Summary

The groupByDisplayName() GraphQL query returns details for the group with the given display name. Use this as an alternative to group() when the display name is known but the group ID is not.

API Stability Long-Term

Syntax

graphql
groupByDisplayName(
      displayName: String!
   ): Group!

Provide the group's display name as displayName (required). Note that display names are case-sensitive. See Returned Values for available fields.

Example

Raw
graphql
query{
  groupByDisplayName(displayName: "chiefs") {
    id, users {
      id, username, displayName
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  groupByDisplayName(displayName: \"chiefs\") {
    id, users {
      id, username, displayName
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  groupByDisplayName(displayName: \"chiefs\") {
    id, users {
      id, username, displayName
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query{ ^
  groupByDisplayName(displayName: \"chiefs\") { ^
    id, users { ^
      id, username, displayName ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query{
  groupByDisplayName(displayName: \"chiefs\") {
    id, users {
      id, username, displayName
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query{
  groupByDisplayName(displayName: \"chiefs\") {
    id, users {
      id, username, displayName
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query{
  groupByDisplayName(displayName: \"chiefs\") {
    id, users {
      id, username, displayName
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query{
  groupByDisplayName(displayName: \"chiefs\") {
    id, users {
      id, username, displayName
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "groupByDisplayName": {
      "id": "BHdJstvjgDUjXg10KrbjiybpSbOHIw1b",
      "users": [
        {
          "id": "czN4YDhpmZ1JrZnJ4bkQzK52",
          "username": "tom",
          "displayName": "Tom Hanks"
        },
        {
          "id": "mQ2oDkHSLhTG6l6ppsmxJYHJ",
          "username": "steve",
          "displayName": "Steve McQueen"
        },
        {
          "id": "TMc2x9a2APnkGvyMJQbxgcOU",
          "username": "bob",
          "displayName": "Bob Newhart"
        }
      ]
    }
  }
}

This example requests first the ID for the group, then a list or array of users in the group. For each user, it calls for the user's ID, the username, and the display name of the user.

Returned Values

Returns a non-nullable Group object with the same fields as group(). Identity fields include id, displayName, and lookupName (nullable — when set, used instead of displayName for IdP/SSO group synchronization matching). Access control fields include defaultRole, defaultQueryPrefix (nullable — a search filter prepended to every query by group members), roles, systemRoles, organizationRoles, and queryPrefixes. User fields include userCount and users. The available fields are listed here:

Table: Group Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
assetIdString,yes   Id of the asset
assetTypeAssetPermissionsAssetType,searchDomainId:String):GroupAssetActionsBySourceyes Short-Term The type of the asset.
assetTypesAssetPermissionsAssetType],yes   List of asset types
defaultQueryPrefixString  Long-Term The default prefix for queries.
defaultRoleRole  Long-Term The default role associated with the group. See Role.
defaultSearchDomainCountIntyes Long-Term The default search domain count.
displayNameStringyes Long-Term The display name of the group.
idStringyes Long-Term The identifier of the group.
limitInt,    The amount of results to return.
lookupNameString  Long-Term The look-up name for the group.
orderByOrderBy):UserResultSetTypeyes Long-Term Choose the order in which the results are returned.
organizationRolesGroupOrganizationRoleyes Long-Term The roles of the organization associated with the group. See GroupOrganizationRole.
permissionTypePermissionType  Long-Term Indicates which level of permissions the group contains. See PermissionType .
permissionsAssetAction]):AssetPermissionSearchResultSetyes Short-Term Include Read, Update and/or Delete permission assignments. The filter will accept all assets if the argument Null or the empty list.
rolesSearchDomainRoleyes Long-Term The roles for the group See SearchDomainRole.
searchDomainCountIntyes Long-Term The number of search domains for the group.
searchDomainIdsString],yes   List of search domain id's to search within. Null or empty list is interpreted as all search domains
searchDomainRoles(searchDomainId: String)SearchDomainRoleyes Long-Term The search domain roles assigned to the group. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: String!)SearchDomainRole  Deprecateddeprecated in 1.195

The search domain roles assigned to the group, by name. See SearchDomainRole. When multiple roles per view is enabled, this field will return only the first of possibly multiple roles matching the name for the view.

Use roles, searchDomainRoles, or searchDomainRolesBySearchDomainName fields instead. This field will be removed at the earliest in version 1.195.

searchDomainRolesBySearchDomainName(searchDomainName: String!)SearchDomainRoleyes Long-Term The domain roles by search domain name. See SearchDomainRole.
searchFilterString,    Filter results based on this string
skipInt,    The number of results to skip or the offset to use. For instance if implementing pagination, set skip = limit * (page - 1)
sortByOrderByUserField,    The value to sort the result set by.
systemRolesGroupSystemRoleyes Long-Term The system roles of the group. See GroupSystemRole.
userCountIntyes Long-Term The number of users that are part of the group.
usersUseryes Long-Term The list of users in the group. See User.