Before creating an email action, you can use the testEmailAction() GraphQL mutation to test your parameters for an email action, including sending the recipients an email.

This mutation doesn't test an existing email action. Instead, once you have the action the way you want and have tested it successfully, you would copy and paste everything into the parameters of the createEmailAction() mutation. These two mutations, though, are tied together in the user interface. Only through the UI can you create an action, test it, and then save it. See the Action Type: Email page in the main documentation.

Since this test mutation doesn't save the email action, you can't update it later, nor do you need to delete it. To update an existing email action, though, use the updateEmailAction() mutation. Use the deleteActionV2() to delete an existing one.

API Stability Long-Term
Security Requirement & Control CreateActions API permission

Syntax

graphql
testEmailAction(
      input: TestEmailAction!
   ): TestResult!

For the input, you would give almost all of the same parameters as when creating an email action, plus two more: triggerName for a fake name of a trigger; and eventData for JSON formatted data containing events. Besides these two, at a minimum, you'll also have to give a list of email addresses — it could be just you for the test — indicate whether to use a proxy, and give a name for the email action. See the Given Datatype section father down this page for more parameters and explanations.

For the results, you either can get an error message, or you can get an indication it was successful along with a message saying as much. See the Returned Datatype section for these parameters.

Example

Raw
graphql
mutation {
  testEmailAction( input: 
    { viewName: "humio",
      name: "email-admin",
      recipients: [ "bob@company.com" ],
      useProxy: false,
      triggerName: "fire",
      eventData: "[{\"#type\":\"kv\"}]",
      } )
  { success, message }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  testEmailAction( input: 
    { viewName: \"humio\",
      name: \"email-admin\",
      recipients: [ \"bob@company.com\" ],
      useProxy: false,
      triggerName: \"fire\",
      eventData: \"[{\\"#type\\":\\"kv\\"}]\",
      } )
  { success, message }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  testEmailAction( input: 
    { viewName: \"humio\",
      name: \"email-admin\",
      recipients: [ \"bob@company.com\" ],
      useProxy: false,
      triggerName: \"fire\",
      eventData: \"[{\\"#type\\":\\"kv\\"}]\",
      } )
  { success, message }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  testEmailAction( input:  ^
    { viewName: \"humio\", ^
      name: \"email-admin\", ^
      recipients: [ \"bob@company.com\" ], ^
      useProxy: false, ^
      triggerName: \"fire\", ^
      eventData: \"[{\\"#type\\":\\"kv\\"}]\", ^
      } ) ^
  { success, message } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  testEmailAction( input: 
    { viewName: \"humio\",
      name: \"email-admin\",
      recipients: [ \"bob@company.com\" ],
      useProxy: false,
      triggerName: \"fire\",
      eventData: \"[{\\"#type\\":\\"kv\\"}]\",
      } )
  { success, message }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  testEmailAction( input: 
    { viewName: \"humio\",
      name: \"email-admin\",
      recipients: [ \"bob@company.com\" ],
      useProxy: false,
      triggerName: \"fire\",
      eventData: \"[{\\"#type\\":\\"kv\\"}]\",
      } )
  { success, message }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  testEmailAction( input: 
    { viewName: \"humio\",
      name: \"email-admin\",
      recipients: [ \"bob@company.com\" ],
      useProxy: false,
      triggerName: \"fire\",
      eventData: \"[{\\"#type\\":\\"kv\\"}]\",
      } )
  { success, message }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  testEmailAction( input: 
    { viewName: \"humio\",
      name: \"email-admin\",
      recipients: [ \"bob@company.com\" ],
      useProxy: false,
      triggerName: \"fire\",
      eventData: \"[{\\"#type\\":\\"kv\\"}]\",
      } )
  { success, message }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "testEmailAction": {
      "success": true,
      "message": "OK: Action test was successful"
    }
  }
}

Given Datatype

For this input datatype, there are a few required parameters. You can see them in the table below. They're about the same as when creating an email action. The triggerName is an extra one: it's for giving a fake name of a trigger. The critical parameter is eventData. It's for providing JSON formatted data containing events for a more realistic test.

Table: TestEmailAction

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 28, 2025
attachCsvboolean falseLong-TermWhether the result set should be be attached as a CSV file.
bodyTemplatestring  Long-TermThe body of the email. Can be templated with values from the result.
eventDatastringyes Long-TermJSON data representing one or more events. One event can be supplied as a JSON object. Multiple events must be supplied as a list of JSON objects.
namestringyes Long-TermThe name of the action.
recipients[string]yes Long-TermA list of email addresses where to send an email.
subjectTemplatestring  Long-TermThe subject of the email. Can be templated with values from the result.
triggerNamestringyes Long-TermThe name of the action. This is a mock value. The trigger doesn't have to exist.
useProxybooleanyes Long-TermDefines whether the action should use the configured proxy to make web requests.
viewNamestringyes Long-TermThe name of the view of the action.

Returned Datatype

The returned datatype will tell you if the test was succesful and it will provide a message explaining this (see the Example above). These parameters are described in the table below:

Table: TestResult

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2024
messagestringyes Long-TermA message explaining the test result.
successbooleanyes Long-TermTrue if the test was a success, false otherwise.