User Management

The User Management service collection provides operations for managing users, roles, and permissions within your CrowdStrike Falcon environment. Create and delete user accounts, assign and revoke roles, and query user grants across direct and Flight Control (MSSP) contexts. Retrieve available role definitions and aggregate user data for auditing and compliance.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Table of Contents

Operation	Description
aggregateUsersV1 aggregate_users	Get user aggregates as specified via json in request body.
GetRoles get_roles	Get info about a role.
combinedUserRolesV1 get_user_grants_v1	Get user grant(s). This operation lists both direct as well as flight control grants between a User and a Customer. deprecated
CombinedUserRolesV2 get_user_grants	Get user grant(s). This operation lists both direct as well as flight control grants between a User and a Customer.
entitiesRolesV1 get_roles_mssp_v1	Get info about a role, supports Flight Control. deprecated
entitiesRolesGETV2 get_roles_mssp	Get info about a role.
userActionV1 user_action	Apply actions to one or more users.
userRolesActionV1 user_roles_action	Grant or Revoke one or more role(s) to a user against a CID.
GrantUserRoleIds grant_user_role_ids	Assign one or more roles to a user.
RevokeUserRoleIds revoke_user_role_ids	Revoke one or more roles from a user
GetAvailableRoleIds get_available_role_ids	Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to GetRoles.
queriesRolesV1 query_roles	Show role IDs for all roles available in your customer account. Supports Flight Control.
queryUserV1 query_users	List user IDs for all users in your customer account.
GetUserRoleIds get_user_role_ids	Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to GetRoles.
RetrieveUser retrieve_user	Get info about a user.
retrieveUsersGETV1 retrieve_users	Get info about users including their name, UID and CID by providing user UUIDs.
CreateUser create_user	Create a new user. After creating a user, assign one or more roles with GrantUserRoleIds.
createUserV1 create_user_mssp	Create a new user. After creating a user, assign one or more roles with userRolesActionV1. Supports Flight Control.
DeleteUser delete_user	Delete a user permanently.
deleteUserV1 delete_user_mssp	Delete a user permanently. Supports Flight Control.
UpdateUser update_user	Modify an existing user’s first or last name
updateUserV1 update_user_mssp	Modify an existing user’s first or last name. Supports Flight Control.
RetrieveEmailsByCID retrieve_emails_by_cid	List the usernames (usually an email address) for all users in your customer account
RetrieveUserUUIDsByCID retrieve_user_uuids_by_cid	List user IDs for all users in your customer account. For more information on each user, provide the user ID to RetrieveUser.
RetrieveUserUUID retrieve_user_uuid	Get a user’s ID by providing a username (usually an email address)

---

aggregateUsersV1

Get user aggregates as specified via json in request body.

POST /user-management/aggregates/users/v1

Consumes · Produces application/json

PEP 8 aggregate_users

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format
date_ranges	body	list of dictionaries	Applies to date_range aggregations. Example: [   {     “from”: “2016-05-28T09:00:31Z”,     “to”: “2016-05-30T09:00:31Z”   },   {     “from”: “2016-06-01T09:00:31Z”,     “to”: “2016-06-10T09:00:31Z”   } ]
exclude	body	string	Elements to exclude.
extended_bounds	body	dictionary	Extended aggregate boundaries. Contains max and min values as strings. Example:   {     “max”: “string”,     “min”: “string”   }
field	body	string	The field on which to compute the aggregation.
filter	body	string	FQL syntax formatted string to use to filter the results.
from	body	integer	Starting position.
include	body	string	Elements to include.
interval	body	string	Time interval for date histogram aggregations. Valid values include: year month week day hour minute
max_doc_count	body	integer	Only return buckets if values are less than or equal to the value here.
min_doc_count	body	integer	Only return buckets if values are greater than or equal to the value here.
missing	body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name	body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q	body	string	Full text search across all metadata fields.
ranges	body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if max_severity is used, ranges might look like: [   {     “From”: 0,     “To”: 70   },   {     “From”: 70,     “To”: 100   } ]
size	body	integer	The max number of term buckets to be returned.
sub_aggregates	body	list of dictionaries	A nested aggregation, such as: [   {     “name”: “max_first_behavior”,     “type”: “max”,     “field”: “first_behavior”   } ] There is a maximum of 3 nested aggregations per request.
sort	body	string	FQL syntax string to sort bucket results. _count - sort by document count _term - sort by the string value alphabetically Supports asc and desc using | format. Example: _count|desc
time_zone	body	string	Time zone for bucket results.
type	body	string	Type of aggregation. Valid values include: date_histogram - Aggregates counts on a specified time interval. Requires use of “interval” field. date_range - Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. terms - Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names. range - Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity. cardinality - Returns the count of distinct values in a specified field. max - Returns the maximum value of a specified field. min - Returns the minimum value of a specified field. avg - Returns the average value of the specified field. sum - Returns the total sum of all values for the specified field. percentiles - Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.aggregate_users(date_ranges="string",
                                  exclude="string",
                                  extended_bounds={},
                                  field="string",
                                  filter="string",
                                  from=integer,
                                  include="string",
                                  interval="string",
                                  max_doc_count=integer,
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=[{"key": "value"}],
                                  size=integer,
                                  sort="string",
                                  sub_aggregates=["string"],
                                  time_zone="string",
                                  type="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.aggregateUsersV1(date_ranges="string",
                                   exclude="string",
                                   extended_bounds={},
                                   field="string",
                                   filter="string",
                                   from=integer,
                                   include="string",
                                   interval="string",
                                   max_doc_count=integer,
                                   min_doc_count=integer,
                                   missing="string",
                                   name="string",
                                   q="string",
                                   ranges=[{"key": "value"}],
                                   size=integer,
                                   sort="string",
                                   sub_aggregates=["string"],
                                   time_zone="string",
                                   type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.command("aggregateUsersV1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  type := "string"

