Skip to content

Installation Tokens

The Installation Tokens service collection provides operations for managing installation tokens and auditing token activity. Create, read, update, and delete installation tokens, manage customer token settings, and query audit events.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.



OperationDescription
audit-events-query
audit_events_query
Search for audit events by providing an FQL filter and paging details.
audit-events-read
audit_events_read
Gets the details of one or more audit events by id.
customer-settings-read
customer_settings_read
Check current installation token settings.
customer-settings-update
customer_settings_update
Update installation token settings.
tokens-create
tokens_create
Creates a token.
tokens-delete
tokens_delete
Deletes a token immediately.
tokens-query
tokens_query
Search for tokens by providing an FQL filter and paging details.
tokens-read
tokens_read
Gets the details of one or more tokens by id.
tokens-update
tokens_update
Updates one or more tokens.

Search for audit events by providing an FQL filter and paging details.

Method GET
Route /installation-tokens/queries/audit-events/v1
Scope Installation Tokens: READ
PEP 8 audit_events_query
offset query · integer
The offset to start retrieving records from.
limit query · integer
The maximum records to return. [1-1000]. Defaults to 50.
sort query · string
The property to sort by. (Ex: timestamp.desc)
filter query · string
FQL Syntax formatted string used to limit the results.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.audit_events_query(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
"string"
]


Gets the details of one or more audit events by id.

Method GET
Route /installation-tokens/entities/audit-events/v1
Scope Installation Tokens: READ
PEP 8 audit_events_read
ids query · string or list of strings
IDs of audit events to retrieve details for
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.audit_events_read(ids=id_list)
print(response)
[
{
"action": "string",
"actor": "string",
"description": "string",
"id": "string",
"timestamp": "string",
"token_id": "string"
}
]


Check current installation token settings.

Method GET
Route /installation-tokens/entities/customer-settings/v1
Scope Installation Tokens: READ
PEP 8 customer_settings_read
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.customer_settings_read()
print(response)
[
{
"max_active_tokens": 0,
"tokens_required": false
}
]


Update installation token settings.

Method PATCH
Route /installation-tokens/entities/customer-settings/v1
Scope Installation Tokens Settings: WRITE
PEP 8 customer_settings_update
body body · dictionary
Full body payload as JSON formatted dictionary.
max_active_tokens body · integer
Set to a positive interger value to set limit of active tokens a customer may have at a time.
tokens_required body · boolean
Set to true to enable installation tokens for the customer.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.customer_settings_update(max_active_tokens=integer,
tokens_required=boolean)
print(response)
[
{
"max_active_tokens": 0,
"tokens_required": false
}
]


Creates a token.

Method POST
Route /installation-tokens/entities/tokens/v1
Scope Installation Tokens: WRITE
PEP 8 tokens_create
body body · dictionary
Full body payload as JSON formatted dictionary.
expires_timestamp body · string
The token’s expiration time (RFC-3339). Null, if the token never expires.
label body · string
The token label.
type body · string
The token type.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.tokens_create(expires_timestamp="string",
label="string",
type="string")
print(response)
[
{
"created_timestamp": "string",
"expires_timestamp": "string",
"id": "string",
"label": "string",
"last_used_timestamp": "string",
"revoked_timestamp": "string",
"status": "string",
"type": "string",
"value": "string"
}
]


Deletes a token immediately.

Method DELETE
Route /installation-tokens/entities/tokens/v1
Scope Installation Tokens: WRITE
PEP 8 tokens_delete
ids query · string or list of strings
The token ids to delete.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.tokens_delete(ids=id_list)
print(response)
{
"errors": [
{
"code": 0,
"id": "string",
"message": "string"
}
],
"meta": {
"pagination": {
"limit": 0,
"offset": 0,
"total": 0
},
"powered_by": "string",
"query_time": 0.0,
"trace_id": "string",
"writes": {
"resources_affected": 0
}
}
}


Search for tokens by providing an FQL filter and paging details.

Method GET
Route /installation-tokens/queries/tokens/v1
Scope Installation Tokens: READ
PEP 8 tokens_query
offset query · integer
The offset to start retrieving records from.
limit query · integer
The maximum records to return. [1-1000]. Defaults to 50.
sort query · string
The property to sort by. (Ex: created_timestamp.desc)
filter query · string
FQL Syntax formatted string used to limit the results.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.tokens_query(filter="string",
limit=integer,
offset=integer,
sort="string")
print(response)
[
"string"
]


Gets the details of one or more tokens by id.

Method GET
Route /installation-tokens/entities/tokens/v1
Scope Installation Tokens: READ
PEP 8 tokens_read
ids query · string or list of strings
IDs of tokens to retrieve details for
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.tokens_read(ids=id_list)
print(response)
[
{
"created_timestamp": "string",
"expires_timestamp": "string",
"id": "string",
"label": "string",
"last_used_timestamp": "string",
"revoked_timestamp": "string",
"status": "string",
"type": "string",
"value": "string"
}
]


Updates one or more tokens.

Method PATCH
Route /installation-tokens/entities/tokens/v1
Scope Installation Tokens: WRITE
PEP 8 tokens_update
body body · dictionary
Full body payload as JSON formatted dictionary.
expires_timestamp body · string
The token’s expiration time (RFC-3339). Null, if the token never expires.
label body · string
The token label.
revoked body · boolean
Set to true to revoke the token, false to un-revoked it.
ids query · string or list of strings
The token ids to update.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
from falconpy import InstallationTokens
falcon = InstallationTokens(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.tokens_update(expires_timestamp="string",
ids=id_list,
label="string",
revoked=boolean)
print(response)
[
{
"created_timestamp": "string",
"expires_timestamp": "string",
"id": "string",
"label": "string",
"last_used_timestamp": "string",
"revoked_timestamp": "string",
"status": "string",
"type": "string",
"value": "string"
}
]