GraphQL User Queries & Mutations

User Queries & Mutations

Below are the user related queries and mutations.

currentUser()

Summary

The currentUser() GraphQL query returns information about the current authenticated user. This could be the person's name, their email address, and any other information included in the user account.

Related to this query field are the queries viewer() to get information about the currently authenticated user account, and viewerOpt() to get information about the currently authenticated user account.

API Stability Long-Term

Syntax

graphql

currentUser: User!

There's no input for this query field. You do have to list what values you want returned, such as the user name and email address. See the Returned Values section farther down this page for more possibilities.

Example

Raw

graphql

query {
	currentUser {
      id,displayName,
      username, isRoot }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	currentUser {
      id,displayName,
      username, isRoot }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	currentUser {
      id,displayName,
      username, isRoot }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	currentUser { ^
      id,displayName, ^
      username, isRoot } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	currentUser {
      id,displayName,
      username, isRoot }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
	currentUser {
      id,displayName,
      username, isRoot }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	currentUser {
      id,displayName,
      username, isRoot }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	currentUser {
      id,displayName,
      username, isRoot }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "currentUser": {
      "id": "abc123",
      "displayName": "dev",
      "username": "dev",
      "isRoot": true
    }
  }
}

The example above requests four values be returned.

Returned Values

For the results, you can get plenty on a user account. Besides the usual information (e.g., name, email address, etc.), the mutation can return data about user permissions and access, what groups they're a member and the assets to which they have access. Below is a list of choices, along with a description of each:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

groupsAndUsersWithPermissionsOnAsset()

Summary

The groupsAndUsersWithPermissionsOnAsset() GraphQL query is used to search groups and users that have permission for certain assets.

API Stability Short-Term

Syntax

graphql

groupsAndUsersWithPermissionsOnAsset(
      searchDomainName: string!, 
      assetType: AssetPermissionsAssetType!, 
      assetId: string!, 
      includeEmptyPermissionSet: boolean!,
      searchFilter: string, 
      groupsOrUsersFilters: [GroupsOrUsersFilter], 
      orderBy: OrderBy,
      limit: integer, 
      skip: integer
   ): UserOrGroupAssetPermissionSearchResultSet

You'll have to enter the name of the search domain, the type of asset, the unique identifier of the asset or file name, whether to include users and groups that don't have access to the asset. There are also a few input parameters that you can include that aren't required. See the Input Parameters section for details of all of this.

For the results, you can get a list of asset permissions for the users and groups found. This will involve several sub-parameters, which are described in the Returned Values section farther down this page.

Example

Raw

graphql

query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: "humio",
    assetType: SavedQuery,
    assetId: "1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: \"humio\",
    assetType: SavedQuery,
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: \"humio\",
    assetType: SavedQuery,
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	groupsAndUsersWithPermissionsOnAsset( ^
    searchDomainName: \"humio\", ^
    assetType: SavedQuery, ^
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\", ^
    groupsOrUsersFilters: Users, ^
    includeEmptyPermissionSet: false ^
  ) ^
  { totalResults  } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: \"humio\",
    assetType: SavedQuery,
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: \"humio\",
    assetType: SavedQuery,
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: \"humio\",
    assetType: SavedQuery,
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	groupsAndUsersWithPermissionsOnAsset(
    searchDomainName: \"humio\",
    assetType: SavedQuery,
    assetId: \"1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y\",
    groupsOrUsersFilters: Users,
    includeEmptyPermissionSet: false
  )
  { totalResults  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "groupsAndUsersWithPermissionsOnAsset": {
      "totalResults": 0
    }
  }
}

Input Parameters

For the input, you would give the name of the search domain to search, give the unique identifier for the asset, and whether to include users and groups that don't have access.

You'll also have to indicate the type of asset (see second table below), whether to restrict results to users or groups (see third table), and how to order the results (see fourth), and a few other optional parameters.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Default	Description
This table contains all input parameters for this query. Since some of the parameters use special datatypes, additional tables for them are included below.
assetId	string	yes		The unique identifier of the asset. For files, use the name of the file.
assetType	AssetPermissionsAssetType	yes		The type of the asset. See table below.
groupsOrUsersFilters	[GroupsOrUsersFilter]			Whether to include only users, only groups — or both. See table below.
includeEmptyPermissionSet	boolean	yes		Whether to include users and groups that currently don't have access to the asset.
limit	integer		`50`	The amount of results to return.
orderBy	OrderBy		`ASC`	How to order results.
searchDomainName	string	yes		The name of the view or repository where the asset belongs.
searchFilter	string			Filter results based on this string.
skip	integer		`0`	The number of results to skip, or the offset to use.

This given datatype allows you to limit the search for users and groups to those with access to the type of asset. Your choices for this are listed in the table here:

Table: AssetPermissionsAssetType

Parameter	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 30, 2025
Action	`Short-Term`	Set to this option if the asset permission is related to an action.
AggregateAlert	`Short-Term`	Set to this if asset permission is related to an aggregate alert.
Dashboard	`Short-Term`	Set if asset permission is related to a dashboard.
File	`Short-Term`	Set this option if related to a file.
FilterAlert	`Short-Term`	Used to indicate the asset permission is related to a filter alert.
LegacyAlert	`Short-Term`	Used if related to a legacy alert.
SavedQuery	`Short-Term`	The asset permission is related to a saved query.
ScheduledReport	`Short-Term`	Indicates the asset permission is related to a scheduled report.
ScheduledSearch	`Short-Term`	The asset permission is related to a scheduled search.

This input datatype is a simple one. You have the choice of restricting searching to either groups or users.

Table: GroupsOrUsersFilter Enum Datatype

Parameter	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Feb 3, 2026
Groups	`Short-Term`	Filter and limit query based on a group.
Users	`Short-Term`	Choose this option to filter based on a user.

This other input datatype is also a simple one. You can return results based on whether they are in ascending or descending order, alphanumerically.

Table: OrderBy Enum Datatype

Parameter	Default	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 10, 2025
ASC	✓	`Long-Term`	Order results in ascending order (e.g., 0 to 9, A to Z).
DESC		`Long-Term`	Order results in descending order (e.g., 9 to 0, Z to A).

Returned Values

For the results, you can get a list of asset permissions for the groups found. The table below shows a couple of choices, but you'll have to click on the special datatype listed to see more.

Table: UserOrGroupAssetPermissionSearchResultSet Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 21, 2025
results	[UserOrGroupTypeAndPermissions]	yes	`Short-Term`	The paginated result set. See UserOrGroupTypeAndPermissions.
totalResults	integer	yes	`Short-Term`	The total number of matching results.

pendingUser()

Summary

The pendingUser() GraphQL query will return information on a specified pending user.

Pending users are only possible if the environment variable, SEND_USER_INVITES is set to true. Otherwise, when adding a new user and sending them an invitation, they won't be pending, they'll become a new user.

API Stability Long-Term

Syntax

graphql

pendingUser(
      token: string!
   ): PendingUser!

For the input, you'll have to give the token for the pending user. If you don't know that, you can use the pendingUsers() query. For the results, you can get the pending user's email address, when they were invited and by whom. See the Returned Values section for more on this.

Example

Raw

graphql

query {
  pendingUser(
      token: "abc123"
    )
  {id, newUserEmail}
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  pendingUser(
      token: \"abc123\"
    )
  {id, newUserEmail}
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  pendingUser(
      token: \"abc123\"
    )
  {id, newUserEmail}
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  pendingUser( ^
      token: \"abc123\" ^
    ) ^
  {id, newUserEmail} ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  pendingUser(
      token: \"abc123\"
    )
  {id, newUserEmail}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  pendingUser(
      token: \"abc123\"
    )
  {id, newUserEmail}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  pendingUser(
      token: \"abc123\"
    )
  {id, newUserEmail}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  pendingUser(
      token: \"abc123\"
    )
  {id, newUserEmail}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "pendingUser": {
     "id": "def456",
     "newUserEmail": "joe@company.com"
    }
 }
}

Returned Values

For the results, you can get the pending user's email address, when they were invited and by whom, etc. Below is a list of choices, along with descriptions of them:

Table: PendingUser Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 26, 2025
createdAt	long	yes	`Long-Term`	The time the pending user was created.
id	string	yes	`Long-Term`	The identifier or token for the pending user.
idp	boolean	yes	`Long-Term`	Whether IdP is enabled for the organization.
invitedByEmail	string	yes	`Long-Term`	The email address of the user that invited the pending user.
invitedByName	string	yes	`Long-Term`	The name of the user that invited the pending user.
newUserEmail	string	yes	`Long-Term`	The email of the pending user.
orgName	string	yes	`Long-Term`	The name of the organization for the pending user.
pendingUserState	PendingUserState	yes	`Long-Term`	The current organization state for the user. See PendingUserState.

pendingUsers()

Summary

The pendingUsers() GraphQL query will return the pending users. You can filter the results by including a search string.

API Stability Long-Term

Syntax

graphql

pendingUsers(
     search: string
   ): [PendingUser]!

There are no special input datatypes for this query field. For the results, you can get the pending users' email addresses, when they were invited and by whom, and other information. See the Returned Datatype section for more on this.

Example

Raw

graphql

query {
  pendingUsers(search:"company.com") {
    newUserEmail
  }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  pendingUsers(search:\"company.com\") {
    newUserEmail
  }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  pendingUsers(search:\"company.com\") {
    newUserEmail
  }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  pendingUsers(search:\"company.com\") { ^
    newUserEmail ^
  } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  pendingUsers(search:\"company.com\") {
    newUserEmail
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  pendingUsers(search:\"company.com\") {
    newUserEmail
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  pendingUsers(search:\"company.com\") {
    newUserEmail
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  pendingUsers(search:\"company.com\") {
    newUserEmail
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "pendingUsers": [
     "newUserEmail": "joe@company.com"
    ]
 }
}

Returned Values

For the results, you can get the pending user's email address, when they were invited and by whom, etc. Below is a list of choices, along with descriptions of them:

Table: PendingUser Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 26, 2025
createdAt	long	yes	`Long-Term`	The time the pending user was created.
id	string	yes	`Long-Term`	The identifier or token for the pending user.
idp	boolean	yes	`Long-Term`	Whether IdP is enabled for the organization.
invitedByEmail	string	yes	`Long-Term`	The email address of the user that invited the pending user.
invitedByName	string	yes	`Long-Term`	The name of the user that invited the pending user.
newUserEmail	string	yes	`Long-Term`	The email of the pending user.
orgName	string	yes	`Long-Term`	The name of the organization for the pending user.
pendingUserState	PendingUserState	yes	`Long-Term`	The current organization state for the user. See PendingUserState.

queryQuotaUserSettings()

Summary

The queryQuotaUserSettings() GraphQL query returns the query quota settings for a given user.

API Stability Short-Term

Syntax

graphql

queryQuotaUserSettings(
     username: string
   ): [QueryQuotaUserSettings]!

There's only one input, the username of the user account for which you want to check its settings. But that's not required. If omitted, the query returns the query quota settings for all users.

For the results, you can get the user name — which is useful when you don't give one — and you can get, through a sub-parameter, the settings for the query quota interval (e.g., daily), what's measured (e.g., query counts), and other such data. See the Returned Values section for more.

Example

Raw

graphql

query {
  queryQuotaUserSettings(username: "bob@company.com") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  queryQuotaUserSettings(username: \"bob@company.com\") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  queryQuotaUserSettings(username: \"bob@company.com\") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  queryQuotaUserSettings(username: \"bob@company.com\")  ^
  { settings { interval, measurementKind,  ^
               value, valueKind, source } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  queryQuotaUserSettings(username: \"bob@company.com\") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  queryQuotaUserSettings(username: \"bob@company.com\") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  queryQuotaUserSettings(username: \"bob@company.com\") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  queryQuotaUserSettings(username: \"bob@company.com\") 
  { settings { interval, measurementKind, 
               value, valueKind, source } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "queryQuotaUserSettings": [
      {
        "settings": []
      }
    ]
  }
}

Returned Values

For the results, you can get the user name, the settings for the query quota interval (e.g., daily), what's measured (e.g., query counts), and other such data. Below is a list of choices, but you'll have to click on the sub-datatype to see the choices for it:

Table: QueryQuotaUserSettings Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 2, 2024
settings	[QueryQuotaIntervalSetting]	yes	`Short-Term`	List of the settings that apply. See QueryQuotaIntervalSetting.
username	string	yes	`Short-Term`	Username of the user for which these Query Quota settings apply.

rolesInOrgForChangingUserAccess()

Summary

The rolesInOrgForChangingUserAccess() GraphQL query field is used to get defined roles in an organization for a user.

API Stability Long-Term

Syntax

graphql

rolesInOrgForChangingUserAccess(
     searchDomainId: string!
   ): [Role]!

You'll need to provide the unique identifier for searchDomainId. If you don't know this, you can first use the searchDomains() query

For the results, you can request plenty of details about each role. See the Returned Values section further down this page for more information on this.

Example

Raw

graphql

query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: "abc123"
   ) 
   { id, displayName, usersCount }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: \"abc123\"
   ) 
   { id, displayName, usersCount }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: \"abc123\"
   ) 
   { id, displayName, usersCount }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
   rolesInOrgForChangingUserAccess( ^
      searchDomainId: \"abc123\" ^
   )  ^
   { id, displayName, usersCount } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: \"abc123\"
   ) 
   { id, displayName, usersCount }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: \"abc123\"
   ) 
   { id, displayName, usersCount }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: \"abc123\"
   ) 
   { id, displayName, usersCount }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
   rolesInOrgForChangingUserAccess(
      searchDomainId: \"abc123\"
   ) 
   { id, displayName, usersCount }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "rolesInOrgForChangingUserAccess": [
      {
        "id": "def456",
        "displayName": "Admin",
        "usersCount": 1
      },
      {
        "id": "hij789",
        "displayName": "Member",
        "usersCount": 14
      }
    ]
  }
}

Returned Values

For the results, you can get plenty on the roles. The table below lists what will be available, along with links to sub-choices:

Table: Role Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 21, 2025
description	string		`Long-Term`	A description of the role.
displayName	string	yes	`Long-Term`	The display name of the role.
groups	[Group]	yes	`Long-Term`	The groups related to the role. See Group.
groupsCount	integer	yes	`Long-Term`	The number of groups related to the role.
groupsV2(search: string, userId: string, searchInRoles: boolean, onlyIncludeGroupsWithRestrictiveQueryPrefix: boolean, limit: integer, skip: integer): GroupResultSetType	multiple	yes	`Long-Term`	The groups related to the role. See GroupResultSetType.
id	string	yes	`Long-Term`	The unique identifier for the role.
organizationManagementPermissions	[OrganizationManagementPermission]	yes	`Long-Term`	The organization management permissions given to the role. See OrganizationManagementPermission.
organizationPermissions	[OrganizationPermission]	yes	`Long-Term`	The organization permissions given to the role. See OrganizationPermission.
readonlyDefaultRole	ReadonlyDefaultRole		`Preview`	The read-only default role. This parameter is a preview and subject to change. See ReadonlyDefaultRole.
systemPermissions	[SystemPermission]	yes	`Long-Term`	The system permissions given to the role. See SystemPermission.
users	[User]	yes	`Long-Term`	A list of users assigned the role. See User.
usersCount	integer	yes	`Long-Term`	The number of users assigned the role.
viewPermissions	[Permission]	yes	`Long-Term`	The view permissions given to the role. See Permission.

user()

Summary

The user() GraphQL query returns information on a user for a given ID.

API Stability Long-Term

Syntax

graphql

user(
     id: string!
   ): User

For the input, you'll have to provide the unique identifier for a user account. To get this, though, you can use the users() query. For the results, you can usually get plenty of data on the user (e.g., names, email address, whether the user has root access). See the Returned Datatypes section for details.

Example

Raw

graphql

query{
  user(id: "abc123") 
   { username, displayName, email }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  user(id: \"abc123\") 
   { username, displayName, email }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  user(id: \"abc123\") 
   { username, displayName, email }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query{ ^
  user(id: \"abc123\")  ^
   { username, displayName, email } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query{
  user(id: \"abc123\") 
   { username, displayName, email }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query{
  user(id: \"abc123\") 
   { username, displayName, email }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query{
  user(id: \"abc123\") 
   { username, displayName, email }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query{
  user(id: \"abc123\") 
   { username, displayName, email }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "user": {
      "username": "bob",
      "displayName": "Bob Newhart",
      "email": "bob@company.com"
    }
  }
}

In this example, the username , displayName, and email address are requested. You could request many more fields in the same way.

Returned Values

For the results, you can get the user's name, their email address, whether they have root access, a list of roles assigned to them, etc. Below is a list of choices:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

users()

Summary

The users() GraphQL query returns a list of all of the users in the system. Since this is a cluster-wide query, it requires ManageCluster permission.

API Stability Long-Term

Syntax

graphql

users(
     search: string,
     orderBy: OrderByUserFieldInput
   ): [User]!

For the input, you can give text on which to filter results, how you want to order results — first by one of the name fields, then in ascending or descending order. See the example below and the Input Parameters section for clarity.

For the results, you can usually get plenty of data on each user (e.g., names, email addresses, whether each user has root access). See the Returned Values section for details.

Example

Raw

graphql

query{
  users(
    search: "company.com",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  users(
    search: \"company.com\",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  users(
    search: \"company.com\",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query{ ^
  users( ^
    search: \"company.com\", ^
    orderBy: {userField: USERNAME, order: ASC} ^
    ) ^
    {username, email, displayName} ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query{
  users(
    search: \"company.com\",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query{
  users(
    search: \"company.com\",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query{
  users(
    search: \"company.com\",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query{
  users(
    search: \"company.com\",
    orderBy: {userField: USERNAME, order: ASC}
    )
    {username, email, displayName}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "users": [
      {
        "username": "bob",
        "email": "bob@company.com",
        "displayName": "Bob Newhart"
      },
      {
        "username": "steve",
        "email": "steve@company.com",
        "displayName": "Steve McQueen"
      },
      {
        "username": "tom",
        "email": "tom@company.com",
        "displayName": "Tom Hanks"
      }
    ]
  }
}

Input Parameters

For the input, you would give text by which to search users, and you can order the results by a particular name field for the user account, and then either in ascending or descending order.

Table: Input Parameters & Datatypes

Parameter	Type	Description
This table contains all input parameters for this query. Since one of the parameters uses a special datatype, an additional table is included below with its parameters.
orderBy	OrderByUserFieldInput	How to order results. See table below.
search	string	A string by which user accounts will be searched.

This special datatype is used to order the search by one of the name fields, then in ascending or descending order.

Table: OrderByUserFieldInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
order	OrderByDirection	yes	`Long-Term`	How to sort users information. See OrderByDirection.
userField	OrderByUserField	yes	`Long-Term`	The user field by which to sort user information. See OrderByDirection.

Returned Values

For the results, you can get each user's name, their email address, whether they have root access, a list of roles assigned to them, etc. Below is a list of choices you can request:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

usersAndGroupsForChangingUserAccess()

Summary

The usersAndGroupsForChangingUserAccess() GraphQL query field is used to get users and groups for changing user access.

API Stability Long-Term

Syntax

graphql

usersAndGroupsForChangingUserAccess(
     search: string,
     searchDomainId: string!,
     skip: integer,
     limit: integer
   ): UsersAndGroupsSearchResultSet

For the input, you would give any text on which to search, the search domain's identifier, and the number of results to skip and how many to return. See the Input Parameters section.

For the results, you can get the total number of records found, and information on users and on groups: for users, their names, email addresses, etc.; for groups, a list of roles, permissions, and counts. See the Returned Values for more details.

Example

Raw

graphql

query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:"abc123" )
    { totalResults }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:\"abc123\" )
    { totalResults }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:\"abc123\" )
    { totalResults }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  usersAndGroupsForChangingUserAccess ^
    ( searchDomainId:\"abc123\" ) ^
    { totalResults } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:\"abc123\" )
    { totalResults }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:\"abc123\" )
    { totalResults }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:\"abc123\" )
    { totalResults }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  usersAndGroupsForChangingUserAccess
    ( searchDomainId:\"abc123\" )
    { totalResults }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

For the input, you would provide any text on which to search, the search domain's identifier, and the number of results to skip and how many to return.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Default	Description
This table contains all input parameters for this query.
limit	integer		`50`	The maximum number of results to return.
search	string			Any text on which to filter results.
searchDomainId	string	yes		The unique identifier of the repository or view.
skip	integer		`0`	The number of results to skip, or offset to use.