  response, err := client.UserManagement.AggregateUsersV1(
    &user_management.AggregateUsersV1Params{
      Body: []*models.MsaAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{
              {
              From: &from,
              To: &to,
              },
            },
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{
              {
              From: &From,
              To: &To,
              },
            },
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{
              {
              DateRanges: []interface{}{},
              Exclude: &exclude,
              ExtendedBounds: &struct{}{},
              Field: &field,
              Filter: &filter,
              FiltersSpec: &struct{}{},
              From: &from,
              Include: &include,
              Interval: &interval,
              MaxDocCount: &max_doc_count,
              MinDocCount: &min_doc_count,
              Missing: &missing,
              Name: &name,
              Percents: []interface{}{},
              Q: &q,
              Ranges: []interface{}{},
              Size: &size,
              Sort: &sort,
              SubAggregates: []interface{}{},
              TimeZone: &time_zone,
              Type: &type,
              },
            },
            TimeZone: &time_zone,
            Type: &type,
            },
          },
          TimeZone: &time_zone,
          Type: &type,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.aggregateUsersV1(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        From: integer,
        To: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            From: integer,
            To: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            extendedBounds: {},
            field: "string",
            filter: "string",
            filtersSpec: {},
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}]  // body
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::aggregate_users_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![MsaAggregateQueryRequest {
            date_ranges: vec![DateRangeSpec {
                from: Some("string".to_string()),
                to: Some("string".to_string()),
                ..Default::default()
            }],
            exclude: Some("string".to_string()),
            field: Some("string".to_string()),
            filter: Some("string".to_string()),
            filters_spec: Default::default(),
            from: Some(integer),
            include: Some("string".to_string()),
            interval: Some("string".to_string()),
            missing: Some("string".to_string()),
            name: Some("string".to_string()),
            percents: vec![],
            q: Some("string".to_string()),
            ranges: vec![RangeSpec {
                from: Some(integer),
                to: Some(integer),
                ..Default::default()
            }],
            size: Some(integer),
            sort: Some("string".to_string()),
            sub_aggregates: vec![AggregateQueryRequest {
                date_ranges: vec![DateRangeSpec {
                    from: Some("string".to_string()),
                    to: Some("string".to_string()),
                    ..Default::default()
                }],
                exclude: Some("string".to_string()),
                field: Some("string".to_string()),
                filter: Some("string".to_string()),
                filters_spec: Default::default(),
                from: Some(integer),
                include: Some("string".to_string()),
                interval: Some("string".to_string()),
                missing: Some("string".to_string()),
                name: Some("string".to_string()),
                percents: vec![],
                q: Some("string".to_string()),
                ranges: vec![RangeSpec {
                    from: Some(integer),
                    to: Some(integer),
                    ..Default::default()
                }],
                size: Some(integer),
                sort: Some("string".to_string()),
                sub_aggregates: vec![AggregateQueryRequest {
                    date_ranges: vec![],
                    exclude: Some("string".to_string()),
                    field: Some("string".to_string()),
                    filter: Some("string".to_string()),
                    filters_spec: Default::default(),
                    from: Some(integer),
                    include: Some("string".to_string()),
                    interval: Some("string".to_string()),
                    missing: Some("string".to_string()),
                    name: Some("string".to_string()),
                    percents: vec![],
                    q: Some("string".to_string()),
                    ranges: vec![],
                    size: Some(integer),
                    sort: Some("string".to_string()),
                    sub_aggregates: vec![],
                    time_zone: Some("string".to_string()),
                    type: Some("string".to_string()),
                    ..Default::default()
                }],
                time_zone: Some("string".to_string()),
                type: Some("string".to_string()),
                ..Default::default()
            }],
            time_zone: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }];

