UserOrGroup is a union datatype for a user or a group. Use the Group or User datatypes and their parameters. Below are tables for each:

Table: Group

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
assetIdString,yes   Id of the asset
assetTypeAssetPermissionsAssetType,searchDomainId:String):GroupAssetActionsBySourceyes Short-Term The type of the asset.
assetTypesAssetPermissionsAssetType],yes   List of asset types
defaultQueryPrefixString  Long-Term The default prefix for queries.
defaultRoleRole  Long-Term The default role associated with the group. See Role.
defaultSearchDomainCountIntyes Long-Term The default search domain count.
displayNameStringyes Long-Term The display name of the group.
idStringyes Long-Term The identifier of the group.
limitInt,    The amount of results to return.
lookupNameString  Long-Term The look-up name for the group.
orderByOrderBy):UserResultSetTypeyes Long-Term Choose the order in which the results are returned.
organizationRolesGroupOrganizationRoleyes Long-Term The roles of the organization associated with the group. See GroupOrganizationRole.
permissionTypePermissionType  Long-Term Indicates which level of permissions the group contains. See PermissionType .
permissionsAssetAction]):AssetPermissionSearchResultSetyes Short-Term Include Read, Update and/or Delete permission assignments. The filter will accept all assets if the argument Null or the empty list.
rolesSearchDomainRoleyes Long-Term The roles for the group See SearchDomainRole.
searchDomainCountIntyes Long-Term The number of search domains for the group.
searchDomainIdsString],yes   List of search domain id's to search within. Null or empty list is interpreted as all search domains
searchDomainRoles(searchDomainId: String)SearchDomainRoleyes Long-Term The search domain roles assigned to the group. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: String!)SearchDomainRole  Deprecateddeprecated in 1.195

The search domain roles assigned to the group, by name. See SearchDomainRole. When multiple roles per view is enabled, this field will return only the first of possibly multiple roles matching the name for the view.

Use roles, searchDomainRoles, or searchDomainRolesBySearchDomainName fields instead. This field will be removed at the earliest in version 1.195.

searchDomainRolesBySearchDomainName(searchDomainName: String!)SearchDomainRoleyes Long-Term The domain roles by search domain name. See SearchDomainRole.
searchFilterString,    Filter results based on this string
skipInt,    The number of results to skip or the offset to use. For instance if implementing pagination, set skip = limit * (page - 1)
sortByOrderByUserField,    The value to sort the result set by.
systemRolesGroupSystemRoleyes Long-Term The system roles of the group. See GroupSystemRole.
userCountIntyes Long-Term The number of users that are part of the group.
usersUseryes Long-Term The list of users in the group. See User.

Table: User

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
allowedOrganizationActionsOrganizationActionyes Long-Term Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActionsSystemActionyes Long-Term Returns the actions the user is allowed to perform in the system. See SystemAction Table.
assetIdString,yes   Id of the asset
assetTypeAssetPermissionsAssetType,yes   The type of the asset.
assetTypesAssetPermissionsAssetType],yes   List of asset types
companyString  Long-Term The name of the company for the user account.
countryCodeString  Long-Term The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAtDateTimeyes Long-Term The data and time the account was created.
displayNameStringyes Long-Term The value of the fullName if used, otherwise the username.
emailString  Long-Term The user account's email address for communications from LogScale.
externalUsernameString  Long-Term Readable username for when user stems from Falcon Stability: Long-term
firstNameString  Long-Term The user's actual first name (e.g., Bob). Don't use with fullName.
fullNameString  Long-Term The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groupSearchDomainRolesGroupSearchDomainRoleyes Long-Term The group search domain roles. See GroupSearchDomainRole.
groupsGroupyes Long-Term The groups of which the user is a member. See Group.
idStringyes Long-Term The identifier or token for the user.
isOrgRootBooleanyes Long-Term Whether the organization is granted organization ownership.
isRootBooleanyes Long-Term Whether the user account is granted root access.
lastNameString  Long-Term The user's actual last name or family name (e.g., Smith). Don't use with fullName.
limitInt,    The amount of results to return.
orderByOrderBy,    Choose the order in which the results are returned.
permissionsAssetAction]):AssetPermissionSearchResultSetyes Short-Term Permissions of the user. See UserPermissions.
phoneNumberString  Long-Term The telephone number for LogScale to use for telephone text messages.
pictureString  Long-Term File name of an image file for the account.
searchDomainIdString):[AssetActionsBySourceyes Short-Term Search domain id
searchDomainIdsString],yes   List of search domain id's to search within. Null or empty list is interpreted as all search domains
searchDomainRoles(searchDomainId: String)SearchDomainRoleyes Long-Term The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: String!)SearchDomainRole  Deprecateddeprecated in 1.195

The search domain roles for the user, by name. See SearchDomainRole.

This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.

searchDomainRolesBySearchDomainName(searchDomainName: String!)SearchDomainRoleyes Long-Term The search domain roles assigned to the user by search domain name. See SearchDomainRole.
searchFilterString,    Filter results based on this string
skipInt,searchInRoles:Boolean):GroupResultSetTypeyes Short-Term The number of results to skip or the offset to use. For instance if implementing pagination, set skip = limit * (page - 1)
sortBySortBy,    The sort by options for assets. Asset name is default
stateCodeString  Long-Term The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
usernameStringyes Long-Term The user name for the account.
viewNameString):[UserPermissionsyes Long-Term Exact name of the repo to find permissions for.