Returned Values

For the results, you can get the total number of users and groups, and through sub-parameters, information on users and on groups: for users, their names, email addresses, etc.; for groups, a list of roles, permissions, and counts.

Table: UsersAndGroupsSearchResultSet Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 26, 2025
results	[UserOrGroup]	yes	`Long-Term`	The results sets of users and groups. See UserOrGroup.
totalResults	integer	yes	`Long-Term`	The total number of matching results.

usersPage()

Summary

The usersPage() GraphQL query returns a list of users in an organization. You can get all users, or limit the list to a specific search value. To use this query field, you'll need organization ownership, or permission to manage users in at least one repository or view.

API Stability Long-Term

Syntax

graphql

usersPage(
     search: string,
     orderBy: OrderByUserFieldInput,
     pageSize: integer!,
     pageNumber: integer!
   ): UsersPage!

For the input, you can give text on which to filter results, how you want to order results — first by one of the name fields, then in ascending or descending order. See the Input Parameters section for more details.

For the results, you can get the total number of users, as well as each user's name, their email address, and a list of roles assigned to them. See the Returned Values section for details.

Example

Raw

graphql

query{
  usersPage(
    search: "company.com"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  usersPage(
    search: \"company.com\"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query{
  usersPage(
    search: \"company.com\"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query{ ^
  usersPage( ^
    search: \"company.com\" ^
    orderBy: {userField: USERNAME, order: ASC} ^
    pageSize: 10 ^
    pageNumber: 1 ^
  ) { ^
    page { ^
      id, username, displayName ^
    } ^
    pageInfo { ^
      number ^
      totalNumberOfRows ^
      total ^
    } ^
  } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query{
  usersPage(
    search: \"company.com\"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query{
  usersPage(
    search: \"company.com\"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query{
  usersPage(
    search: \"company.com\"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query{
  usersPage(
    search: \"company.com\"
    orderBy: {userField: USERNAME, order: ASC}
    pageSize: 10
    pageNumber: 1
  ) {
    page {
      id, username, displayName
    }
    pageInfo {
      number
      totalNumberOfRows
      total
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "usersPage": {
      "page": [
        {
          "id": "abc123",
          "username": "bob",
          "displayName": "Bob Newhart"
        },
        {
          "id": "def456",
          "username": "steve",
          "displayName": "Steve McQueen"
        },
        {
          "id": "ghi789",
          "username": "tom",
          "displayName": "Tom Hanks"
        }
      ],
      "pageInfo": {
        "number": 1,
        "totalNumberOfRows": 3,
        "total": 3
      }
    }
  }
}

For the UsersPage (see Returned Values below), you have to enter page with the fields you want returned. As for pageInfo , all three of the parameters are required and returned.

Input Parameters

For the input, you can give text on which to filter results, how you want to order results — first by one of the name fields, then in ascending or descending order. You would also specify the number of records you want per page, and then which page to return.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Description
This table contains all input parameters for this query. Since one of the parameters uses a special datatype, an additional table is included below with its parameters.
orderBy	OrderByUserFieldInput		How to order results. See table below.
pageNumber	integer	yes	Which page to return.
pageSize	integer	yes	The number of results returned per page.
search	string		A string by which user accounts will be searched.

This special datatype is used to order the search by one of the name fields, then in ascending or descending order.

Table: OrderByUserFieldInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
order	OrderByDirection	yes	`Long-Term`	How to sort users information. See OrderByDirection.
userField	OrderByUserField	yes	`Long-Term`	The user field by which to sort user information. See OrderByDirection.

Returned Values

For the results, you can get the total number of users, the page number, as well as each user's name, their email address, whether they have root access, a list of roles assigned to them, etc.

Table: UsersPage Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 4, 2024
page	[User]	yes	`Long-Term`	The users included in the page. See User.
pageInfo	PageType	yes	`Long-Term`	The page settings. See PageType.

The datatype above uses another datatype for information about user accounts. For your convenience, the table for that sub-datatype is included here:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

usersWithoutOrganizations()

Summary

The usersWithoutOrganizations() GraphQL query returns a list of users that aren't assigned to an organization.

API Stability Short-Term

Syntax

graphql

usersWithoutOrganizations: [User]!

There is no input for this query field. For the results, you can usually get plenty of data on each user (e.g., names, email addresses, whether each user has root access). See the Returned Datatypes section for details.

Example

Raw

graphql

query {
  usersWithoutOrganizations {id, username, email}
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  usersWithoutOrganizations {id, username, email}
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  usersWithoutOrganizations {id, username, email}
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  usersWithoutOrganizations {id, username, email} ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  usersWithoutOrganizations {id, username, email}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  usersWithoutOrganizations {id, username, email}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  usersWithoutOrganizations {id, username, email}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  usersWithoutOrganizations {id, username, email}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Returned Values

For the results, you can get each user's name, their email address, whether they have root access, a list of roles assigned to them, etc. Below is a list of choices:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

addLoginBridgeAllowedUsers()

Summary

The addLoginBridgeAllowedUsers() GraphQL mutation field is used to add a user to the list of allowed login bridge users.

To remove a user from the allowed list, use the removeLoginBridgeAllowedUsers() mutation. To add a login bridge, use setLoginBridge(). To make changes, use updateLoginBridge() and removeLoginBridge() to delete it, completely.

Hide Query Example

Show Allowed Users Query

To get a list of allowed users, you could execute the organization() like this:

graphql

query {
     organization {
       configs {
         subdomains: {
           loginBridge { allowedUsers { id, username } }
           }
       }
     }
   }

API Stability Long-Term

Syntax

graphql

addLoginBridgeAllowedUsers(
      userID: string!
    ): LoginBridge!

You'll have to give the unique identifier of the login bridge user. Click on Show Query link below for an example of how to get a user identifier.

Hide Query Example

Show Users Query

To get a list of users, you could execute the users() like this:

graphql

query {
     users { id, username  }
     }
   }

From the results of the query here, you can get the unique identifiers of the users you want to add.

Example

Raw

graphql

mutation {
  addLoginBridgeAllowedUsers(userID: "abc123")
  {name, issuer, samlEntityId}
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addLoginBridgeAllowedUsers(userID: \"abc123\")
  {name, issuer, samlEntityId}
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addLoginBridgeAllowedUsers(userID: \"abc123\")
  {name, issuer, samlEntityId}
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addLoginBridgeAllowedUsers(userID: \"abc123\") ^
  {name, issuer, samlEntityId} ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addLoginBridgeAllowedUsers(userID: \"abc123\")
  {name, issuer, samlEntityId}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addLoginBridgeAllowedUsers(userID: \"abc123\")
  {name, issuer, samlEntityId}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addLoginBridgeAllowedUsers(userID: \"abc123\")
  {name, issuer, samlEntityId}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addLoginBridgeAllowedUsers(userID: \"abc123\")
  {name, issuer, samlEntityId}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addLoginBridgeAllowedUsers": {
      "name": "our-checker",
      "issuer": "mr-saml",
      "samlEntityId": "urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
    }
  }
}

Input Parameters

For the input, you will have to give the unique identifier of the login bridge user. Click on the Show Query link in the Syntax section above for an example of how to get a user identifier.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Default	Description
This table contains all input parameters for this mutation.
userID	string	yes		The unique identifier of the login bridge user.

Returned Values

For the results, you can get the login URL, SAML information, and other values you might need. These are described in the table here:

Table: LoginBridge Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 26, 2024
additionalAttributes	string		`Long-Term`	Any additional attributes.
allowedUsers	[User]	yes	`Long-Term`	A list of users allowed to access the bridge. See User.
anyUserAlreadyLoggedInViaLoginBridge	boolean	yes	`Long-Term`	True if any user in this organization has logged in to CrowdStream via LogScale. Requires manage organizations permissions. Whether to generate user names.
description	string	yes	`Long-Term`	A description of the login bridge.
generateUserName	boolean	yes	`Long-Term`	Whether to generate user names.
groupAttribute	string	yes	`Long-Term`	Any group attributes.
groups	[string]	yes	`Long-Term`	Any groups associated with the login bridge.
issuer	string	yes	`Long-Term`	The issuer of the login bridge.
loginUrl	string	yes	`Long-Term`	The URL for logging in.
name	string	yes	`Long-Term`	The name of the login bridge.
organizationIdAttributeName	string	yes	`Long-Term`	The organization's unique identifier of the attribute name.
organizationNameAttributeName	string		`Long-Term`	The organization's name of the attribute name.
publicSamlCertificate	string	yes	`Long-Term`	The public SAML certificate.
relayStateUUrl	string	yes	`Long-Term`	The relay state URL.
remoteId	string	yes	`Long-Term`	The unique identifier of the remote connection.
samlEntityId	string	yes	`Long-Term`	The unique identifier of the SAML entity.
showTermsAndConditions	boolean	yes	`Long-Term`	Whether to show the terms and conditions.
termsDescription	string	yes	`Long-Term`	A description of the terms.
termsLink	string	yes	`Long-Term`	A link to the terms and conditions.

addOrUpdateQueryQuotaUserSettings()

Summary

The addOrUpdateQueryQuotaUserSettings() GraphQL mutation field is used to add or update query quota user settings.

API Stability Short-Term

Syntax

graphql

addOrUpdateQueryQuotaUserSettings(
      input: QueryQuotaUserSettingsInput!
    ): QueryQuotaUserSettings!

For the input, you'll have to give the user name, the query quota interval, how the quota is measured and other information you want to add or change. See the Input Parameters section for details.

For the results, you can get data on query quotas, including the interval used, how quotas are measured, etc. See the Returned Values section for more.

Example

Raw

graphql

mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: "tester", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: \"tester\", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: \"tester\", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addOrUpdateQueryQuotaUserSettings(input:  ^
       { username: \"tester\",  ^
         settings: [ {interval: PerDay, measurementKind: QueryCount,  ^
                      valueKind: Limited, value: 1000 } ] } ) ^
  { settings { interval, value } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: \"tester\", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: \"tester\", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: \"tester\", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addOrUpdateQueryQuotaUserSettings(input: 
       { username: \"tester\", 
         settings: [ {interval: PerDay, measurementKind: QueryCount, 
                      valueKind: Limited, value: 1000 } ] } )
  { settings { interval, value } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addOrUpdateQueryQuotaUserSettings": {
      "settings": [
        {
          "interval": "PerDay",
          "value": 1000
        }
      ]
    }
  }
}

Input Parameters

For the input, you would provide the user name, and through sub-parameters (see second table below), the query quota interval, how the quota is measured and other related information you want to add or update.

Table: QueryQuotaUserSettingsInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
settings	[QueryQuotaIntervalSettingInput]	yes	`Short-Term`	The query quota settings for the user. See QueryQuotaIntervalSettingInput.
username	string	yes	`Short-Term`	The username for which to set the query quota.

The datatype above uses another datatype for query quota interval information. For your convenience, the table for that sub-datatype is included here:

Table: QueryQuotaIntervalSettingInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
interval	QueryQuotaInterval	yes	`Short-Term`	The query quota time interval to use. See QueryQuotaInterval.
measurementKind	QueryQuotaMeasurementKind	yes	`Short-Term`	The kind of measurement used for the query quota. See QueryQuotaMeasurementKind.
value	long		`Short-Term`	The amount to set for the query quota.
valueKind	QueryQuotaIntervalSettingKind	yes	`Short-Term`	The kind of query quota setting. See QueryQuotaIntervalSettingKind.

Returned Values

For the results, you can get data on query quotas, including the interval used, how quotas are measured and other such information.

Table: QueryQuotaUserSettings Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 2, 2024
settings	[QueryQuotaIntervalSetting]	yes	`Short-Term`	List of the settings that apply. See QueryQuotaIntervalSetting.
username	string	yes	`Short-Term`	Username of the user for which these Query Quota settings apply.

Table: QueryQuotaIntervalSetting Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 2, 2024
interval	QueryQuotaInterval	yes	`Short-Term`	The interval for setting the query quota. See QueryQuotaInterval.
measurementKind	QueryQuotaMeasurementKind	yes	`Short-Term`	The kind of measurement. See QueryQuotaMeasurementKind.
source	QueryQuotaIntervalSettingSource	yes	`Short-Term`	The source of the query quota. See QueryQuotaIntervalSettingSource.
value	long		`Short-Term`	The query quota value.
valueKind	QueryQuotaIntervalSettingKind	yes	`Short-Term`	The kind of value. See QueryQuotaIntervalSettingKind.

addUserV2()

Summary

The addUserV2() GraphQL mutation may be used to add or invite a new user.

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

addUserV2(
      input: AddUserInputV2!
   ): userOrPendingUser!

For the input, you can provide the user's name, their email address, whether they may have root access, and other information. See the Input Parameters section for details.

For the results, you can get plenty of information on the user in complex ways, depending on whether the user is added conditionally. See the Returned Values section to understand better.

Example

Raw

graphql

mutation {
  addUserV2 (
    input: {
      username: "steve"
      sendInvite: true
      email: "steve@company.com"
    }
  ) {__typename ... on User {id, username}}
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addUserV2 (
    input: {
      username: \"steve\"
      sendInvite: true
      email: \"steve@company.com\"
    }
  ) {__typename ... on User {id, username}}
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addUserV2 (
    input: {
      username: \"steve\"
      sendInvite: true
      email: \"steve@company.com\"
    }
  ) {__typename ... on User {id, username}}
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addUserV2 ( ^
    input: { ^
      username: \"steve\" ^
      sendInvite: true ^
      email: \"steve@company.com\" ^
    } ^
  ) {__typename ... on User {id, username}} ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addUserV2 (
    input: {
      username: \"steve\"
      sendInvite: true
      email: \"steve@company.com\"
    }
  ) {__typename ... on User {id, username}}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addUserV2 (
    input: {
      username: \"steve\"
      sendInvite: true
      email: \"steve@company.com\"
    }
  ) {__typename ... on User {id, username}}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addUserV2 (
    input: {
      username: \"steve\"
      sendInvite: true
      email: \"steve@company.com\"
    }
  ) {__typename ... on User {id, username}}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addUserV2 (
    input: {
      username: \"steve\"
      sendInvite: true
      email: \"steve@company.com\"
    }
  ) {__typename ... on User {id, username}}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addUserV2": {
      "__typename": "User",
      "id": "abc123",
      "username": "steve"
    }
  }
}

This is a simple example of how to add a new user to LogScale — and to have the system send that user an invitation by email. To capture and confirm some of the results, the User return type was added with a couple of parameters. You can see this in the results.

Input Parameters

For the input, you can provide the user's name, their email address, whether they may have root access, and other information. These parameters are listed and explained in the table below:

Table: AddUserInputV2 Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 17, 2024
company	string		`Long-Term`	The name of the company associated with the user.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
email	type		`Long-Term`	The user's email address for communications from LogScale. Required when using sendInvite.
firstName	string		`Long-Term`	The user's actual first name (e.g., Rob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Rob U. Blindman). Don't use if using other name parameters.
isOrgOwner	boolean		`Long-Term`	Whether the user account is the organization owner.
isRoot	boolean		`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Blindman). Don't use with fullName.
picture	type		`Long-Term`	The file name of an image file for the user.
sendInvite	boolean		`Long-Term`	Whether LogScale should send an email providing the user with information to login.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	User name for the login account.
verificationToken	string		`Long-Term`	The verification token for the user account.

As mentioned previously, the addition of a user account and setting of attributes related to that account are made in LogScale, but some values may be captured in return by the application by specifying the desired fields based on the userOrPendingUser schema.

Returned Values

The fields available depend on whether the user has been created, or is instead a pending user. This is determined based on whether the input parameters include not sending an invitation (i.e., sendInvite is set to false). So what's pending is the user acceptance of the invitation.

The schema for the User possibility includes all of the user account attributes. They are listed in the table below, along with their data type and a description of each. Additionally, the Resultant column is used to indicate whether the respective field is always created and filled with a value.

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

The schema for the PendingUser possibility includes several fields based on the minimal data collected thus far. They are listed in the table below, along with their data type and a description of each, as well as whether the respective field will always result in it being created and filled with a value.

Table: PendingUser Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 26, 2025
createdAt	long	yes	`Long-Term`	The time the pending user was created.
id	string	yes	`Long-Term`	The identifier or token for the pending user.
idp	boolean	yes	`Long-Term`	Whether IdP is enabled for the organization.
invitedByEmail	string	yes	`Long-Term`	The email address of the user that invited the pending user.
invitedByName	string	yes	`Long-Term`	The name of the user that invited the pending user.
newUserEmail	string	yes	`Long-Term`	The email of the pending user.
orgName	string	yes	`Long-Term`	The name of the organization for the pending user.
pendingUserState	PendingUserState	yes	`Long-Term`	The current organization state for the user. See PendingUserState.

assignUserRolesInSearchDomain()

Summary

The assignUserRolesInSearchDomain() GraphQL mutation field is used to assigns roles for the user in the search domain. It allows assigning multiple roles for the same view and is thus dependent on the MultipleViewRoleBindings feature being enabled. Use the unassignUserRoleForSearchDomain() mutation to unassign them.

Hide Query Example

Show Users and Roles Query

To get a list of users and their roles for search domains, you could execute the searchDomains() query like this:

graphql

query {
     searchDomains
       { usersV2 
           { username, 
             rolesV2
                 { roles { id, displayName, 
                           viewPermissions } }
            }
        }
   }

API Stability	`Short-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

assignUserRolesInSearchDomain(
       input: AssignUserRolesInSearchDomainInput!
    ): [User]!

For the input, you'll have to give the unique identifier for the search domain, and a list of users and the roles you want to assign. Click on Show Query above to find this identifier. See the Input Parameters section for details.

For the results, you can get plenty on the user. See the Returned Datatype section for your choices.

Example

Raw

graphql

mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: "abc123", 
       roleAssignments: [ 
         { userId: "def456",
           roleIds: [ "ghi789" ] } ] 
       } )
   { id, username }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: \"abc123\", 
       roleAssignments: [ 
         { userId: \"def456\",
           roleIds: [ \"ghi789\" ] } ] 
       } )
   { id, username }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: \"abc123\", 
       roleAssignments: [ 
         { userId: \"def456\",
           roleIds: [ \"ghi789\" ] } ] 
       } )
   { id, username }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  assignUserRolesInSearchDomain(input:  ^
      {searchDomainId: \"abc123\",  ^
       roleAssignments: [  ^
         { userId: \"def456\", ^
           roleIds: [ \"ghi789\" ] } ]  ^
       } ) ^
   { id, username } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: \"abc123\", 
       roleAssignments: [ 
         { userId: \"def456\",
           roleIds: [ \"ghi789\" ] } ] 
       } )
   { id, username }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: \"abc123\", 
       roleAssignments: [ 
         { userId: \"def456\",
           roleIds: [ \"ghi789\" ] } ] 
       } )
   { id, username }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: \"abc123\", 
       roleAssignments: [ 
         { userId: \"def456\",
           roleIds: [ \"ghi789\" ] } ] 
       } )
   { id, username }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  assignUserRolesInSearchDomain(input: 
      {searchDomainId: \"abc123\", 
       roleAssignments: [ 
         { userId: \"def456\",
           roleIds: [ \"ghi789\" ] } ] 
       } )
   { id, username }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "assignUserRolesInSearchDomain": {
      "id": "def456",
      "username": "bob"
    }
  }
}

Input Parameters

For the given datatype, you'll need to provide the unique identifier for the search domain, and a list of users and the roles you want to assign to them for that search domain. Click on the Show Query link above the Syntax section to find this identifier.

Table: AssignUserRolesInSearchDomainInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 17, 2024
roleAssignments	[UserRoleAssignmentInput]	yes	`Short-Term`	The user roles to assign in search domain. See UserRoleAssignmentInput.
searchDomainId	string	yes	`Short-Term`	The unique identifier of the search domain.

Returned Values

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

changeUserAndGroupRolesForSearchDomain()

Summary

Users can be assigned roles that contain a set of permissions. Users can also be part of groups, which can also be assigned roles. To change the roles for a user or a group for a particular search domain, you can use the changeUserAndGroupRolesForSearchDomain() GraphQL mutation.

Hide Query Example

Show Group, Roles, and Users Query

To get a list of groups, roles, and users, you could use the searchDomains() query like this:

graphql

query{
    searchDomains
       { id, name, __typename,
         groups { id, displayName, 
                  roles { role { id, displayName,
                          users { id, username },
                          viewPermissions } } 
                 }
         } 
  }

The results of this query will provide a list or search domains and their identifiers. It will also return information on the groups, roles, and users for each.

For more information on roles in LogScale, see the Manage Users and Permissions documentation page. You may also want to look at Manage Users and Permissions for related information.

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

changeUserAndGroupRolesForSearchDomain(
      searchDomainId: string!,
      groups: [GroupRoleAssignment]!,
      users: [UserRoleAssignment]!
   ): [UserOrGroup]!

For the input, you'll have to give unique identifiers for the search domain, the group or user, and the role. To see an example of how to find all of that, click on the Show Query link above.

For the results, depending on whether you change roles for a user or a group, you would request information on the user or the group changed. See the Returned Values section farther down this page for more on this.

Example

Raw

graphql

mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: "aK9GKAsTnMXfRxT8Fpecx3fX",
      groups: [ {groupId: "abc123", 
                 roleId: "def456"} ],
      users:  [ {userId: "ghi789", 
                 roleId: "jkl012"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\",
      groups: [ {groupId: \"abc123\", 
                 roleId: \"def456\"} ],
      users:  [ {userId: \"ghi789\", 
                 roleId: \"jkl012\"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\",
      groups: [ {groupId: \"abc123\", 
                 roleId: \"def456\"} ],
      users:  [ {userId: \"ghi789\", 
                 roleId: \"jkl012\"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  changeUserAndGroupRolesForSearchDomain( ^
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\", ^
      groups: [ {groupId: \"abc123\",  ^
                 roleId: \"def456\"} ], ^
      users:  [ {userId: \"ghi789\",  ^
                 roleId: \"jkl012\"} ] ) ^
  {... on Group {displayName, userCount} ^
   ... on User {username} } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\",
      groups: [ {groupId: \"abc123\", 
                 roleId: \"def456\"} ],
      users:  [ {userId: \"ghi789\", 
                 roleId: \"jkl012\"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\",
      groups: [ {groupId: \"abc123\", 
                 roleId: \"def456\"} ],
      users:  [ {userId: \"ghi789\", 
                 roleId: \"jkl012\"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\",
      groups: [ {groupId: \"abc123\", 
                 roleId: \"def456\"} ],
      users:  [ {userId: \"ghi789\", 
                 roleId: \"jkl012\"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  changeUserAndGroupRolesForSearchDomain(
      searchDomainId: \"aK9GKAsTnMXfRxT8Fpecx3fX\",
      groups: [ {groupId: \"abc123\", 
                 roleId: \"def456\"} ],
      users:  [ {userId: \"ghi789\", 
                 roleId: \"jkl012\"} ] )
  {... on Group {displayName, userCount}
   ... on User {username} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

For the input, you'll have to give unique identifiers for the search domain. You'll also have to give either the unique identifier for a group or a user, as well as identifier of a role (see second and third tables below). For an example of how to find all of that, click on the Show Query link above the Syntax section near the top of this page.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Description
This table contains all input parameters for this mutation. Since two of the parameters use special datatypes, additional tables for them are included below.
groups	[GroupRoleAssignment]	yes	Any group role assignments. See table below.
searchDomainId	string	yes	The unique identifier of the search domain, the repository or view for which you want to change user or group roles.
users	UserRoleAssignment	yes	A list of user role assignments. See table below.

With the first special input datatype, you would specify the unique identifiers of a group and a role. The table below explains these parameters:

Table: GroupRoleAssignment Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 18, 2024
groupId	string	yes	`Long-Term`	The unique identifier for the group related to the role.
roleId	string	yes	`Long-Term`	The unique identifier of the role.

With this second special input datatype, you would specify the unique identifiers of a user and a role. The table below explains these parameters:

Table: UserRoleAssignment Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 23, 2024
userId	string	yes	`Long-Term`	The unique identifier of the user for which to assign the role.
roleId	string	yes	`Long-Term`	The unique identifier for the role to assign.

Returned Values

The returned datatype, UserOrGroup is a union of two other datatypes: Group and User. You would preface your choice with ellipses and the reserved word on like this: ... on Group. See the Example for a better understanding.

With the union, if you changed a role for a group, you might want to get information on that group (e.g., a list of roles for the group). After changing a role for a user, you may want to know more about the user (e.g., a list of roles for the user). The parameters for each sub-datatype are listed in the tables below:

Table: Group Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 11, 2025
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): GroupAssetActionsBySource	multiple	yes	`Preview`	Get allowed asset actions for the group on a specific asset and explain how it has gotten this access. See AssetPermissionsAssetType GroupAssetActionsBySource.
defaultQueryPrefix	string		`Long-Term`	The default prefix for queries.
defaultRole	Role		`Long-Term`	The default role associated with the group. See Role.
defaultSearchDomainCount	integer	yes	`Long-Term`	The default search domain count.
displayName	string	yes	`Long-Term`	The display name of the group.
id	string	yes	`Long-Term`	The identifier of the group.
lookupName	string		`Long-Term`	The look-up name for the group.
organizationRoles	[GroupOrganizationRole]	yes	`Long-Term`	The roles of the organization associated with the group. See GroupOrganizationRole.
permissionType	PermissionType		`Long-Term`	Indicates which level of permissions the group contains. See PermissionType .
queryPrefixes(onlyIncludeRestrictiveQueryPrefixes: boolean, onlyForRoleWithId: string): [QueryPrefixes]	multiple		`Long-Term`	The query prefixes for the group. See QueryPrefixes.
roles	[SearchDomainRole]	yes	`Long-Term`	The roles for the group See SearchDomainRole.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction], includeUnassignedAssets: boolean): AssetPermissionSearchResultSet	multiple	yes	`Short-Term`	Search for asset permissions for the group. This is a preview and subject to change. See AssetPermissionsAssetType AssetAction, and AssetPermissionSearchResultSet.
searchDomainCount	integer	yes	`Long-Term`	The number of search domains for the group.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple	yes	`Long-Term`	The search domain roles assigned to the group. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles assigned to the group, by name. See SearchDomainRole. When multiple roles per view is enabled, this field will return only the first of possibly multiple roles matching the name for the view. Use roles, searchDomainRoles, or searchDomainRolesBySearchDomainName fields instead. This field will be removed at the earliest in version 1.195.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple	yes	`Long-Term`	The domain roles by search domain name. See SearchDomainRole.
searchUsers(searchFilter: string, skip: integer, limit: integer, sortBy: OrderByUserField, orderBy: OrderBy): UserResultSetType	multiple		`Long-Term`	Used to search the list of users in the group. See OrderByUserField , OrderBy , UserResultSetType.
systemRoles	[GroupSystemRole]	yes	`Long-Term`	The system roles of the group. See GroupSystemRole.
userCount	integer	yes	`Long-Term`	The number of users that are part of the group.
users	[User]	yes	`Long-Term`	The list of users in the group. See User.

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

createPersonalUserToken()

Summary

The createPersonalUserToken() GraphQL mutation is used to create a personal user token. It will inherit the same permissions as the user. As an alternative, you can use the createPersonalUserTokenV2(), which returns more than the token string.

To change the permissions associated with a personal user token, you can use the updateViewPermissionsTokenPermissions() mutation. Use deleteToken() to delete a token.

Hide Query Example

Show Permissions Query

To get a list of user permissions, you could use the roles() query:

graphql

query {
     roles
       { totalResults,
         results { id, displayName, 
                   users { id, username, 
                           permissions { viewPermissions } } 
        }
    }

For more information on access tokens of various types, see the Ingest Tokens documentation page. For information on user authorization, see the Manage Users and Permissions documentation page.

API Stability Long-Term

Syntax

graphql

createPersonalUserToken(
      input: CreatePersonalUserTokenInput!
   ): string

For the input, you'd give the unique identifier of an IP filter to use, and when the token will expire. See the Input Parameters section for details.

For the results, you'll receive confirmation if successful.

Example

Raw

graphql

mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createPersonalUserToken(input: ^
      { expireAt: null } ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createPersonalUserToken(input:
      { expireAt: null } )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createPersonalUserToken": "abc123-def456-ghi789"
  }
}

Input Parameters

For the input, you may specify the unique identifier of an IP filter that you want to use, and when the token will expire. These are explained in the table below:

Table: CreatePersonalUserTokenInput Input Datatype

Parameter	Type	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 17, 2024
expireAt	long	`Long-Term`	Name of the view of the parser.
ipFilterId	string	`Long-Term`	Name of the parser.

createPersonalUserTokenV2()

Summary

The createPersonalUserTokenV2() GraphQL mutation field is used to create a personal user token for the user. It will inherit the same permissions as the user.

To change the permissions associated with a personal user token, you can use the updateViewPermissionsTokenPermissions() mutation. Use xxdeleteTokenxxx() to delete a token.

Hide Query Example

Show View Permissions Query

To get a list of user permissions for , you could use the roles() query:

graphql

query {
     roles
       { totalResults,
         results { id, displayName, 
                   users { id, username, 
                           permissions { viewPermissions } } 
        }
    }

Instead of using the GraphQL API, you can use the LogScale UI to create a personal user token. See the Personal API Token section of the Manage Your LogScale Account documentation page for more information.

API Stability Long-Term

Syntax

graphql

createPersonalUserTokenV2(
       input: CreatePersonalUserTokenV2Input!
    ): CreatePersonalUserTokenV2Output!

For the input, you'd give the unique identifier of an IP filter to use, and when the token will expire. See the Input Parameters section for details.

For the results, you can get the IP filter, when the it will expire, etc. See the Returned Values section for more.