    let response = aggregate_users_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = [Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)]

response = api.aggregate_users_v1(body)

puts response

---

GetRoles

Get info about a role

GET /user-roles/entities/user-roles/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_roles

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID of a role. Find a role ID from GetAvailableRoleIds or GetUserRoleIds.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_roles(ids=id_list)
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetRoles(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetRoles",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.GetRoles(
    &user_management.GetRolesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.getRoles(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::get_roles;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_roles(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.get_roles(['ID1', 'ID2', 'ID3'])

puts response

---

combinedUserRolesV1

Get User Grant(s). This operation lists both direct as well as flight control grants between a User and a Customer.

deprecated This operation has been superseded by the CombinedUserRolesV2 operation and is now deprecated. Developers should move code over to this new operation as soon as time permits.

GET /user-management/combined/user-roles/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_user_grants_v1

Parameters

Name	Type	Data type	Description
cid	query	string	Customer ID to get grants for. An empty CID value returns Role IDs for the user against the current CID in view.
direct_only	query	boolean	Specifies if to request direct only role grants or all role grants between user and CID (specified using cid keyword).
filter	query	string	The filter expression that should be used to limit the results. FQL syntax. Available values: expires_at, role_id, role_name
limit	query	integer	The maximum number of records to return. Default: 100 Maximum: 500
offset	query	integer	The integer offset to start retrieving records from. Default: 0
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The property to sort by. FQL syntax. Available sort values: cid, expires_at, role_name, type, user_uuid
user_uuid	query	string	User UUID to retrieve available roles for. Must be provides as a keyword, argument or part of the parameters payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_user_grants_v1(user_uuid="string",
                                     cid="string",
                                     direct_only=boolean,
                                     filter="string",
                                     offset=integer,
                                     limit=integer,
                                     sort="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.combinedUserRolesV1(user_uuid="string",
                                      cid="string",
                                      direct_only=boolean,
                                      filter="string",
                                      offset=integer,
                                      limit=integer,
                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("combinedUserRolesV1",
                          user_uuid="string",
                          cid="string",
                          direct_only=boolean,
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  directOnly := boolean
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.UserManagement.CombinedUserRolesV1(
    &user_management.CombinedUserRolesV1Params{
      UserUUID: "string",
      Cid: &cid,
      DirectOnly: &directOnly,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.combinedUserRolesV1(
  "string",  // userUuid
  "string",  // cid
  boolean,  // directOnly
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::combined_user_roles_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_user_roles_v1(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        Some("string"),  // cid
        Some(boolean),  // direct_only
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.combined_user_roles_v1('string')

puts response

---

CombinedUserRolesV2

Get User Grant(s). This endpoint lists both direct as well as flight control grants between a User and a Customer.

GET /user-management/combined/user-roles/v2

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_user_grants

Parameters

Name	Type	Data type	Description
cid	query	string	Customer ID to get grants for. An empty CID value returns Role IDs for the user against the current CID in view.
direct_only	query	boolean	Specifies if to request direct only role grants or all role grants between user and CID (specified using cid keyword).
filter	query	string	The filter expression that should be used to limit the results. FQL syntax. Available values: expires_at, role_id, role_name
limit	query	integer	The maximum number of records to return. Default: 100 Maximum: 500
offset	query	integer	The integer offset to start retrieving records from. Default: 0
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The property to sort by. FQL syntax. Available sort values: cid, expires_at, role_name, type, user_uuid
user_uuid	query	string	User UUID to retrieve available roles for. Must be provides as a keyword, argument or part of the parameters payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_user_grants(user_uuid="string",
                                  cid="string",
                                  direct_only=boolean,
                                  filter="string",
                                  offset=integer,
                                  limit=integer,
                                  sort="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CombinedUserRolesV2(user_uuid="string",
                                      cid="string",
                                      direct_only=boolean,
                                      filter="string",
                                      offset=integer,
                                      limit=integer,
                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedUserRolesV2",
                          user_uuid="string",
                          cid="string",
                          direct_only=boolean,
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconRole -UserId "string" `
  -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  directOnly := boolean
  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.UserManagement.CombinedUserRolesV2(
    &user_management.CombinedUserRolesV2Params{
      UserUUID: "string",
      Cid: &cid,
      DirectOnly: &directOnly,
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.combinedUserRolesV2(
  "string",  // userUuid
  "string",  // cid
  boolean,  // directOnly
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::combined_user_roles_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_user_roles_v2(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        Some("string"),  // cid
        Some(boolean),  // direct_only
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.combined_user_roles_v2('string')

puts response

---

queriesRolesV1

Show role IDs for all roles available in your customer account. Supports Flight Control.

GET /user-management/queries/roles/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 query_roles

Parameters

Name	Type	Data type	Description
action	query	string	Actionable purpose of the query. Default value: grant
cid	query	string	Customer ID to get available role IDs for. An empty CID value returns Role IDs for the current CID in view.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
user_uuid	query	string	User UUID to retrieve available roles for. An empty user_uuid will return all role IDs available for the customer.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_roles(cid="string", user_uuid="string", action="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queriesRolesV1(cid="string",
                                 user_uuid="string",
                                 action="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queriesRolesV1",
                          cid="string",
                          user_uuid="string",
                          action="string")
print(response)

PowerShell

Get-FalconRole

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  userUUID := "string"
  action := "string"

  response, err := client.UserManagement.QueriesRolesV1(
    &user_management.QueriesRolesV1Params{
      Cid: &cid,
      UserUUID: &userUUID,
      Action: &action,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.queriesRolesV1(
  "string",  // cid
  "string",  // userUuid
  "string"  // action
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::queries_roles_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = queries_roles_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // cid
        Some("string"),  // user_uuid
        Some("string"),  // action
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.queries_roles_v1(cid: 'string',
                                user_uuid: 'string',
                                action: 'string')

puts response

---

queryUserV1

List user IDs for all users in your customer account.

GET /user-management/queries/users/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 query_users

Parameters

Name	Type	Data type	Description
filter	query	string	The filter expression that should be used to limit the results. FQL syntax. Available values: assigned_cids, cid, direct_assigned_cids, factors, first_name, has_temporary_roles, last_name, name, status, temporarily_assigned_cids, uid, uuid.
limit	query	integer	The maximum number of records to return. Default: 100 Maximum: 500
offset	query	integer	The integer offset to start retrieving records from. Default: 0
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The property to sort by. FQL syntax. Available sort values: cid_name, created_at, first_name, has_temporary_roles, last_login_at, last_name, name, status, temporarily_assigned_cids, uid.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.query_users(filter="string",
                              offset=integer,
                              limit=integer,
                              sort="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queryUserV1(filter="string",
                              offset=integer,
                              limit=integer,
                              sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("queryUserV1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

PowerShell

Get-FalconUser -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.UserManagement.QueryUserV1(
    &user_management.QueryUserV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.queryUserV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::query_user_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_user_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.query_user_v1(filter: 'string',
                             offset: integer,
                             limit: integer,
                             sort: 'string')

puts response

---

entitiesRolesV1

DEPRECATED : Please use entitiesRolesGETV2. Get information about a role, supports Flight Control.

deprecated

GET /user-management/entities/roles/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_roles_mssp_v1

Parameters

Name	Type	Data type	Description
cid	query	string	Customer ID to get available roles for. Providing no value for cid returns results for the current CID in view.
ids	query	string or list of strings	List of role IDs to retrieve. Comma-delimited strings accepted. Must be provided as a keyword, argument or part of the parameters payload. Find a role ID from GetAvailableRoleIds or GetUserRoleIds.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_roles_mssp_v1(cid="string", ids=id_list)
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entitiesRolesV1(cid="string", ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entitiesRolesV1",
                          cid="string",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"

  response, err := client.UserManagement.EntitiesRolesV1(
    &user_management.EntitiesRolesV1Params{
      Cid: &cid,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.entitiesRolesV1(
  ["ID1", "ID2", "ID3"],  // ids
  "string"  // cid
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::entities_roles_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_roles_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some("string"),  // cid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.entities_roles_v1(['ID1', 'ID2', 'ID3'])

puts response

---

entitiesRolesGETV2

Get info about a role.

POST /user-management/entities/roles/GET/v2

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_roles_mssp

Parameters

Name	Type	Data type	Description
cid	query	string	Customer ID to get available roles for. Providing no value for cid returns results for the current CID in view.
ids	body	string or list of strings	Role IDs to retrieve. Maximum of 5000 Role IDs can be specified per request.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_roles_mssp(ids=["string"], cid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.entitiesRolesGETV2(ids=["string"], cid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": ["string"]
}

response = falcon.command("entitiesRolesGETV2",
                          cid="string",
                          body=body_payload)
print(response)

PowerShell

Get-FalconRole -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"

  response, err := client.UserManagement.EntitiesRolesGETV2(
    &user_management.EntitiesRolesGETV2Params{
      Body: &models.MsaspecIdsRequest{
        Ids: []string{"string"},
      },
      Cid: &cid,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.entitiesRolesGETV2(
  {  // body
      ids: []
  },
  "string"  // cid
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::entities_roles_getv2;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaspecIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaspecIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = entities_roles_getv2(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // cid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::MsaspecIdsRequest.new(
  ids: []
)

response = api.entities_roles_getv2(body)

puts response

---

userActionV1

Apply actions to one or more users.

POST /user-management/entities/user-actions/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 user_action

Parameters

Name	Type	Data type	Description
action_name	body	string	Action to perform. Allowed values: reset_2fa, reset_password. Must be provided as a keyword or as part of the body payload.
action_value	body	string	Value to provide for action.
body	body	dictionary	Full body payload in JSON format, not required when using other keywords.
ids	body	string or list of strings	User IDs to apply actions to. Supports comma-delimited strings. Must be provided as a keyword or as part of the body payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

action = {
    "action_name": "string",
    "action_value": "string"
}

response = falcon.user_action(action=action, ids=["string"])
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

action = {
    "action_name": "string",
    "action_value": "string"
}

response = falcon.userActionV1(action=action, ids=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "action": {
        "action_name": "string",
        "action_value": "string"
    },
    "ids": ["string"]
}

response = falcon.command("userActionV1", body=body_payload)
print(response)

PowerShell

Invoke-FalconUserAction -Name "string" -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.UserActionV1(
    &user_management.UserActionV1Params{
      Body: &models.DomainUserActionRequest{
        Action: &struct{}{},
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.userActionV1(
  {
    action: {
      actionName: "string",
      actionValue: "string"
    },
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::user_action_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUserActionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUserActionRequest {
        action: Default::default(),
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = user_action_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::DomainUserActionRequest.new(
  action: {
    action_name: 'string',
    action_value: 'string'
  },
  ids: []
)

response = api.user_action_v1(body)

puts response

---

userRolesActionV1

Grant or Revoke one or more role(s) to a user against a CID.

POST /user-management/entities/user-role-actions/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 user_roles_action

Parameters

Name	Type	Data type	Description
action	body	string	Action to perform. Allowed values: grant, revoke. Must be provided as a keyword or as part of the body payload.
body	body	dictionary	Full body payload in JSON format, not required when using other keywords.
cid	body	string	Customer ID of the tenant to take action within. Must be provided as a keyword or as part of the body payload.
role_ids	body	string or list of strings	Role IDs you want to adjust within the user id. Must be provided as a keyword or as part of the body payload.
uuid	body	string	User ID to grant roles access to. Must be provided as a keyword or as part of the body payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.user_roles_action(action="string",
                                    cid="string",
                                    expires_at="string",
                                    role_ids=["string"],
                                    uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.userRolesActionV1(action="string",
                                    cid="string",
                                    expires_at="string",
                                    role_ids=["string"],
                                    uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "action": "string",
    "cid": "string",
    "expires_at": "string",
    "role_ids": ["string"],
    "uuid": "string"
}

response = falcon.command("userRolesActionV1", body=body_payload)
print(response)

PowerShell

Remove-FalconRole -UserId "string" `
  -Cid "string" `
  -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  action := "string"
  cid := "string"
  expires_at := "string"
  uuid := "string"

  response, err := client.UserManagement.UserRolesActionV1(
    &user_management.UserRolesActionV1Params{
      Body: &models.FlightcontrolapiGrantInput{
        Action: &action,
        CID: &cid,
        ExpiresAt: &expires_at,
        RoleIds: []string{"string"},
        Uuid: &uuid,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.userRolesActionV1(
  {
    action: "string",
    cid: "string",
    expiresAt: "string",
    roleIds: [],
    uuid: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::user_roles_action_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::FlightcontrolapiGrantInput;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = FlightcontrolapiGrantInput {
        ..Default::default()
    };

    let response = user_roles_action_v1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::FlightcontrolapiGrantInput.new(
  action: 'string',
  cid: 'string',
  expires_at: 'string',
  role_ids: [],
  uuid: 'string'
)

response = api.user_roles_action_v1(body)

puts response

---

GrantUserRoleIds

Assign one or more roles to a user

POST /user-roles/entities/user-roles/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 grant_user_role_ids

