🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The redactEvents() mutation permanently removes events from a LogScale repository. Provide a query and a time interval to match the target events. The mutation returns the task identifier for the submitted redaction job. Pass this identifier to cancelRedactEvents() to stop the job before it completes.

Syntax

graphql
redactEvents(
     input: RedactEventsInputType!
   ): String!

The mutation takes a single required argument, input, of type RedactEventsInputType!. Provide the repository name, query, and time interval as fields on this input. The String! return type is non-null: the mutation always returns the task identifier for the submitted redaction job.

Example

Raw
graphql
mutation {
  redactEvents(
    input: {
      repositoryName: "humio",
      start: "2025-11-12T03:00:00.000Z",
      end: "2025-11-12T03:15:00.000Z",
      query: "password=*",
      userMessage: "Hiding Passwords"
    }
  )
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  redactEvents(
    input: {
      repositoryName: \"humio\",
      start: \"2025-11-12T03:00:00.000Z\",
      end: \"2025-11-12T03:15:00.000Z\",
      query: \"password=*\",
      userMessage: \"Hiding Passwords\"
    }
  )
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  redactEvents(
    input: {
      repositoryName: \"humio\",
      start: \"2025-11-12T03:00:00.000Z\",
      end: \"2025-11-12T03:15:00.000Z\",
      query: \"password=*\",
      userMessage: \"Hiding Passwords\"
    }
  )
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  redactEvents( ^
    input: { ^
      repositoryName: \"humio\", ^
      start: \"2025-11-12T03:00:00.000Z\", ^
      end: \"2025-11-12T03:15:00.000Z\", ^
      query: \"password=*\", ^
      userMessage: \"Hiding Passwords\" ^
    } ^
  ) ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  redactEvents(
    input: {
      repositoryName: \"humio\",
      start: \"2025-11-12T03:00:00.000Z\",
      end: \"2025-11-12T03:15:00.000Z\",
      query: \"password=*\",
      userMessage: \"Hiding Passwords\"
    }
  )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  redactEvents(
    input: {
      repositoryName: \"humio\",
      start: \"2025-11-12T03:00:00.000Z\",
      end: \"2025-11-12T03:15:00.000Z\",
      query: \"password=*\",
      userMessage: \"Hiding Passwords\"
    }
  )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  redactEvents(
    input: {
      repositoryName: \"humio\",
      start: \"2025-11-12T03:00:00.000Z\",
      end: \"2025-11-12T03:15:00.000Z\",
      query: \"password=*\",
      userMessage: \"Hiding Passwords\"
    }
  )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  redactEvents(
    input: {
      repositoryName: \"humio\",
      start: \"2025-11-12T03:00:00.000Z\",
      end: \"2025-11-12T03:15:00.000Z\",
      query: \"password=*\",
      userMessage: \"Hiding Passwords\"
    }
  )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "redactEvents": "abc123"
  }
}

Input Parameters

The RedactEventsInputType input requires the repository name, the redaction query, and the start and end of the time interval. It also accepts an optional audit log message. The following table describes the fields of this input type.

Table: RedactEventsInputType Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
endDateTimeyes Long-Term The end of the interval in which to perform redactions.
queryStringyes Long-Term The query to use for redaction. Any event returned by this query will be removed.
repositoryNameStringyes Long-Term The name of the repository in which to redact events.
startDateTimeyes Long-Term The start of the interval from which to perform redactions.
userMessageString  Long-Term Optional message to log in the audit log for this action.