🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createSystemPermissionsToken() mutation creates a system permissions token scoped to a specified set of system permissions and returns the token string. System permissions tokens authenticate API calls using organization-level permissions rather than user-level permissions, making them suitable for automated pipelines and service accounts that require consistent access independent of any user account.

This mutation returns only the token string. If you need the token string together with token metadata such as name, assigned permissions, expiration time, and IP filter association, use createSystemPermissionsTokenV2() instead. Use createSystemPermissionsToken() when your workflow only needs the bearer token value and does not require a full metadata response.

Syntax

graphql
createSystemPermissionsToken(
      input: CreateSystemPermissionTokenInput!
   ): String!

The mutation accepts a single required input argument of type CreateSystemPermissionTokenInput!. Provide a token name and a list of system permissions. The mutation returns a non-null String! containing the new token value. Use this string as the bearer token in Authorization: Bearer headers for API calls that require system-level access.

Example

Raw
graphql
mutation {
  createSystemPermissionsToken( input:
     { name: "admin-nurse",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSystemPermissionsToken( input:
     { name: \"admin-nurse\",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSystemPermissionsToken( input:
     { name: \"admin-nurse\",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createSystemPermissionsToken( input: ^
     { name: \"admin-nurse\", ^
       expireAt: null, ^
       permissions: [ ReadHealthCheck ], ^
    } ) ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createSystemPermissionsToken( input:
     { name: \"admin-nurse\",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createSystemPermissionsToken( input:
     { name: \"admin-nurse\",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createSystemPermissionsToken( input:
     { name: \"admin-nurse\",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createSystemPermissionsToken( input:
     { name: \"admin-nurse\",
       expireAt: null,
       permissions: [ ReadHealthCheck ],
    } )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createSystemPermissionsToken": "abc123-def456-ghi789"
  }
}

Input Parameters

Provide a token name and a list of system permissions to assign. You can optionally set an expiration time and restrict token use to specific IP ranges. The following table describes all fields in CreateSystemPermissionTokenInput. Note that this input uses permissions rather than systemPermissions as in createSystemPermissionsTokenV2().

Table: CreateSystemPermissionTokenInput Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
expireAtLong  Long-Term The date when the permission token will expire.
ipFilterIdString  Long-Term The unique identifier of the IP filter for the token.
nameStringyes Long-Term The name for the system permission token to create.
permissionsSystemPermissionyes Long-Term A list of system permissions to grant the token. See SystemPermission.

Returned Values

The mutation returns a String! containing the new token value. Use this string as the bearer token in Authorization: Bearer headers for API calls that require system-level permissions. Store the token securely immediately after creation; there is no separate mutation to retrieve the token value after this call completes. To retrieve token metadata such as name, permissions, and expiration after creation, query the token through the organization's token management queries.