Parameters

Name	Type	Data type	Description
body	body	string	Role ID(s) of the role you want to assign.
parameters	query	dictionary	Full query string parameters payload in JSON format.
role_ids	body	string or list of strings	Role ID(s) of the role you want to assign. Can also use the keyword roleIds.
user_uuid	query	string	ID of a user. Find a user’s ID using RetrieveUserUUID.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.grant_user_role_ids(role_ids=["string"], user_uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GrantUserRoleIds(role_ids=["string"], user_uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "role_ids": ["string"]
}

response = falcon.command("GrantUserRoleIds",
                          user_uuid="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.GrantUserRoleIds(
    &user_management.GrantUserRoleIdsParams{
      Body: &models.DomainRoleIDs{
        Roleids: []string{"string"},
      },
      UserUUID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.grantUserRoleIds(
  "string",  // userUuid
  {  // body
      roleIds: []
  }
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::grant_user_role_ids;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainRoleIds;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainRoleIds {
        role_ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = grant_user_role_ids(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::DomainRoleIDs.new(
  roleIds: []
)

response = api.grant_user_role_ids(body, 'string')

puts response

---

RevokeUserRoleIds

Revoke one or more roles from a user

DELETE /user-roles/entities/user-roles/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 revoke_user_role_ids

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	One or more role IDs to revoke. Find a role’s ID using GetAvailableRoleIds.
parameters	query	dictionary	Full query string parameters payload in JSON format.
user_uuid	query	string	ID of a user. Find a user’s ID using RetrieveUserUUID.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.revoke_user_role_ids(user_uuid="string", ids=id_list)
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RevokeUserRoleIds(user_uuid="string", ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RevokeUserRoleIds",
                          user_uuid="string",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.RevokeUserRoleIds(
    &user_management.RevokeUserRoleIdsParams{
      UserUUID: "string",
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.revokeUserRoleIds(
  "string",  // userUuid
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::revoke_user_role_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = revoke_user_role_ids(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.revoke_user_role_ids('string', ['ID1', 'ID2', 'ID3'])

puts response

---

GetAvailableRoleIds

Show role IDs for all roles available in your customer account. For more information on each role, provide the role ID to GetRoles.

GET /user-roles/queries/user-role-ids-by-cid/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_available_role_ids

No keywords or arguments accepted.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_available_role_ids()
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetAvailableRoleIds()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAvailableRoleIds")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.GetAvailableRoleIds(
    &user_management.GetAvailableRoleIdsParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.getAvailableRoleIds();

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::get_available_role_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_available_role_ids(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.get_available_role_ids

puts response

---

GetUserRoleIds

Show role IDs of roles assigned to a user. For more information on each role, provide the role ID to GetRoles.

GET /user-roles/queries/user-role-ids-by-user-uuid/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 get_user_role_ids

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
user_uuid	query	string	ID of a user. Find a user’s ID using RetrieveUserUUID.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.get_user_role_ids(user_uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.GetUserRoleIds(user_uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetUserRoleIds",
                          user_uuid="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.GetUserRoleIds(
    &user_management.GetUserRoleIdsParams{
      UserUUID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.getUserRoleIds("string");  // userUuid

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::get_user_role_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_user_role_ids(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.get_user_role_ids('string')

puts response

---

RetrieveUser

Get info about a user

GET /users/entities/users/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 retrieve_user

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ID of a user. Find a user’s ID using RetrieveUserUUID.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.retrieve_user(ids=id_list)
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RetrieveUser(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RetrieveUser",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.RetrieveUser(
    &user_management.RetrieveUserParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.retrieveUser(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::retrieve_user;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = retrieve_user(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.retrieve_user(['ID1', 'ID2', 'ID3'])

puts response

---

retrieveUsersGETV1

Get info about users including their name, UID and CID by providing user UUIDs.

POST /user-management/entities/users/GET/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 retrieve_users

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	List of user IDs to retrieve. Find a user’s ID using RetrieveUserUUID. Must be provided as an argument, keyword, or part of the body payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.retrieve_users(ids=["string"])
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.retrieveUsersGETV1(ids=["string"])
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": ["string"]
}

response = falcon.command("retrieveUsersGETV1", body=body_payload)
print(response)

PowerShell

Get-FalconUser -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.RetrieveUsersGETV1(
    &user_management.RetrieveUsersGETV1Params{
      Body: &models.MsaspecIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.retrieveUsersGETV1(
  {
    ids: []
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::retrieve_users_getv1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaspecIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaspecIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = retrieve_users_getv1(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::MsaspecIdsRequest.new(
  ids: []
)

response = api.retrieve_users_getv1(body)

puts response

---

CreateUser

Create a new user. After creating a user, assign one or more roles with GrantUserRoleIds.