Example

Raw

graphql

mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createPersonalUserTokenV2(input: ^
       { expireAt: null } ) ^
  { token, tokenMetadata { name } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createPersonalUserTokenV2(input:
       { expireAt: null } )
  { token, tokenMetadata { name } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createPersonalUserTokenV2": {
      "token": "abc123-def456-ghi789",
      "tokenMetadata": {
        "name": "Personal token"
      }
    }
  }
}

Input Parameters

For the input, you may specify the unique identifier of an IP filter that you want to use, and when the token will expire. These are explained in the table below:

Table: CreatePersonalUserTokenV2Input Input Datatype

Parameter	Type	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 23, 2025
expireAt	long	`Long-Term`	The date when the token expires.
ipFilterId	string	`Long-Term`	The IP address on which to filter access.

Returned Values

For the results, you can get the IP filter, if there is one, that's used with the token, when the token will expire, and other information. The table below contains some details:

Table: CreatePersonalUserTokenV2Output Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 13, 2025
token	string	yes	`Long-Term`	The personal user token.
tokenMetadata	PersonalUserToken	yes	`Long-Term`	Metadata about the token. See PersonalUserToken, which implements Token.

removeLoginBridgeAllowedUsers()

Summary

The removeLoginBridgeAllowedUsers() GraphQL mutation field is used to remove allowed users from the login bridge.

To add a user from the allowed list, use the addLoginBridgeAllowedUsers() mutation. To add a login bridge, use setLoginBridge(). To make changes, use updateLoginBridge() and removeLoginBridge() to eliminate it.

Hide Query Example

Show Allowed Users Query

To get a list of allowed users, you could execute the organization() like this:

graphql

query {
     organization {
       configs {
         subdomains: {
           loginBridge { allowedUsers }
           }
       }
     }
   }

API Stability Long-Term

Syntax

graphql

removeLoginBridgeAllowedUsers(
      userID: string!
   ): LoginBridge!

You'll have to give the unique identifier of the user you want to remove from the list of allowed users. Click on Show Query above to find the identifier.

For the results, you can get the login URL, the response from SAML, and the relay state. See the Returned Values section for more details.

Example

Raw

graphql

mutation {
  removeLoginBridgeAllowedUsers(
    userID: "abc123"
  )
  { name }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeLoginBridgeAllowedUsers(
    userID: \"abc123\"
  )
  { name }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeLoginBridgeAllowedUsers(
    userID: \"abc123\"
  )
  { name }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeLoginBridgeAllowedUsers( ^
    userID: \"abc123\" ^
  ) ^
  { name } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeLoginBridgeAllowedUsers(
    userID: \"abc123\"
  )
  { name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeLoginBridgeAllowedUsers(
    userID: \"abc123\"
  )
  { name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeLoginBridgeAllowedUsers(
    userID: \"abc123\"
  )
  { name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeLoginBridgeAllowedUsers(
    userID: \"abc123\"
  )
  { name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeLoginBridgeAllowedUsers": {
      "name": "pont-neuf"
    }
  }
}

Input Parameters

For the input, you'll have to give the unique identifier of the user you want to remove from the list of allowed users. Click on the Show Query link above the Syntax section for an example of how to find the identifier.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Default	Description
This table contains all input parameters for this mutation.
userID	string	yes		The unique identifier of the user to remove from list.

Returned Values

For the results, you can get the login URL, the response from SAML, and the relay state. These are described in the table here:

Table: LoginBridge Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 26, 2024
additionalAttributes	string		`Long-Term`	Any additional attributes.
allowedUsers	[User]	yes	`Long-Term`	A list of users allowed to access the bridge. See User.
anyUserAlreadyLoggedInViaLoginBridge	boolean	yes	`Long-Term`	True if any user in this organization has logged in to CrowdStream via LogScale. Requires manage organizations permissions. Whether to generate user names.
description	string	yes	`Long-Term`	A description of the login bridge.
generateUserName	boolean	yes	`Long-Term`	Whether to generate user names.
groupAttribute	string	yes	`Long-Term`	Any group attributes.
groups	[string]	yes	`Long-Term`	Any groups associated with the login bridge.
issuer	string	yes	`Long-Term`	The issuer of the login bridge.
loginUrl	string	yes	`Long-Term`	The URL for logging in.
name	string	yes	`Long-Term`	The name of the login bridge.
organizationIdAttributeName	string	yes	`Long-Term`	The organization's unique identifier of the attribute name.
organizationNameAttributeName	string		`Long-Term`	The organization's name of the attribute name.
publicSamlCertificate	string	yes	`Long-Term`	The public SAML certificate.
relayStateUUrl	string	yes	`Long-Term`	The relay state URL.
remoteId	string	yes	`Long-Term`	The unique identifier of the remote connection.
samlEntityId	string	yes	`Long-Term`	The unique identifier of the SAML entity.
showTermsAndConditions	boolean	yes	`Long-Term`	Whether to show the terms and conditions.
termsDescription	string	yes	`Long-Term`	A description of the terms.
termsLink	string	yes	`Long-Term`	A link to the terms and conditions.

removeQueryQuotaUserSettings()

Summary

The removeQueryQuotaUserSettings() GraphQL mutation field is used to remove query quota settings for a given user.

API Stability Short-Term

Syntax

graphql

removeQueryQuotaUserSettings(
     username: string!
   ): boolean

You'll have to give the user name from whom you want to remove query quota settings.

For the results, you'll receive confirmation if successful.

Example

Raw

graphql

mutation {
  removeQueryQuotaUserSettings(
    username: "wilbur"
  )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeQueryQuotaUserSettings(
    username: \"wilbur\"
  )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeQueryQuotaUserSettings(
    username: \"wilbur\"
  )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeQueryQuotaUserSettings( ^
    username: \"wilbur\" ^
  ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeQueryQuotaUserSettings(
    username: \"wilbur\"
  )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeQueryQuotaUserSettings(
    username: \"wilbur\"
  )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeQueryQuotaUserSettings(
    username: \"wilbur\"
  )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeQueryQuotaUserSettings(
    username: \"wilbur\"
  )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeQueryQuotaUserSettings": true
  }
}

Input Parameters

For the input, you'll have to give the user name for which you want to remove query quota settings.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Default	Description
This table contains all input parameters for this mutation.
username	string	yes		The user name for which you want to remove query quota settings.

removeUser()

Summary

The removeUser() GraphQL mutation may be used to remove a user from LogScale using their user name. If you have the user's unique identifer, though, you can use removeUserById().

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

removeUser(
      input: RemoveUserInput!
   ): RemoveUserMutation!

For the input, you'll have to give the user name for the user account to delete. See the Input Parameters section.

For the results, you can get plenty of information. However, since you will be deleting the user account, you'll only want confirmation. So requesting the identifier may be enough.

Example

Raw

graphql

mutation {
  removeUser(input:
     { username: "bob" } 
  )
  { user { id, firstName } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeUser(input:
     { username: \"bob\" } 
  )
  { user { id, firstName } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeUser(input:
     { username: \"bob\" } 
  )
  { user { id, firstName } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeUser(input: ^
     { username: \"bob\" }  ^
  ) ^
  { user { id, firstName } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeUser(input:
     { username: \"bob\" } 
  )
  { user { id, firstName } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeUser(input:
     { username: \"bob\" } 
  )
  { user { id, firstName } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeUser(input:
     { username: \"bob\" } 
  )
  { user { id, firstName } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeUser(input:
     { username: \"bob\" } 
  )
  { user { id, firstName } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeUser": {
      "user": {
        "id": "abc123",
        "firstName": "Bob"
      }
    }
  }
}

Input Parameters

For the input, you'll have to give the user name. The table below describes this:

Table: RemoveUserInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
username	string	yes	`Long-Term`	The user name of the user to remove.

Returned Values

For the results, you can get a multitude of information on a user account. Besides the usual information (e.g., name, email address, etc.), it can return data about user permissions and access, what groups they're a member and the assets to which they have access. Below is a list of them, along with a description of each, but you'll have to click on the special datatypes for some to see what else you can request:

Table: RemoveUserMutation Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 3, 2024
user	User	yes	`Long-Term`	The user to remove from the mutation. See User.

removeUserById()

Summary

The removeUserById() GraphQL mutation is used to remove a user by their identifier. If you know their user name, though, you can use instead the removeUser() mutation.

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

removeUserById(
      input: RemoveUserByIdInput!
   ): RemoveUserByIdMutation!

For the input, you'll have to give the unique identifier for the user account to delete. You can use the users() query to get this. See the Input Parameters section for details.

For the results, you can get plenty of information. However, since you will be deleting the user account, you'll only want confirmation. So requesting the identifier may be enough.

Example

Raw

graphql

mutation {
  removeUserById(input:
     { id: "abc123" } 
  )
  { user { id, firstName } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeUserById(input:
     { id: \"abc123\" } 
  )
  { user { id, firstName } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeUserById(input:
     { id: \"abc123\" } 
  )
  { user { id, firstName } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeUserById(input: ^
     { id: \"abc123\" }  ^
  ) ^
  { user { id, firstName } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeUserById(input:
     { id: \"abc123\" } 
  )
  { user { id, firstName } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeUserById(input:
     { id: \"abc123\" } 
  )
  { user { id, firstName } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeUserById(input:
     { id: \"abc123\" } 
  )
  { user { id, firstName } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeUserById(input:
     { id: \"abc123\" } 
  )
  { user { id, firstName } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeUserById": {
      "user": {
        "id": "abc123",
        "firstName": "Bob"
      }
    }
  }
}

Input Parameters

For the input, you'll have to give the unique identifier for the user. You can use the users() query to get a list of users and their identifiers.

Table: RemoveUserByIdInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
id	string	yes	`Long-Term`	The unique identifier of the user to be removed.

Returned Values

Table: RemoveUserByIdMutation Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 3, 2024
user	User	yes	`Long-Term`	The user to remove from the mutation. See User.

removeUsersFromGroup()

Summary

For a variety of reasons, you may want to remove users from a group. You can do this with the removeUsersFromGroup() GraphQL mutation. Doing so doesn't delete the user accounts. It only removes them from the group.

To add users to a group, you can use the addUsersToGroup() mutation.

Hide Query Example

Show Users in Group Query

To get a list of all groups and their unique identifiers, use the groupsPage() query:

graphql

query {
     groupsPage ( pageSize: 10, pageNumber: 1 )
        { page { id, displayName } }
   }

With these results you can get the unique identifier of a group to get a list of users in the group by using the group() query like this:

graphql

query{
    group( groupId: "abc123" ) {
      displayName, userCount, users { id, username }
    }
  }

With these results you can see who is a member of the group. To get a list of user names, use the users() query.

For more information on user authorization, see the Manage Users and Permissions documentation page. In particular, read the section on groups, Manage Groups.

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

removeUsersFromGroup(
      input: RemoveUsersFromGroupInput!
   ): RemoveUsersFromGroupMutation!

For the input, you will need to give the unique identifier of the group (click on Show Query above for an example of how to get this). You'll also have to enter a comma-separated list of user names. Click on Show Query above to find these items.

For the results, you can get plenty details on the group, in particular a list of remaining users. See the Returned Values section for more details.

Example

Raw

graphql

mutation {
  removeUsersFromGroup(input: 
         { groupId: "abc123",
           users: ["bob", "tom"] } )
    { group {displayName, userCount} }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeUsersFromGroup(input: 
         { groupId: \"abc123\",
           users: [\"bob\", \"tom\"] } )
    { group {displayName, userCount} }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeUsersFromGroup(input: 
         { groupId: \"abc123\",
           users: [\"bob\", \"tom\"] } )
    { group {displayName, userCount} }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeUsersFromGroup(input:  ^
         { groupId: \"abc123\", ^
           users: [\"bob\", \"tom\"] } ) ^
    { group {displayName, userCount} } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeUsersFromGroup(input: 
         { groupId: \"abc123\",
           users: [\"bob\", \"tom\"] } )
    { group {displayName, userCount} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeUsersFromGroup(input: 
         { groupId: \"abc123\",
           users: [\"bob\", \"tom\"] } )
    { group {displayName, userCount} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeUsersFromGroup(input: 
         { groupId: \"abc123\",
           users: [\"bob\", \"tom\"] } )
    { group {displayName, userCount} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeUsersFromGroup(input: 
         { groupId: \"abc123\",
           users: [\"bob\", \"tom\"] } )
    { group {displayName, userCount} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addUsersToGroup": {
      "group": {
        "displayName": "Maintainers",
        "userCount": 5
      }
    }
  }
}

Input Parameters

For the input, you'll have to give the unique identifier for the group, and a list of users to remove from that group. For an example of how to get the group identifier and user names, click on Show Query above the Syntax section.

Table: RemoveUsersFromGroupInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
groupId	string	yes	`Long-Term`	The unique identifier of the group from which users should be removed.
users	[string]	yes	`Long-Term`	A list of users to remove from the group.

Returned Values

For the results, you can get plenty on the group. What may be most of interest to you with this mutation is the users sub-option to get a list of remaining users. Click on the link in the table below to the sub-datatype for more details:

Table: RemoveUsersFromGroupMutation Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 26, 2025
group	Group	yes	`Long-Term`	The group from which to remove users from the mutation. See Group.

revokePendingUser()

Summary

The revokePendingUser() GraphQL mutation is used to revoke a pending user. Once revoked, the invitation link sent to the user becomes invalid.

API Stability Long-Term

Syntax

graphql

revokePendingUser(
     input: TokenInput!
   ): boolean

For the input, you'll have to give the token for the pending user. See the Input Parameters section for details.

For the results, you'll receive confirmation if successful.

Example

Raw

graphql

mutation {
  revokePendingUser( input: {
     token: "abc123"
  } )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  revokePendingUser( input: {
     token: \"abc123\"
  } )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  revokePendingUser( input: {
     token: \"abc123\"
  } )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  revokePendingUser( input: { ^
     token: \"abc123\" ^
  } ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  revokePendingUser( input: {
     token: \"abc123\"
  } )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  revokePendingUser( input: {
     token: \"abc123\"
  } )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  revokePendingUser( input: {
     token: \"abc123\"
  } )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  revokePendingUser( input: {
     token: \"abc123\"
  } )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "revokePendingUser": true
  }
}

Input Parameters

For the input, you'll have to give the token for the pending user. It's explained in the table here:

Table: TokenInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 20, 2024
token	string	yes	`Long-Term`	The unique token to use.

unassignUserRoleForSearchDomain()

Summary

The unassignUserRoleForSearchDomain() GraphQL mutation field is used to unassign user roles for search domains.

Use the assignUserRolesInSearchDomain() mutation to assign them.

Hide Query Example

Show Users and Roles Query

To get a list of users and their roles for search domains, you could execute the searchDomains() query like this:

graphql

query {
     searchDomains
       { usersV2 
           { username, 
             rolesV2
                 { roles { id, displayName, 
                           viewPermissions } }
            }
        }
   }

For more information on roles in LogScale, see the Manage Users and Permissions documentation page. To unassign users from a role, read Edit a user role.

API Stability Long-Term

Syntax

graphql

unassignUserRoleForSearchDomain(
     userId: string!, 
     searchDomainId: string!,
     roleId: string
   ): User!

You'll need to give the unique identifiers of the repository or view, the user, and optionally the role to unassign. If you don't specify a role, this mutation will unassign all user roles for the user in the search domain. Click on Show Query above to get the identifiers.

For the results, you can get plenty on the user account (e.g., user permissions and access). See the Returned Values for more.

Example

Raw

graphql

mutation {
  unassignUserRoleForSearchDomain(
     userId: "abc123",
     searchDomainId: "def456",
     roleId: "ghi789"
  )
    { username }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  unassignUserRoleForSearchDomain(
     userId: \"abc123\",
     searchDomainId: \"def456\",
     roleId: \"ghi789\"
  )
    { username }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  unassignUserRoleForSearchDomain(
     userId: \"abc123\",
     searchDomainId: \"def456\",
     roleId: \"ghi789\"
  )
    { username }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  unassignUserRoleForSearchDomain( ^
     userId: \"abc123\", ^
     searchDomainId: \"def456\", ^
     roleId: \"ghi789\" ^
  ) ^
    { username } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  unassignUserRoleForSearchDomain(
     userId: \"abc123\",
     searchDomainId: \"def456\",
     roleId: \"ghi789\"
  )
    { username }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  unassignUserRoleForSearchDomain(
     userId: \"abc123\",
     searchDomainId: \"def456\",
     roleId: \"ghi789\"
  )
    { username }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  unassignUserRoleForSearchDomain(
     userId: \"abc123\",
     searchDomainId: \"def456\",
     roleId: \"ghi789\"
  )
    { username }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  unassignUserRoleForSearchDomain(
     userId: \"abc123\",
     searchDomainId: \"def456\",
     roleId: \"ghi789\"
  )
    { username }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "unassignUserRoleForSearchDomain": {
      "username": "bob"
    }
  }
}

Input Parameters

For the input, you need to provide the unique identifiers of the repository or view, the user, and optionally the role to unassign. If you don't specify a role, this mutation will unassign all user roles for the user in the search domain. Click on the Show Query link above the Syntax section for an example of how to find the identifiers.

Table: Input Parameters & Datatypes

Parameter	Type	Required	Description
This table contains all input parameters for this mutation.
roleId	string		The unique identifier of the role to unassign.
searchDomainId	string	yes	The unique identifier of the repository or view.
userId	string	yes	The unique identifier of the user account.

Returned Values

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

updateUser()

Summary

The updateUser() GraphQL mutation is used to update a user in LogScale — with the user name. If you know their unique identifier, though, you can use instead the updateUserById() mutation.

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

updateUser(
      input: AddUserInput!
   ): UpdateUserMutation!

For the input, you'll have to give the user name, and whatever user information you want to change. See the Input Parameters section for details.

For the results, you can get a multitude of information on the user account. See the Returned Values section.

Example

Raw

graphql

mutation {
  updateUser( input:
       { username: "bob",
         isRoot: true
      } )
  { user { id } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUser( input:
       { username: \"bob\",
         isRoot: true
      } )
  { user { id } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUser( input:
       { username: \"bob\",
         isRoot: true
      } )
  { user { id } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateUser( input: ^
       { username: \"bob\", ^
         isRoot: true ^
      } ) ^
  { user { id } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateUser( input:
       { username: \"bob\",
         isRoot: true
      } )
  { user { id } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateUser( input:
       { username: \"bob\",
         isRoot: true
      } )
  { user { id } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateUser( input:
       { username: \"bob\",
         isRoot: true
      } )
  { user { id } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateUser( input:
       { username: \"bob\",
         isRoot: true
      } )
  { user { id } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "updateUser": {
      "user": {
        "id": "abc123"
      }
    }
  }
}

Input Parameters

For the input, you would provide the user name, and whatever you want to change: the user's name, their email address, whether they may have root access, and other information. These parameters are listed and explained in the table below:

Table: AddUserInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 17, 2024
company	string		`Long-Term`	The name of the company or other entity associated with the user.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
email	string		`Long-Term`	The email address for contacting the user related to the account.
firstName	string		`Long-Term`	The first name of the user.
fullName	string		`Long-Term`	The full name of the user.
isRoot	boolean		`Long-Term`	Whether the user has root access.
lastName	string		`Long-Term`	The last name or family name of the user.
picture	string		`Long-Term`	The file name of an image file containing a picture of the user.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The name of the user.

Returned Values

For the results, can get a multitude of information on the user account. Besides the usual information (e.g., name, email address, etc.), it can return data about user permissions and access, what groups they're a member and the assets to which they have access. See the second table below for the sub-parameters.

Table: UpdateUserMutation Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 4, 2024
user	User	yes	`Long-Term`	The user to update. See User.

The datatype above uses another datatype for user information. For your convenience, the table for that sub-datatype is included here:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

updateUserById()

Summary

The updateUserById() GraphQL mutation may be used to update a user account in LogScale based on a given unique identifier. If you know the user name, though, you can use instead the updateUser() mutation.

API Stability	`Long-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

updateUserById(
      input: UpdateUserByIdInput!
   ): UpdateUserByIdMutation!

For the input, you'll have to give the identifier of the user account, and whatever user information you want to change. Use the users() query to get a list of users and their identifiers. See the Input Parameters section for details.

For the results, you can get a multitude of information on a user account. See the Returned Values section.

Example

Raw

graphql

mutation {
  updateUserById( input:
       { userId: "abc123",
         isRoot: true        
      } )
  { user { username } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUserById( input:
       { userId: \"abc123\",
         isRoot: true        
      } )
  { user { username } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUserById( input:
       { userId: \"abc123\",
         isRoot: true        
      } )
  { user { username } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateUserById( input: ^
       { userId: \"abc123\", ^
         isRoot: true         ^
      } ) ^
  { user { username } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateUserById( input:
       { userId: \"abc123\",
         isRoot: true        
      } )
  { user { username } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateUserById( input:
       { userId: \"abc123\",
         isRoot: true        
      } )
  { user { username } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateUserById( input:
       { userId: \"abc123\",
         isRoot: true        
      } )
  { user { username } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateUserById( input:
       { userId: \"abc123\",
         isRoot: true        
      } )
  { user { username } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "updateUserById": {
      "user": {
        "username": "bob"
      }
    }
  }
}

Input Parameters

For the input, you would provide the unique identifier of the user account, and whatever you want to change: the user's name, their email address, whether they may have root access, and other information. Use the users() query to get a list of users and their identifiers.

Table: UpdateUserByIdInput Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 23, 2024
company	string		`Long-Term`	The name of the company or organization entity by which the user is affiliated.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
email	string		`Long-Term`	The email address of the user for contacting regarding the account.
firstName	string		`Long-Term`	The first name of the user.
fullName	string		`Long-Term`	The full name of the user.
isRoot	boolean		`Long-Term`	Whether the user being updated has root access.
lastName	string		`Long-Term`	The last name or family name of the user.
picture	string		`Long-Term`	The name of an image file containing a photograph of the user.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
userId	string	yes	`Long-Term`	The unique identifier of the user to update.
username	string		`Long-Term`	The username for the account to update.

Returned Values

The results, by way of sub-parameters, can return a multitude of information on a user account. Besides the usual information (e.g., name, email address, etc.), it can return data about user permissions and access, what groups they're a member and the assets to which they have access. See the second table below for the sub-parameters.

Table: UpdateUserByIdMutation Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Apr 2, 2025
user	User	yes	`Long-Term`	The user to update based on the unique identifier of the user. See User.

The datatype above uses another datatype for user information. For your convenience, the table for that sub-datatype is included here:

Table: User Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jun 26, 2026
allowedAssetActionsBySource(assetId: string, assetType: AssetPermissionsAssetType, searchDomainId: string): [AssetActionsBySource]	multiple	yes	`Short-Term`	Get allowed asset actions for the user on a specific asset and explain how these actions have been granted. See AssetPermissionsAssetType , and AssetActionsBySource.
allowedOrganizationActions	[OrganizationAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the organization. See OrganizationAction .
allowedSystemActions	[SystemAction]	yes	`Long-Term`	Returns the actions the user is allowed to perform in the system. See SystemAction Table.
company	string		`Long-Term`	The name of the company for the user account.
countryCode	string		`Long-Term`	The two-letter ISO 3166-1 Alpha-2 code for the country of residence (e.g., us).
createdAt	datetime	yes	`Long-Term`	The data and time the account was created.
displayName	string	yes	`Long-Term`	The value of the fullName if used, otherwise the username.
email	string		`Long-Term`	The user account's email address for communications from LogScale.
firstName	string		`Long-Term`	The user's actual first name (e.g., Bob). Don't use with fullName.
fullName	string		`Long-Term`	The user's full name (e.g., Bob Smith). Don't use if using other name parameters.
groups	[Group]	yes	`Long-Term`	The groups of which the user is a member. See Group.
groupSearchDomainRoles	[GroupSearchDomainRole]	yes	`Long-Term`	The group search domain roles. See GroupSearchDomainRole.
groupsV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInRoles: boolean): GroupResultSetType	multiple		`Short-Term`	The groups of which the user is a member. This is a preview and subject to change. The default for skip is 0, and limit is 50. See PermissionType , and GroupResultSetType.
id	string	yes	`Long-Term`	The identifier or token for the user.
isOrgRoot	boolean	yes	`Long-Term`	Whether the organization is granted organization ownership.
isRoot	boolean	yes	`Long-Term`	Whether the user account is granted root access.
lastName	string		`Long-Term`	The user's actual last name or family name (e.g., Smith). Don't use with fullName.
permissions(viewName: string): [UserPermissions]	multiple	yes	`Long-Term`	Permissions of the user. See UserPermissions.
phoneNumber	string		`Long-Term`	The telephone number for LogScale to use for telephone text messages.
picture	string		`Long-Term`	File name of an image file for the account.
rolesV2(search: string, typeFilter: [PermissionType], limit: integer, skip: integer, searchInGroups: boolean): RolesResultSetType	multiple		`Short-Term`	The roles assigned to the user through a group. The default for skip is 0, and limit is 50. See PermissionType , and RolesResultSetType.
searchAssetPermissions(searchFilter: string, skip: integer, limit: integer, orderBy: OrderBy, sortBy: SortBy, assetTypes: [AssetPermissionsAssetType], searchDomainIds: [string], permissions: [AssetAction]): AssetPermissionSearchResultSet	multiple		`Short-Term`	Search for asset permissions for the user. This is a preview and subject to change. The default for skip is 0, limit is 50, and OrderBy is ASC. See AssetPermissionsAssetType , AssetAction , and AssetPermissionSearchResultSet.
searchDomainRoles(searchDomainId: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user. See SearchDomainRole.
searchDomainRolesByName(searchDomainName: string): SearchDomainRole	multiple	yes	`Deprecated`	The search domain roles for the user, by name. See SearchDomainRole. This field is deprecated because when multiple roles per view is enabled, it will return only the first of possibly multiple roles matching the name for the view. Use instead searchDomainRoles or searchDomainRolesBySearchDomainName.
searchDomainRolesBySearchDomainName(searchDomainName: string): [SearchDomainRole]	multiple		`Long-Term`	The search domain roles assigned to the user by search domain name. See SearchDomainRole.
stateCode	string		`Long-Term`	The two-letter, ISO 3166-2 country sub-division code for the state of residence (e.g., ny).
username	string	yes	`Long-Term`	The user name for the account.
userOrGroupSearchDomainRoles(search: string, skip: integer, limit: integer): UserOrGroupSearchDomainRoleResultSet	multiple	yes	`Long-Term`	The user or group search domain roles. The default for skip is 0, and limit is 50. See UserOrGroupSearchDomainRoleResultSet.

updateUserDefaultSettings()

Summary

The updateUserDefaultSettings() GraphQL mutation may be used to update user default settings for the organization.

To add a user, use the addUserV2() mutation. To makes changes to a user account, use the updateUser() mutation. To delete a user, you can use the removeUserById() if you know their unique identifier, or the removeUser() mutation if you know their user name.

Hide Query Example

Show Account Settings Query

To get current default time zone, you could use the viewer() query like this:

graphql

query {
     viewer
       { settings { defaultTimeZone } }
   }

API Stability	`Short-Term`
Security Requirement & Control	`ManageUsers` API permission

Syntax

graphql

updateUserDefaultSettings(
      input: UserDefaultSettingsInput!
   ): Organization!

For the input, you'll have to give only the default time zone for the current user. See the Input Parameters section for details.

For the results, you can get the organization's configuration, URLs, limits, etc. See the Returned Values section for more.

Example

Raw

graphql

mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: "UTC+2" } )
  { id }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: \"UTC+2\" } )
  { id }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: \"UTC+2\" } )
  { id }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateUserDefaultSettings( input: ^
    { defaultTimeZone: \"UTC+2\" } ) ^
  { id } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: \"UTC+2\" } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: \"UTC+2\" } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: \"UTC+2\" } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateUserDefaultSettings( input:
    { defaultTimeZone: \"UTC+2\" } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "updateUserDefaultSettings": {
      "id": "SINGLE_ORGANIZATION_ID"
    }
  }
}

Input Parameters

For the input, you have to provide only the default time zone for the current user. Below is a description of this:

Table: UserDefaultSettingsInput Input Datatype

Parameter	Type	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Feb 26, 2025
defaultTimeZone	string	`Short-Term`	The default time zone (e.g., UTC+2 or Europe/Copenhagen).

Returned Values

For the results, you can get the organization's configuration and URLs, any organization limits, and other data. The table below lists what's possible:

Table: Organization Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 21, 2025
cid	string		`Short-Term`	The CID corresponding to the organization.
configs	OrganizationConfigs	yes	`Short-Term`	Organization configurations and settings. See OrganizationDetails.
createdAt	long		`Short-Term`	Date organization was created.
defaultCachePolicy	CachePolicy		`Preview`	The default cache policy of the organization. See CachePolicy. This is a preview and subject to change.
deletedAt	long		`Short-Term`	Day organization was deleted if it was marked for deletion.
description	string		`Short-Term`	The description for the Organization. Can be null.
details	OrganizationDetails	yes	`Short-Term`	Any additional details related to the organization. See OrganizationDetails.
externalGroupSynchronization	boolean	yes	`Short-Term`	Whether there is group synchronization.
externalPermissions	boolean	yes	`Short-Term`	Whether permissions are managed externally.
id	string	yes	`Short-Term`	The unique id for the Organization.
ingestUrl	string		`Short-Term`	The ingest URL for the organization.
isActionAllowed(action: OrganizationAction): boolean	multiple	yes	`Short-Term`	Check if user has a permission in organization. For OrganizationAction, give the action to check if a user is allowed to perform on the organization. See OrganizationAction.
limits	[Limit]	yes	`Short-Term`	Limits assigned to the organization. See Limit.
limitsV2	[LimitV2]	yes	`Short-Term`	Limits assigned to the organization. See LimitV2.
name	string	yes	`Short-Term`	The name for the Organization.
publicUrl	string		`Short-Term`	The public URL for the organization.
readonlyDashboardIPFilter	string		`Short-Term`	IP filter for readonly dashboard links.
searchDomains	[SearchDomain]	yes	`Short-Term`	Search domains within the organization. See SearchDomain.
stats	OrganizationStats	yes	`Short-Term`	Statistics of the organization. See OrganizationStats.
trialStartedAt	long		`Short-Term`	Date organization's trial started.

User related queries and mutations.

GraphQL API

GraphQL Queries

GraphQL Mutations

GraphQL Datatypes