🔒Security Requirements and Controls
🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateTokenSecurityPolicies() mutation sets the organization-wide security policies that govern all token types. Changes take effect immediately. Enforcing an IP filter applies it to all tokens of that type. Disabling a token type deletes all tokens of that type. Setting an enforced expiration shortens tokens that exceed the new maximum interval. Tokens whose expiration falls below the new maximum are deleted. Tokens within the interval retain their current expiration. Requires the ManageCluster permission.

Syntax

graphql
updateTokenSecurityPolicies(
      input: TokenSecurityPoliciesInput!
   ): Organization!

The mutation accepts a single non-null input argument of type TokenSecurityPoliciesInput, containing the IP filter identifier and token policy settings to apply. It returns a non-null Organization object reflecting the updated organization state.

Input parameters

The input argument accepts a non-null TokenSecurityPoliciesInput object containing the IP filter and token policy settings to apply. The following table describes the available fields:

Table: TokenSecurityPoliciesInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
organizationPermissionTokensAllowPermissionUpdatesBooleanyes Long-Term Whether it should be allowed to change permissions on existing organization permission tokens.
organizationPermissionTokensEnabledBooleanyes Long-Term Whether organization permission tokens should be enabled.
organizationPermissionTokensEnforceExpirationAfterMsLong  Long-Term Maximum time in milliseconds an organization permission token can be used before expiring (TTL).
organizationPermissionTokensEnforceIpFilterIdString  Long-Term The IP filter that will be enforced on all organization permission tokens.
personalUserTokensEnabledBooleanyes Long-Term Whether personal user tokens should be enabled.
personalUserTokensEnforceExpirationAfterMsLong  Long-Term Maximum time in ms a personal user token can be used before expiring (TTL).
personalUserTokensEnforceIpFilterIdString  Long-Term The IP filter that will be enforced on all personal user tokens.
systemPermissionTokensAllowPermissionUpdatesBoolean  Long-Term Whether it should be allowed to change permissions on existing system permission tokens.
systemPermissionTokensEnabledBoolean  Long-Term Whether system permission tokens should be enabled.
systemPermissionTokensEnforceExpirationAfterMsLong  Long-Term Maximum time in milliseconds a system permission token can be used before expiring (TTL).
systemPermissionTokensEnforceIpFilterIdString  Long-Term The IP filter that will be enforced on all system permission tokens.
viewPermissionTokensAllowPermissionUpdatesBooleanyes Long-Term Whether it should be allowed to change permissions on existing view permission tokens.
viewPermissionTokensEnabledBooleanyes Long-Term Whether view permission tokens should be enabled.
viewPermissionTokensEnforceExpirationAfterMsLong  Long-Term Maximum time in milliseconds a view permission token can be used before expiring (TTL).
viewPermissionTokensEnforceIpFilterIdString  Long-Term The IP filter that will be enforced on all view permission tokens.

Example

Raw
graphql
mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateTokenSecurityPolicies( input: ^
    { ^
      personalUserTokensEnabled: true, ^
      viewPermissionTokensEnabled: true, ^
      viewPermissionTokensAllowPermissionUpdates: true, ^
      organizationPermissionTokensEnabled: true, ^
      organizationPermissionTokensAllowPermissionUpdates: true, ^
    } ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateTokenSecurityPolicies( input:
    {
      personalUserTokensEnabled: true,
      viewPermissionTokensEnabled: true,
      viewPermissionTokensAllowPermissionUpdates: true,
      organizationPermissionTokensEnabled: true,
      organizationPermissionTokensAllowPermissionUpdates: true,
    }
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateTokenSecurityPolicies": {
      "id": "SINGLE_ORGANIZATION_ID"
    }
  }
}

Returned values

The mutation returns a non-null Organization object reflecting the updated token security policy state. The object provides access to organization-level configuration, applied token policies, limits, and URLs. The following table lists the available fields:

Table: Organization Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionOrganizationAction):Booleanyes Short-Term The action to check if a user is allowed to perform on an organization.
cidString  Short-Term The CID corresponding to the organization.
configsOrganizationConfigsyes Short-Term Organization configurations and settings. See OrganizationDetails.
createdAtLong  Short-Term Date organization was created.
defaultCachePolicyCachePolicy  Short-Term The default cache policy of the organization. See CachePolicy. This is a preview and subject to change.
deletedAtLong  Short-Term Day organization was deleted if it was marked for deletion.
descriptionString  Short-Term The description for the Organization. Can be null.
detailsOrganizationDetailsyes Short-Term Any additional details related to the organization. See OrganizationDetails.
externalGroupSynchronizationBooleanyes Short-Term Whether there is group synchronization.
externalPermissionsBooleanyes Short-Term Whether permissions are managed externally.
idStringyes Short-Term The unique id for the Organization.
ingestUrlString  Short-Term The ingest URL for the organization.
limitsLimityes Short-Term Limits assigned to the organization. See Limit.
limitsV2LimitV2yes Short-Term Limits assigned to the organization. See LimitV2.
nameStringyes Short-Term The name for the Organization.
publicUrlString  Short-Term The public URL for the organization.
readonlyDashboardIPFilterString  Short-Term IP filter for readonly dashboard links.
searchDomainsSearchDomainyes Short-Term Search domains within the organization. See SearchDomain.
statsOrganizationStatsyes Short-Term Statistics of the organization. See OrganizationStats.
trialStartedAtLong  Short-Term Date organization's trial started.