updateSlackAction()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateSlackAction() mutation updates a Slack action in a LogScale view or repository. Slack actions send an outbound HTTP POST to a Slack incoming webhook URL each time an associated alert fires. This mutation performs a full replacement of the action configuration — provide all required fields even if their values are unchanged. Use it to rotate the webhook URL, revise the message field set, rename the action, toggle proxy routing, or update labels. To create a new Slack action, use createSlackAction() instead.

To create a Slack action, use the createSlackAction() mutation. To verify a Slack action sends correctly, use the testSlackAction() mutation. To remove an action, use the deleteActionV2() mutation. To add or update labels on an action, use the addActionLabels() mutation. To update a post-message variant instead, use the updateSlackPostMessageAction() mutation.

Hide Query Example

Show Slack Actions Query

To retrieve a list of Slack actions, use the repository() query:

graphql

query {
     repository(name: "humio")
        { id, name,
          actions { id, name, 
                    ... on SlackAction { id, name } }
          }
   }

For more information on Slack actions, see Action Type: Slack. For an overview of all action types, see Actions.

Syntax

graphql

updateSlackAction(
      input: UpdateSlackAction!
   ): SlackAction!

Provide the view name, the action ID, and all required fields from the UpdateSlackAction input type. The mutation returns a non-null SlackAction object reflecting the updated state.

Input parameters

The viewName, id, name, url, fields, and useProxy arguments are required. This mutation performs a full replacement — provide all required arguments even if their values are unchanged.

viewName is the name of the view or repository that owns the action. id is the unique identifier of the action to update; use the repository() query to retrieve it. url must be a valid Slack incoming webhook URL; the URL is replaced. fields is an array of SlackField objects, each mapping a Slack message field name to a LogScale alert template variable such as {events_str} or {query_time_interval}; this array replaces the current list. Set useProxy to true to route the outbound webhook request through the configured HTTP proxy, which is applicable in network-restricted or air-gapped deployments. labels is optional; it replaces the current label set when provided.

Table: UpdateSlackAction Input Datatype

Parameter	Type	Required	Stability	Description
fields	SlackFieldEntryInput	yes	`Long-Term`	Fields to include within the Slack message. They can be templated with values from the result. See SlackFieldEntryInput.
id	String	yes	`Long-Term`	The unique identifier of the action.
labels	String	yes		Labels to categorize the action.
name	String	yes	`Long-Term`	The name of the action.
url	String	yes	`Long-Term`	The Slack webhook URL where to send the request.
useProxy	Boolean	yes	`Long-Term`	Defines whether the action should use the configured proxy to make web requests.
viewName	String	yes	`Long-Term`	The name of the view of the action.

Example

Raw

graphql

mutation {
  updateSlackAction(input:
       { viewName: "humio",
         id: "abc123",
         name: "my-slack-act",
         url: "https://slack.com/api/chat.postMessage",
         fields: [ {fieldName: "Events String", value: "{events_str}"},
                {fieldName: "Time Interval", value: "{query_time_interval}"} ],
         useProxy: false
      } )
  { id }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSlackAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         url: \"https://slack.com/api/chat.postMessage\",
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
         useProxy: false
      } )
  { id }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSlackAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         url: \"https://slack.com/api/chat.postMessage\",
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
         useProxy: false
      } )
  { id }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateSlackAction(input: ^
       { viewName: \"humio\", ^
         id: \"abc123\", ^
         name: \"my-slack-act\", ^
         url: \"https://slack.com/api/chat.postMessage\", ^
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"}, ^
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ], ^
         useProxy: false ^
      } ) ^
  { id } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateSlackAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         url: \"https://slack.com/api/chat.postMessage\",
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
         useProxy: false
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateSlackAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         url: \"https://slack.com/api/chat.postMessage\",
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
         useProxy: false
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateSlackAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         url: \"https://slack.com/api/chat.postMessage\",
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
         useProxy: false
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateSlackAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         url: \"https://slack.com/api/chat.postMessage\",
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
         useProxy: false
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "updateSlackAction": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns the updated SlackAction object, reflecting the configuration state immediately after the update. Check the returned id to confirm the correct action was updated. The url field contains the active webhook URL. The fields array reflects the complete, updated list of Slack message fields. The useProxy field confirms the current proxy routing state. The labels field lists all labels currently applied to the action. Creation and modification timestamps and the associated user are also available. The following table lists all returnable fields:

Table: SlackAction Datatype

Parameter	Type	Required	Stability	Description
allowedActions	[AssetAction]	yes	`Short-Term`	A list of allowed asset actions. See AssetAction .
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the action. See AssetCommitMetadata.
displayName	string	yes	`Long-Term`	The display name of the action.
fields	[SlackFieldEntry]	yes	`Long-Term`	The fields to include within the Slack message. This can be templated with values from the result. See SlackFieldEntry.
id	string	yes	`Long-Term`	The unique identifier of the action.
isAllowedToRun	boolean	yes	`Long-Term`	False if this type of action is disabled because of a security policy, true otherwise.
labels	[string]	yes	`Preview`	The labels associated with the action.
modifiedInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the latest modification of the action. See AssetCommitMetadata.
name	string	yes	`Long-Term`	The name of the action.
package	PackageInstallation		`Long-Term`	The package, if there is one, of which the action is part (see PackageInstallation Table).
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package. VersionedPackageSpecifier is a scalar.
requiresOrganizationOwnedQueriesPermissionToEdit	boolean	yes	`Long-Term`	True if this action is used by triggers, where the query is run by the organization. If true, then the OrganizationOwnedQueries permission is required to edit the action.
resource	string	yes	`Short-Term`	The resource identifier for the action.
url	string	yes	`Long-Term`	The Slack webhook URL where to send the requests.
useProxy	boolean	yes	`Long-Term`	Whether the action should use the configured proxy to make web requests.
yamlTemplate	YAML	yes	`Long-Term`	A template that can be used to recreate the action. YAML is a scalar.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes