createOrganizationPermissionsToken()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createOrganizationPermissionsToken() mutation creates an organization permissions token and returns the token string directly as a bearer credential for organization-level API calls. Because the response contains only the token string and not the token ID, store the token value at creation time — it cannot be retrieved again. To manage the token's lifecycle after creation (for example, to call updateOrganizationPermissionsTokenPermissions() or deleteToken()), look up the token ID using the tokens() query with typeFilter: OrganizationPermissionToken. Use createOrganizationPermissionsTokenV2() instead when you need the token ID and full metadata returned in a single call.

To modify the permissions on an existing organization permissions token, use updateOrganizationPermissionsTokenPermissions(). To delete a token, use deleteToken(). Both mutations require the token ID, which this mutation does not return. Look up the token ID using the tokens() query shown below, or use createOrganizationPermissionsTokenV2() to receive the token ID at creation time.

Hide Query Example

Show Tokens and Permissions Query

To get a list of organization permissions tokens, use the tokens() query like this:

graphql

query {
     tokens( typeFilter: OrganizationPermissionToken,
             sortBy: Name )
        { totalResults,
          results { id, name }
          }
   }

To get a list of permissions for organization permissions tokens, use the roles() query:

graphql

query {
    roles
       { totalResults,
         results { id, displayName,
                   organizationPermissions }
    }
   }

For more information on organization settings, see the Organization Settings documentation page. See the Manage Users and Permissions page for related authorization information. For information on access tokens of various types, see the Ingest Tokens documentation page.

Syntax

graphql

createOrganizationPermissionsToken(
      input: CreateOrganizationPermissionTokenInput!
   ): String!

The required input argument accepts a CreateOrganizationPermissionTokenInput object. This object requires a token name and a list of organization permissions. The mutation returns the token string directly as a non-null String.

On success, the mutation returns the token string as a bearer credential. Include this value in the Authorization: Bearer header of organization-level API requests. Store the token at creation time — this mutation does not return the token ID, and the token string is not retrievable after the call completes.

Example

Raw

graphql

mutation {
  createOrganizationPermissionsToken(input:
         {name: "key-people",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createOrganizationPermissionsToken(input:
         {name: \"key-people\",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createOrganizationPermissionsToken(input:
         {name: \"key-people\",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createOrganizationPermissionsToken(input: ^
         {name: \"key-people\", ^
          expireAt: null, ^
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ] ^
        } ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createOrganizationPermissionsToken(input:
         {name: \"key-people\",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createOrganizationPermissionsToken(input:
         {name: \"key-people\",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createOrganizationPermissionsToken(input:
         {name: \"key-people\",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createOrganizationPermissionsToken(input:
         {name: \"key-people\",
          expireAt: null,
          permissions: [ManageUsers, ViewFleetManagement, ChangeFleetManagement ]
        } )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createOrganizationPermissionsToken": "abc123-def456-ghi789"
  }
}

Input Parameters

Provide a token name and a list of organization permissions in the input. Set expireAt to a timestamp to create a token that expires automatically; set it to null to create a token with no expiration. The following table describes all available input parameters:

Table: CreateOrganizationPermissionTokenInput Input Datatype

Parameter	Type	Required	Stability	Description
expireAt	Long		`Long-Term`	When the organization permission token will expire.
ipFilterId	String		`Long-Term`	The unique identifier for the related IP filter.
name	String	yes	`Long-Term`	The name of the organization token.
permissions	OrganizationPermission	yes	`Long-Term`	A list of permissions for the organization. See OrganizationPermission.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes