createOrganizationPermissionsTokenV2()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createOrganizationPermissionsTokenV2() mutation creates an organization permissions token and returns both the token string and a metadata object that includes the token ID, assigned permissions, IP filter, and expiration time. Use this mutation when you need the token ID in the same response — for example, to immediately call updateOrganizationPermissionsTokenPermissions() or deleteToken() without a separate lookup query. Store the token string at creation time — it is not retrievable after the call completes. Use createOrganizationPermissionsToken() instead when you need only the token string and do not require the token ID or full metadata in the same response.

To modify the permissions on an existing token, use updateOrganizationPermissionsTokenPermissions(). To delete a token, use deleteToken(). Both mutations require the token ID, which this mutation returns in tokenMetadata.id.

Hide Query Example

Show Tokens and Permissions Query

To list existing organization permissions tokens, use the tokens() query with typeFilter: OrganizationPermissionToken:

graphql

query {
     tokens( typeFilter: OrganizationPermissionToken,
             sortBy: Name )
        { totalResults,
          results { id, name }
          }
   }

To list permissions available for organization permissions tokens, use the roles() query:

graphql

query {
    roles
       { totalResults,
         results { id, displayName,
                   organizationPermissions }
    }
   }

For more information on organization settings, see the Organization Settings documentation page. For related authorization concepts, see Manage Users and Permissions. For information on access tokens of various types, see Ingest Tokens.

Syntax

graphql

createOrganizationPermissionsTokenV2(
      input: CreateOrganizationPermissionsTokenV2Input!
   ): CreateOrganizationPermissionsTokenV2Output!

The mutation takes a single required argument, input, of type CreateOrganizationPermissionsTokenV2Input!. The input requires a token name in name and a list of organization-level permissions in organizationPermissions. Optionally, set expireAt to a Unix epoch millisecond timestamp to create a token with a fixed lifetime, or omit it to create a non-expiring token. Set ipFilterId to the ID of an existing IP filter to restrict the token to permitted source addresses.

The mutation returns a non-null CreateOrganizationPermissionsTokenV2Output object containing the token string and a tokenMetadata object of type OrganizationPermissionsToken. Store the token string at creation time — it is not retrievable after the call completes. Request tokenMetadata.id to obtain the identifier needed for subsequent lifecycle mutations.

Example

Raw

graphql

mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: "my-org-access-token",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: \"my-org-access-token\",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: \"my-org-access-token\",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createOrganizationPermissionsTokenV2(input: ^
         { name: \"my-org-access-token\", ^
          organizationPermissions: [ ManageUsers, ViewUsage ] ^
        }) ^
  { token, tokenMetadata { id, expireAt } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: \"my-org-access-token\",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: \"my-org-access-token\",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: \"my-org-access-token\",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createOrganizationPermissionsTokenV2(input:
         { name: \"my-org-access-token\",
          organizationPermissions: [ ManageUsers, ViewUsage ]
        })
  { token, tokenMetadata { id, expireAt } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createOrganizationPermissionsTokenV2": {
      "token": "abc123-def456-ghi789",
      "tokenMetadata": {
        "id": "abc123",
        "expireAt": null
      }
    }
  }
}

Input Parameters

The required fields are name and organizationPermissions. Set expireAt to a Unix epoch millisecond timestamp to limit the token's lifetime; omit it or set it to null to create a non-expiring token. Set ipFilterId to the ID of an existing IP filter to restrict the token to permitted source addresses. The following table describes all available input fields:

Table: CreateOrganizationPermissionsTokenV2Input Input Datatype

Parameter	Type	Required	Stability	Description
expireAt	Long		`Long-Term`	When the token expires.
ipFilterId	String		`Long-Term`	The unique identifier of the filter to use.
name	String	yes	`Long-Term`	The name of the organization permissions token.
organizationPermissions	OrganizationPermission	yes	`Long-Term`	A list of organization permissions. See OrganizationPermission.

Returned Values

The mutation returns the token string in token and a tokenMetadata object of type OrganizationPermissionsToken that includes the token ID, name, assigned permissions, IP filter, creation timestamp, and expiration time. Store the token string at creation time — it is not retrievable after the call completes. Request tokenMetadata.id to obtain the identifier needed by updateOrganizationPermissionsTokenPermissions() and deleteToken(). A null tokenMetadata.expireAt value means the token does not expire. The following table lists the available output fields:

Table: CreateOrganizationPermissionsTokenV2Output Datatype

Parameter	Type	Required	Default	Stability	Availability	Description
token	String	yes		`Long-Term`		The organization permissions token.
tokenMetadata	OrganizationPermissionsToken	yes		`Long-Term`		Metadata about the token. See OrganizationPermissionsToken.

The CreateOrganizationPermissionsTokenV2Output type includes a tokenMetadata field that returns the full OrganizationPermissionsToken datatype. The following table describes the fields available on that sub-type.

Table: OrganizationPermissionsToken Datatype

Parameter	Type	Required	Stability	Description
createdAt	long	yes	`Long-Term`	The date the token was created.
expireAt	long		`Long-Term`	The time at which the token expires.
id	string	yes	`Long-Term`	The unique identifier of the token.
ipFilter	string		`Long-Term`	The token's IP filter.
ipFilterV2	IPFilter		`Long-Term`	The token's IP filter. See IPFilter.
name	string	yes	`Long-Term`	The name of the token.
permissions	[string]	yes	`Long-Term`	The set of permissions on the token.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes