🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The unassignSystemRoleFromGroup() mutation removes a system role from a group. System roles grant system-level permissions across LogScale, so removing one immediately revokes those permissions for all members of the group. Other role assignments for the group are unaffected. To grant a system role to a group, use assignSystemRoleToGroup().

Syntax

graphql
unassignSystemRoleFromGroup(
      input: RemoveSystemRoleFromGroupInput!
   ): UnassignSystemRoleFromGroup!

The mutation accepts a single required input argument of type RemoveSystemRoleFromGroupInput!, which requires both groupId and roleId as non-null string identifiers. The mutation returns a non-null UnassignSystemRoleFromGroup object containing details about the updated group state. Use the group() query to retrieve the identifiers needed for the input fields.

The returned object provides information about the group after the removal, including its current system roles and members. See the Returned Values section for available fields.

Example

Raw
graphql
mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: "abc123", 
       roleId: "def456" } 
   )
     {group { displayName, userCount } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: \"abc123\", 
       roleId: \"def456\" } 
   )
     {group { displayName, userCount } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: \"abc123\", 
       roleId: \"def456\" } 
   )
     {group { displayName, userCount } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  unassignSystemRoleFromGroup(input:  ^
     { groupId: \"abc123\",  ^
       roleId: \"def456\" }  ^
   ) ^
     {group { displayName, userCount } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: \"abc123\", 
       roleId: \"def456\" } 
   )
     {group { displayName, userCount } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: \"abc123\", 
       roleId: \"def456\" } 
   )
     {group { displayName, userCount } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: \"abc123\", 
       roleId: \"def456\" } 
   )
     {group { displayName, userCount } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  unassignSystemRoleFromGroup(input: 
     { groupId: \"abc123\", 
       roleId: \"def456\" } 
   )
     {group { displayName, userCount } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "unassignSystemRoleFromGroup": {
      "group": {
        "displayName": "Sales Dept.",
        "userCount": 6
      }
    }
  }
}

Input Parameters

Provide the unique identifiers for both the group and the system role to remove. Both groupId and roleId are required string values. Use the group() query to look up these identifiers.

Table: RemoveSystemRoleFromGroupInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
groupIdStringyes Long-Term The unique identifier of the group.
roleIdStringyes Long-Term The unique identifier of the system role to remove from the group.

Returned Values

The mutation returns an UnassignSystemRoleFromGroup object representing the group after the role removal. You can request group membership details, the remaining system roles, and the assets each member can access. Use the systemRoles field to confirm which system roles remain assigned to the group after the operation.

Table: UnassignSystemRoleFromGroup Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
groupGroupyes Long-Term The group from which to unassign the system role. See Group.