Data source Save & test passes but Explore queries fail — what the health check validates

Validating integrations without production secrets

Teams need to confirm that a Grafana data source integration works before promoting it to production, ideally without using production credentials. The built-in Save & test button runs a lightweight health check against the configured endpoint, but its depth varies by plugin.

Where the green check can mislead

A successful health check typically confirms reachability and that the supplied credentials are accepted. For many core and third-party plugins, however, the probe is only a version or ping request — it does not verify that the account can execute the actual queries your dashboards depend on. Missing query permissions, an incorrect default database, TLS mismatches, or clock skew often surface only when a real panel query runs.

Plugin behavior is not uniform

Core data sources (Prometheus, Loki, PostgreSQL, etc.) each implement their own health check logic. Community plugins may implement none at all, making Save & test effectively a connectivity ping. Without knowing exactly what request the plugin issues, teams cannot rely on the green result as evidence of readiness.

For a given data source plugin, how can you determine exactly what the Save & test endpoint calls without inspecting backend logs? What minimal representative query should be run in Explore to confirm the test credential has the permissions your dashboards require? Is there a documented matrix of health check behavior across core and community plugins for a specific Grafana version?