POST /users/entities/users/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 create_user

Parameters

Name	Type	Data type	Description
body	body	string	Attributes for this user. uid (required) is the user’s email address, which is their username in Falcon. Optional attributes: firstName, lastName, password. As a best practice, we recommend omitting password. If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password. The user should use the activation email to set their own password.
first_name	body	string	First name of the user. (Can also use the keyword firstName.)
last_name	body	string	Last name of the user. (Can also use the keyword lastName.)
password	body	string	Assigned password. String. As a best practice, we recommend ommitting password. If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password. The user should use the activation email to set their own password.
uid	body	string	The user’s email address, which will be the assigned username.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.create_user(first_name="string",
                              last_name="string",
                              password="string",
                              uid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CreateUser(first_name="string",
                             last_name="string",
                             password="string",
                             uid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "first_name": "string",
    "last_name": "string",
    "password": "string",
    "uid": "string"
}

response = falcon.command("CreateUser", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  firstName := "string"
  lastName := "string"
  password := "string"
  uid := "string"

  response, err := client.UserManagement.CreateUser(
    &user_management.CreateUserParams{
      Body: &models.DomainUserCreateRequest{
        Firstname: &firstName,
        Lastname: &lastName,
        Password: &password,
        Uid: &uid,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.createUser(
  {
    firstName: "string",
    lastName: "string",
    password: "string",
    uid: "string"
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::create_user;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUserCreateRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUserCreateRequest {
        ..Default::default()
    };

    let response = create_user(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = {
  firstName: 'string',
  lastName: 'string',
  password: 'string',
  uid: 'string'
}

response = api.create_user(body)

puts response

---

createUserV1

Create a new user. Supports Flight Control. After creating a user, assign one or more roles with userRolesActionV1.

POST /user-management/entities/users/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 create_user_mssp

Parameters

Name	Type	Data type	Description
body	body	string	Attributes for this user. uid (required) is the user’s email address, which is their username in Falcon. Optional attributes: first_name, last_name, password. As a best practice, we recommend omitting password. If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password. The user should use the activation email to set their own password.
first_name	body	string	First name of the user. (Can also use the keyword firstName.)
last_name	body	string	Last name of the user. (Can also use the keyword lastName.)
password	body	string	Assigned password. String. As a best practice, we recommend ommitting password. If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password. The user should use the activation email to set their own password.
uid	body	string	The user’s email address, which will be the assigned username. Must be provided as a keyword or as part of the body payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.create_user_mssp(cid="string",
                                   first_name="string",
                                   last_name="string",
                                   password="string",
                                   uid="string",
                                   validate_only=boolean)
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.createUserV1(cid="string",
                               first_name="string",
                               last_name="string",
                               password="string",
                               uid="string",
                               validate_only=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "cid": "string",
    "first_name": "string",
    "last_name": "string",
    "password": "string",
    "uid": "string"
}

response = falcon.command("createUserV1",
                          validate_only=boolean,
                          body=body_payload)
print(response)

PowerShell

New-FalconUser -Username "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  cid := "string"
  first_name := "string"
  last_name := "string"
  password := "string"
  uid := "string"
  validateOnly := boolean

  response, err := client.UserManagement.CreateUserV1(
    &user_management.CreateUserV1Params{
      Body: &models.DomainCreateUserRequest{
        CID: &cid,
        FirstName: &first_name,
        LastName: &last_name,
        Password: &password,
        Uid: &uid,
      },
      ValidateOnly: &validateOnly,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.createUserV1(
  {  // body
      cid: "string",
      firstName: "string",
      lastName: "string",
      password: "string",
      uid: "string"
  },
  boolean  // validateOnly
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::create_user_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCreateUserRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCreateUserRequest {
        ..Default::default()
    };

    let response = create_user_v1(
        &falcon.cfg,  // configuration
        body,  // body
        Some(boolean),  // validate_only
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = {
  cid: 'string',
  first_name: 'string',
  last_name: 'string',
  password: 'string',
  uid: 'string'
}

response = api.create_user_v1(body)

puts response

---

DeleteUser

Delete a user permanently

DELETE /users/entities/users/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 delete_user

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
user_uuid	query	string	ID of a user. Find a user’s ID using RetrieveUserUUID.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.delete_user(user_uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.DeleteUser(user_uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeleteUser",
                          user_uuid="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.DeleteUser(
    &user_management.DeleteUserParams{
      UserUUID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.deleteUser("string");  // userUuid

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::delete_user;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_user(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.delete_user('string')

puts response

---

deleteUserV1

Delete a user permanently. Supports Flight Control.

