Stability Level Long-Term

The defaultFleetInstallationToken() GraphQL query will return the default Fleet installation token, as well as information about using it.

There are also some related mutations: createFleetInstallToken() for creating a Fleet installation token; and updateFleetInstallTokenConfigId() for changing one.

To get the default Fleet installation token using the UI, see the Full Falcon LogScale Collector Installation page of the main documentation.

Syntax

graphql
defaultFleetInstallationToken: FleetInstallationToken

You'd enter no input for this query field, just the return values you want. At a minimum, you'll probably want the token itself and the installation command for installing LogCollector. The possibilities are listed in a table in the Returned Datatype section.

Example

Here's an example using this query:

Raw
graphql
query {
	defaultFleetInstallationToken 
	{ name }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	defaultFleetInstallationToken  ^
	{ name } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
	defaultFleetInstallationToken 
	{ name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "defaultFleetInstallationToken": {
      "name": "our_token"
    }
  }
}

Returned Datatype

With the returned datatype, besides the token itself, you can specify what information you need related to it (e.g., the commands for installing on your operating system). Listed below are the parameters, but you'll have to click on the special datatypes for what you'll need to specify for configuring and installing:

Table: FleetInstallationToken

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Jul 24, 2025
assignedConfigurationLogCollectorConfiguration  Short-TermThe assigned configuration. See LogCollectorConfiguration.
installationCommandsLogCollectorInstallCommandyes Short-TermThe installation commands. See LogCollectorInstallCommand.
jwtTokenstringyes Short-TermThe JSON web token used.
namestringyes Short-TermThe name of the Fleet installation token.
tokenstringyes Short-TermThe Fleet installation token used.