🎯API Stability
Short-TermThis API may change in future versions. Use with caution in production environments.

Summary

The unassignOrganizationManagementRoleFromGroup() mutation removes an organization management role from a group in one or more organizations. Organization management roles grant elevated administrative capabilities at the organization level, distinct from repository-level and system-level role assignments. Specifying multiple organization IDs removes the role across all of them in a single call. Other role assignments for the group are unaffected. To grant an organization management role to a group, use assignOrganizationManagementRoleToGroup().

Syntax

graphql
unassignOrganizationManagementRoleFromGroup(
      input: UnassignOrganizationManagementRoleFromGroupInput!
   ): UnassignOrganizationManagementRoleFromGroup!

The mutation accepts a single required input argument of type UnassignOrganizationManagementRoleFromGroupInput!. The input requires three fields: groupId, roleId, and organizationIds. The organizationIds field accepts a list, so you can remove the role across multiple organizations in a single call. The mutation returns a non-null UnassignOrganizationManagementRoleFromGroup object containing the updated group. Use the roles() query to retrieve the identifiers needed for the input fields.

The returned object exposes the updated Group type, from which you can query user membership, asset access, and role assignments. See the Returned Values section for available fields.

Example

Raw
graphql
mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: "abc123",
       roleId: "def456",
       organizationIds:[ "SINGLE_ORGANIZATION_ID" ]
     } 
  )
  { group { displayName } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: \"abc123\",
       roleId: \"def456\",
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ]
     } 
  )
  { group { displayName } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: \"abc123\",
       roleId: \"def456\",
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ]
     } 
  )
  { group { displayName } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  unassignOrganizationManagementRoleFromGroup(input: ^
     { groupId: \"abc123\", ^
       roleId: \"def456\", ^
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ] ^
     }  ^
  ) ^
  { group { displayName } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: \"abc123\",
       roleId: \"def456\",
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ]
     } 
  )
  { group { displayName } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: \"abc123\",
       roleId: \"def456\",
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ]
     } 
  )
  { group { displayName } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: \"abc123\",
       roleId: \"def456\",
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ]
     } 
  )
  { group { displayName } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  unassignOrganizationManagementRoleFromGroup(input:
     { groupId: \"abc123\",
       roleId: \"def456\",
       organizationIds:[ \"SINGLE_ORGANIZATION_ID\" ]
     } 
  )
  { group { displayName } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "unassignOrganizationManagementRoleFromGroup": {
      "group": {
        "displayName": "sales"
      }
    }
  }
}

Input Parameters

Provide the unique identifiers for the group, the management role, and the organizations from which you want to remove the role assignment. All three input fields are required. Use the roles() query shown in the Related section to retrieve role and group identifiers.

Table: UnassignOrganizationManagementRoleFromGroupInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
groupIdStringyes Preview The unique identifier for the group.
organizationIdsStringyes Preview The unique identifiers for the organization.
roleIdStringyes Preview The unique identifier for the role.

Returned Values

The mutation returns the updated Group object. You can query user membership, assigned organization roles, and accessible assets from the returned object. This confirms the role removal and enables you to verify the group's current role state in a single call.

Table: UnassignOrganizationManagementRoleFromGroup Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
groupGroupyes Short-Term The group for which the organization management role was unassigned. See Group.