Application Programming Interfaces (APIs)
There are several application programming interfaces, known as APIs, that are available for use with Falcon LogScale. Collectively, these are known as the REST APIs, and they use the HTTP protocol. Everything you can do in LogScale's UI can be done through them. In fact, the UI is constructed using solely the public API.
Why use REST APIs?
There are several compelling reasons to use the REST APIs instead of (or in addition to) the UI. These are listed in the rest of this section.
Automation and Scripting:
Scheduled tasks - Automate repetitive queries, report generation, or data exports without manual intervention
CI/CD pipelines - Integrate LogScale operations into deployment workflows (e.g., automatically updating parsers or dashboards on release)
Bulk operations - Perform actions at scale that would be tedious to do manually in the UI
Data Ingestion:
Custom log shippers - Send log data programmatically from applications, services, or devices that don't have a native LogScale integration
High-volume ingestion - Ingest structured data directly from your own applications or pipelines
Integration with External Systems:
SIEM/SOAR workflows - Trigger queries or alerts from external orchestration platforms
Custom dashboards - Pull LogScale data into third-party BI tools (e.g., Grafana, Tableau)
Ticketing systems - Automatically create incidents in tools like Jira or ServiceNow based on query results
Programmatic Query Execution:
Application-embedded analytics - Surface LogScale query results within your own applications
Dynamic queries - Build queries programmatically based on runtime parameters
Administration and Configuration Management:
Infrastructure-as-Code - Manage repositories, users, parsers, saved queries, and alerts via Terraform or similar tools
Audit and compliance - Extract configuration states for documentation or change tracking
Limitations of the UI:
The UI is inherently interactive and synchronous - not suited for unattended or long-running operations
No native multi-tenant bulk management across many repositories simultaneously
Difficult to version control changes made through the UI
In summary, the REST API is preferred whenever repeatability, scale, integration, or automation is required beyond what a human-driven interface can efficiently provide.
Primary & Essential APIs
Below is a list of the primary and essential APIs available with Falcon LogScale. The headings are links to pages that will provide more information than the brief descriptions here.
Almost everything you might do with an application will require authentication. This is the first step. This API is used for doing that, for authenticating with LogScale.
This is the main endpoint for executing queries in LogScale. It streams results as soon as they're calculated. Depending on the query type filter or aggregate, the time of delivery changes.
Almost any administrative tasks that can be done in LogScale can be done using GraphQL. It's the API that LogScale software uses internally. This section contains an extensive reference manual for all mutations and queries, as well as datatypes used by the GraphQL API
Administrative APIs
These APIs are primarily for performing administrative tasks on LogScale.
If you're self-hosting Falcon LogScale and have set up your own cluster, this API may be used to manage your cluster.
With this API, you can redact individual events from a compressed segment files. It's intended to support removal of a small number of events from LogScale. Usually, this is used to remove personally identifiable information (e.g., a GDPR requirement), accidentally logged passwords or other confidential data from LogScale.
Server logs and other such data can be sent to LogScale and a repository using the Ingest API. That can be sent in a structured format, or it can be sent as it is, relying on LogScale parsers to add structure to it.
This API can be used to upload CSV or JSON files. These may then be used by the
match()functions.The health of LogScale can be determined by a set of individual health checks. This includes a Status API and a Health API.
In addition to LogScale's APIs, there are a few software libraries (click on the heading here for more) that can be used to integrate applications — written in other programming languages (e.g., JavaScript, Python) — into LogScale. Although they work, CrowdStrike doesn't offer support for them.
Attention
REST & GraphQL
Falcon LogScale has a mixture of GraphQL and REST endpoints. You can read about the motivation behind using GraphQL, as well as an introduction to GraphQL if you are not familiar with the technology.
Some of the REST endpoints described above are deprecated. We strongly encourage you to use the corresponding GraphQL queries and mutations instead. See the reference page on GraphQL for more information.