The installPackageFromZip() GraphQL mutation field may be used to install a package from file provided in multipart or form-data (i.e, name=file) in a specific view.

Use updatePackageFromZip() to update a package from a zip file. To uninstall a package, use the uninstallPackage() mutation.

Hide Query Example

Show Installed Packages Query

For more information on packages, see the Package Management documentation page.

API Stability Long-Term

Syntax

graphql
installPackageFromZip(
     viewName: string!, 
     overwrite: boolean,
     queryOwnershipType: QueryOwnershipType
   ): InstallPackageFromZipResult!

You'll have to provide the name of the view or repository where to install the package. You also can indicate whether to overwrite an existing installation, and specify the type of query ownership. See the Given Datatype section for details.

For the results, you'll receive confirmation if successful through a simple parameter. See the Returned Datatype section.

Example

Raw
graphql
mutation {
  installPackageFromZip (
    viewName: "humio",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  installPackageFromZip (
    viewName: \"humio\",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  installPackageFromZip (
    viewName: \"humio\",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  installPackageFromZip ( ^
    viewName: \"humio\", ^
    overwrite: true, ^
    queryOwnershipType: User ^
  ) ^
  { wasSuccessful } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  installPackageFromZip (
    viewName: \"humio\",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  installPackageFromZip (
    viewName: \"humio\",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  installPackageFromZip (
    viewName: \"humio\",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  installPackageFromZip (
    viewName: \"humio\",
    overwrite: true,
    queryOwnershipType: User
  )
  { wasSuccessful }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "installPackageFromZip": {
      "wasSuccessful": true
    }
  }
}

Given Datatype

For the input, you'll need to give the name of the view or repository where to install the package. You also can indicate whether to overwrite an existing installation, and specify the type of query ownership (see second table below).

Table: Input Using Standard Datatypes

Parameter Type Required Default Description
overwrite boolean     Whether to overwrite an existing installation.
viewName string yes   The name of the view or repository where to install.

Ownership relates to the queries run by the triggers (e.g. alerts and scheduled searches) that are installed as part of the package. For instance, User indicates ownership will be based on the calling user.

Table: QueryOwnershipType

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2025
Organization   Long-TermQueries are run on behalf of the organization.
User   Long-TermQueries are run on behalf of the user.

Returned Datatype

For this datatype, the only result is whether the mutation was successful or not. The table below describes this:

Table: InstallPackageFromZipResult

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Apr 10, 2026
wasSuccessfulbooleanyes Long-TermWhether package was installed successfully.