Summary

The defaultFleetInstallationToken() GraphQL query returns the default Fleet installation token for the organization. The result includes the token string, a JWT representation, the token name, assigned log collector configuration, expiration timestamp, and installation commands for supported operating systems.

API Stability Long-Term

Syntax

graphql
defaultFleetInstallationToken(): FleetInstallationToken

There is no input for this query. The result is nullable — it may be null if no default token exists. Specify the fields you want returned. See Returned Values for details.

Example

Raw
graphql
query {
	defaultFleetInstallationToken 
	{ name }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	defaultFleetInstallationToken  ^
	{ name } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
	defaultFleetInstallationToken 
	{ name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	defaultFleetInstallationToken 
	{ name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "defaultFleetInstallationToken": {
      "name": "our_token"
    }
  }
}

Returned Values

The result provides the raw token string (token), a JWT representation (jwtToken), the token name (name), the assigned log collector configuration (assignedConfiguration, nullable), the expiration timestamp (expiresAt, nullable), and installation commands for different operating systems (installationCommands). The available fields are listed here:

Table: FleetInstallationToken Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
assignedConfigurationLogCollectorConfiguration  Short-Term The assigned configuration. See LogCollectorConfiguration.
expiresAtLong  Short-Term Stability: Short-term
installationCommandsLogCollectorInstallCommandyes Short-Term The installation commands. See LogCollectorInstallCommand.
jwtTokenStringyes Short-Term The JSON web token used.
nameStringyes Short-Term The name of the Fleet installation token.
tokenStringyes Short-Term The Fleet installation token used.