🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createSystemPermissionsTokenV2() mutation creates a system permissions token that grants organization-level API access. Unlike user tokens, which carry the permissions of the calling user, system permissions tokens carry only the specific system permissions you assign at creation time. This makes them well suited for automated workflows, service accounts, and integrations that require stable, scoped API credentials independent of any user account.

Provide a token name and at least one SystemPermission value. Optionally set an expiration time or restrict the token to specific IP ranges using an IP filter.

Syntax

graphql
createSystemPermissionsTokenV2(
      input: CreateSystemPermissionTokenV2Input!
   ): CreateSystemPermissionsTokenV2Output!

The mutation accepts a single required input argument of type CreateSystemPermissionTokenV2Input!. The name and systemPermissions fields are required; expireAt and ipFilterId are optional. The mutation returns a non-null CreateSystemPermissionsTokenV2Output! containing the token string and a SystemPermissionsToken metadata object.

Example

Raw
graphql
mutation {
	createSystemPermissionsTokenV2( input:
	  { name: "my-token",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
	createSystemPermissionsTokenV2( input:
	  { name: \"my-token\",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
	createSystemPermissionsTokenV2( input:
	  { name: \"my-token\",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
	createSystemPermissionsTokenV2( input: ^
	  { name: \"my-token\", ^
      systemPermissions: [ ViewOrganizations, ^
                           ManageOrganizations ] ^
    } ) ^
  { token, tokenMetadata { name } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
	createSystemPermissionsTokenV2( input:
	  { name: \"my-token\",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
	createSystemPermissionsTokenV2( input:
	  { name: \"my-token\",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
	createSystemPermissionsTokenV2( input:
	  { name: \"my-token\",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
	createSystemPermissionsTokenV2( input:
	  { name: \"my-token\",
      systemPermissions: [ ViewOrganizations,
                           ManageOrganizations ]
    } )
  { token, tokenMetadata { name } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createSystemPermissionsTokenV2": {
      "token": "abc123",
      "tokenMetadata": {
        "name": "my-token"
      }
    }
  }
}

Input Parameters

Provide the token name and at least one system permission value. An expiration time and IP filter are also accepted. The following table describes all input fields:

Table: CreateSystemPermissionTokenV2Input Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
expireAtLong  Long-Term A Unix timestamp in milliseconds after which the token is no longer valid. If omitted, the token does not expire. Set an expiration time for short-lived tokens in automated workflows or when issuing tokens to external parties.
ipFilterIdString  Long-Term The unique identifier of an IP filter to associate with the token. When set, the token only accepts requests from IP addresses that match the filter. If omitted, the token accepts requests from any IP address.
nameStringyes Long-Term The display name for the token. This name appears in audit logs and the LogScale UI. Choose a name that identifies the service or workflow using the token.
systemPermissionsSystemPermissionyes Long-Term The list of system permissions the token grants. The token can only perform operations covered by the permissions you include here. To identify which permissions a role typically requires, use the roles() query and request the systemPermissions field on each result. See SystemPermission.

Returned Values

The mutation returns a CreateSystemPermissionsTokenV2Output! object. Request token to obtain the raw token string for use in Authorization: Bearer headers. Save this value immediately — LogScale does not expose the token string again after this call returns. To replace a lost token, delete it and create a new one. The following table describes the top-level output fields:

Table: CreateSystemPermissionsTokenV2Output Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
tokenStringyes Long-Term The raw token string for use in Authorization: Bearer headers. Save this value immediately — LogScale does not expose the token string again after this call returns. To replace a lost token, delete it and create a new one.
tokenMetadataSystemPermissionsTokenyes Long-Term Metadata for the newly created token, including its unique identifier, display name, assigned permissions, creation timestamp, expiration time, and IP filter. See SystemPermissionsToken.

The tokenMetadata field returns a SystemPermissionsToken object containing the token's unique identifier, display name, assigned permissions, creation timestamp, expiration time, and IP filter details. The following table describes those fields:

Table: SystemPermissionsToken Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
createdAtlongyes Long-Term The Unix timestamp in milliseconds recording when the token was created.
expireAtlong  Long-Term The Unix timestamp in milliseconds after which the token is no longer valid. Returns null if the token has no expiration.
idstringyes Long-Term The unique identifier of the token. Use this value to reference the token in update or delete operations.
ipFilterstring  Long-Term The string identifier of the IP filter associated with the token, or null if no IP filter is set.
ipFilterV2IPFilter  Long-Term The full IP filter object associated with the token. Returns null if no IP filter is set. See IPFilter.
namestringyes Long-Term The display name of the token as it appears in audit logs and the LogScale UI.
permissions[string]yes Long-Term The list of system permission strings granted to the token. Each value corresponds to a SystemPermission enum member.