Available: Service user tokens v1.265.0

Service user tokens is available from version 1.265.0.

๐ŸŽฏAPI Stability
Short-TermThis API may change in future versions. Use with caution in production environments.

Summary

The createServiceUserToken() mutation creates a named token that authenticates as the user and inherits the same permissions as the user. Unlike createPersonalUserTokenV2(), creating a service user token does not replace any existing token: a user can hold up to 20 unexpired service user tokens at the same time. The limit can be changed with the dynamic configuration parameter MaxServiceUserTokensPerUser. An expiration timestamp is required. Token names must be unique per user. A service user token cannot be used to create another service user token. The token can only be created in the user's own organization but can proxy into other organizations if the user has the appropriate permissions.

The token value is only returned once, in the token field of the response. Store it securely before discarding the response.

Syntax

graphql
createServiceUserToken(
      input: CreateServiceUserTokenInput!
   ): CreateServiceUserTokenOutput!

The mutation accepts a required input argument of type CreateServiceUserTokenInput. The input requires a name (unique per user) and an expireAt Unix epoch timestamp in milliseconds. An optional ipFilterId restricts token usage to the IP addresses defined in the specified IP filter. The mutation returns a non-null CreateServiceUserTokenOutput containing the token string and its associated metadata.

Example

Raw
graphql
mutation {
  createServiceUserToken(
    input: {
      name: "my-service-token",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createServiceUserToken(
    input: {
      name: \"my-service-token\",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createServiceUserToken(
    input: {
      name: \"my-service-token\",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createServiceUserToken( ^
    input: { ^
      name: \"my-service-token\", ^
      expireAt: 1893456000000 ^
    } ^
  ) { ^
    token ^
    tokenMetadata { name } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createServiceUserToken(
    input: {
      name: \"my-service-token\",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createServiceUserToken(
    input: {
      name: \"my-service-token\",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createServiceUserToken(
    input: {
      name: \"my-service-token\",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createServiceUserToken(
    input: {
      name: \"my-service-token\",
      expireAt: 1893456000000
    }
  ) {
    token
    tokenMetadata { name }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createServiceUserToken": {
      "token": "abc123xyz",
      "tokenMetadata": {
        "name": "my-service-token"
      }
    }
  }
}

Supply mock values for name and expireAt. No real expiration condition is required. The response returns the token string in token and the token name in tokenMetadata.name.

Input Parameters

The CreateServiceUserTokenInput type requires a token name and an expiration timestamp. Provide an optional IP filter ID to restrict token usage by IP address. The input parameters are listed here:

Returned Values

The mutation returns a CreateServiceUserTokenOutput object containing the raw token string and a tokenMetadata field of type ServiceUserToken. Request token to retrieve the token value โ€” it is only returned once. Use tokenMetadata to inspect the token's name, IP filter assignment, expiration time, and other attributes.

The CreateServiceUserTokenOutput type includes a tokenMetadata field that returns the full ServiceUserToken datatype. The following table describes the fields available on that sub-type.