🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createActionFromPackageTemplate() mutation creates an action in a repository or view by instantiating a named action template from an installed package. Use this mutation when a package provides preconfigured action templates and you want to add one of those actions without defining the action from scratch. To create an action from a standalone YAML template instead, use createActionFromTemplate().

Syntax

graphql
createActionFromPackageTemplate(
      viewName: String!,
      packageId: VersionedPackageSpecifier!,
      actionTemplateName: String!,
      overrideName: String
   ): CreateActionFromPackageTemplateMutation!

Provide the target view or repository name, the versioned package identifier, and the name of the action template within that package. The optional overrideName argument sets a custom name for the new action; when omitted, the action takes its name from the template. The mutation returns a non-null CreateActionFromPackageTemplateMutation object containing the created action and its configuration.

Select Show Installed Packages Query for an example of how to retrieve available package IDs and their action template names.

Hide Query Example

Show Installed Packages Query

Example

Raw
graphql
mutation {
  createActionFromPackageTemplate(
         viewName: "humio", 
         packageId: "crowdstrike/logscale-slack@1.0.0", 
         actionTemplateName: "Slack")
  {action {name, isAllowedToRun, allowedActions} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createActionFromPackageTemplate(
         viewName: \"humio\", 
         packageId: \"crowdstrike/logscale-slack@1.0.0\", 
         actionTemplateName: \"Slack\")
  {action {name, isAllowedToRun, allowedActions} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createActionFromPackageTemplate(
         viewName: \"humio\", 
         packageId: \"crowdstrike/logscale-slack@1.0.0\", 
         actionTemplateName: \"Slack\")
  {action {name, isAllowedToRun, allowedActions} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createActionFromPackageTemplate( ^
         viewName: \"humio\",  ^
         packageId: \"crowdstrike/logscale-slack@1.0.0\",  ^
         actionTemplateName: \"Slack\") ^
  {action {name, isAllowedToRun, allowedActions} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createActionFromPackageTemplate(
         viewName: \"humio\", 
         packageId: \"crowdstrike/logscale-slack@1.0.0\", 
         actionTemplateName: \"Slack\")
  {action {name, isAllowedToRun, allowedActions} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createActionFromPackageTemplate(
         viewName: \"humio\", 
         packageId: \"crowdstrike/logscale-slack@1.0.0\", 
         actionTemplateName: \"Slack\")
  {action {name, isAllowedToRun, allowedActions} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createActionFromPackageTemplate(
         viewName: \"humio\", 
         packageId: \"crowdstrike/logscale-slack@1.0.0\", 
         actionTemplateName: \"Slack\")
  {action {name, isAllowedToRun, allowedActions} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createActionFromPackageTemplate(
         viewName: \"humio\", 
         packageId: \"crowdstrike/logscale-slack@1.0.0\", 
         actionTemplateName: \"Slack\")
  {action {name, isAllowedToRun, allowedActions} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createActionFromPackageTemplate": {
      "action": {
        "name": "Slack",
        "isAllowedToRun": true,
        "allowedActions": [
          "Read",
          "Update"
        ]
      }
    }
  }
}

Input Parameters

Provide the target view name, the versioned package identifier, and the name of the action template within that package. The overrideName argument is optional. Select Show Installed Packages Query in the Syntax section to retrieve these details.

Table: Input Parameters and Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
actionTemplateName string yes   The name of the action template within the package. This name identifies which template to instantiate when a package contains multiple action templates.
overrideName string     A custom name for the new action. When omitted, the action uses the name defined in the template. Set this argument to distinguish multiple instances of the same template in the same view.
packageId VersionedPackageSpecifier yes   The versioned identifier of the installed package that contains the action template. The format is namespace/name@version, for example, humio/insights@0.0.14.
viewName string yes   The name of the view or repository where the package is installed and where the new action will be created.

Returned Values

The mutation returns a CreateActionFromPackageTemplateMutation object containing the newly created action and its full configuration, including any default settings supplied by the template. Inspect these values to confirm the action was created correctly before referencing it in alerts or scheduled searches.

Table: CreateActionFromPackageTemplateMutation Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionActionyes Long-Term The action to create from a package template. See Action.

The CreateActionFromPackageTemplateMutation type includes an action field that returns an Action object. The following table lists the available Action fields:

Table: Action Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
allowedActionsAssetActionyes Short-Term A list of allowed asset actions. See AssetAction.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the action. See AssetCommitMetadata.
displayNameStringyes Long-Term The display name of the action.
idStringyes Long-Term The unique identifier of the action.
isAllowedToRunBooleanyes Long-Term Whether the action is allowed to run. Should be false if this type of action is disabled because of a security policy.
labelsStringyes Long-Term Labels attached to the action.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the action. See AssetCommitMetadata.
nameStringyes Long-Term The name of the action.
packagePackageInstallation  Long-Term The package, if any, of which the action is part. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package. See VersionedPackageSpecifier.
requiresOrganizationOwnedQueriesPermissionToEditBooleanyes Long-Term This should be set to true if this action is used by triggers, where the query is run by the organization. If true, then the OrganizationOwnedQueries permission is required to edit the action.
resourceStringyes Short-Term The resource identifier for the action.
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the action. YAML is a scalar.