🎯API Stability
Short-TermThis API may change in future versions. Use with caution in production environments.

Summary

The enableOrganizationIocAccess() mutation grants IOC (indicators of compromise) database access to a specified organization. Organizations without IOC access cannot use threat indicator data to enrich searches or correlate events against the configured IOC database. This mutation requires Organization Manager permission. To remove access, use disableOrganizationIocAccess().

Syntax

graphql
enableOrganizationIocAccess(
      input: EnableOrganizationIocAccess!
   ): Organization!

The required input argument accepts an EnableOrganizationIocAccess object with a single field, organizationId, identifying the organization for which you want to enable IOC access. Use the searchOrganizations() query in the Related section to retrieve organization identifiers.

The mutation returns an Organization! object (non-null). See the Returned Values section for the fields available on this type.

Example

Raw
graphql
mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: "abc123"
    } ) {
    id
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: \"abc123\"
    } ) {
    id
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: \"abc123\"
    } ) {
    id
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  enableOrganizationIocAccess( input: ^
    { ^
      organizationId: \"abc123\" ^
    } ) { ^
    id ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: \"abc123\"
    } ) {
    id
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: \"abc123\"
    } ) {
    id
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: \"abc123\"
    } ) {
    id
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  enableOrganizationIocAccess( input:
    {
      organizationId: \"abc123\"
    } ) {
    id
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "enableOrganizationIocAccess": true,
    "id": "abc123"
  }
}

Input Parameters

The input argument requires an organizationId value, which is the unique internal identifier for the organization — not its display name. Use the searchOrganizations() query in the Related section to retrieve identifiers for all organizations.

Table: EnableOrganizationIocAccess Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
organizationIdStringyes   Id of organization

Returned Values

The mutation returns an Organization object reflecting the updated organization state. To confirm the operation succeeded, check details.iocAccess, which returns true after a successful enable. The Organization type also includes configuration, limits, URLs, and other organizational metadata.

Table: Organization Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionOrganizationAction):Booleanyes Short-Term The action to check if a user is allowed to perform on an organization.
cidString  Short-Term The CID corresponding to the organization.
configsOrganizationConfigsyes Short-Term Organization configurations and settings. See OrganizationDetails.
createdAtLong  Short-Term Date organization was created.
defaultCachePolicyCachePolicy  Short-Term The default cache policy of the organization. See CachePolicy. This is a preview and subject to change.
deletedAtLong  Short-Term Day organization was deleted if it was marked for deletion.
descriptionString  Short-Term The description for the Organization. Can be null.
detailsOrganizationDetailsyes Short-Term Any additional details related to the organization. See OrganizationDetails.
externalGroupSynchronizationBooleanyes Short-Term Whether there is group synchronization.
externalPermissionsBooleanyes Short-Term Whether permissions are managed externally.
idStringyes Short-Term The unique id for the Organization.
ingestUrlString  Short-Term The ingest URL for the organization.
limitsLimityes Short-Term Limits assigned to the organization. See Limit.
limitsV2LimitV2yes Short-Term Limits assigned to the organization. See LimitV2.
nameStringyes Short-Term The name for the Organization.
publicUrlString  Short-Term The public URL for the organization.
readonlyDashboardIPFilterString  Short-Term IP filter for readonly dashboard links.
searchDomainsSearchDomainyes Short-Term Search domains within the organization. See SearchDomain.
statsOrganizationStatsyes Short-Term Statistics of the organization. See OrganizationStats.
trialStartedAtLong  Short-Term Date organization's trial started.