DELETE /user-management/entities/users/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 delete_user_mssp

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format, not required if user_uuid keyword is provided.
user_uuid	query	string	User ID of a user to delete. Find a user’s ID using RetrieveUserUUID.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.delete_user_mssp(user_uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.deleteUserV1(user_uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("deleteUserV1",
                          user_uuid="string")
print(response)

PowerShell

Remove-FalconUser -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.DeleteUserV1(
    &user_management.DeleteUserV1Params{
      UserUUID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.deleteUserV1("string");  // userUuid

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::delete_user_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_user_v1(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.delete_user_v1('string')

puts response

---

UpdateUser

Modify an existing user’s first or last name

PATCH /users/entities/users/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 update_user

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
first_name	body	string	First name of the user. (Can also use the keyword firstName.)
last_name	body	string	Last name of the user. (Can also use the keyword lastName.)
parameters	query	dictionary	Full query string parameters payload in JSON format.
user_uuid	query	string	The user ID to modify.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.update_user(first_name="string",
                              last_name="string",
                              user_uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.UpdateUser(first_name="string",
                             last_name="string",
                             user_uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "first_name": "string",
    "last_name": "string"
}

response = falcon.command("UpdateUser",
                          user_uuid="string",
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  firstName := "string"
  lastName := "string"

  response, err := client.UserManagement.UpdateUser(
    &user_management.UpdateUserParams{
      Body: &models.DomainUpdateUserFields{
        Firstname: &firstName,
        Lastname: &lastName,
      },
      UserUUID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.updateUser(
  "string",  // userUuid
  {  // body
      firstName: "string",
      lastName: "string"
  }
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::update_user;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUpdateUserFields;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUpdateUserFields {
        ..Default::default()
    };

    let response = update_user(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::DomainUpdateUserFields.new(
  firstName: 'string',
  lastName: 'string'
)

response = api.update_user(body, 'string')

puts response

---

updateUserV1

Modify an existing user’s first or last name. Supports Flight Control.

PATCH /user-management/entities/users/v1

Scope User Management: WRITE Consumes · Produces application/json

PEP 8 update_user_mssp

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
first_name	body	string	First name of the user. (Can also use the keyword firstName.)
last_name	body	string	Last name of the user. (Can also use the keyword lastName.)
parameters	query	dictionary	Full query string parameters payload in JSON format.
user_uuid	query	string	The user ID to modify. Must be provided as a keyword or as part of the parameters payload.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.update_user_mssp(first_name="string",
                                   last_name="string",
                                   user_uuid="string")
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.updateUserV1(first_name="string",
                               last_name="string",
                               user_uuid="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "first_name": "string",
    "last_name": "string"
}

response = falcon.command("updateUserV1",
                          user_uuid="string",
                          body=body_payload)
print(response)

PowerShell

Edit-FalconUser -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  first_name := "string"
  last_name := "string"

  response, err := client.UserManagement.UpdateUserV1(
    &user_management.UpdateUserV1Params{
      Body: &models.DomainUpdateUserRequest{
        FirstName: &first_name,
        LastName: &last_name,
      },
      UserUUID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.updateUserV1(
  "string",  // userUuid
  {  // body
      firstName: "string",
      lastName: "string"
  }
);

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::update_user_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainUpdateUserRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainUpdateUserRequest {
        ..Default::default()
    };

    let response = update_user_v1(
        &falcon.cfg,  // configuration
        "string",  // user_uuid
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

body = Falcon::DomainUpdateUserRequest.new(
  first_name: 'string',
  last_name: 'string'
)

response = api.update_user_v1(body, 'string')

puts response

---

RetrieveEmailsByCID

List the usernames (usually an email address) for all users in your customer account

GET /users/queries/emails-by-cid/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 retrieve_emails_by_cid

No keywords or arguments accepted.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.retrieve_emails_by_cid()
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.RetrieveEmailsByCID()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RetrieveEmailsByCID")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.RetrieveEmailsByCID(
    &user_management.RetrieveEmailsByCIDParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.retrieveEmailsByCID();

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::retrieve_emails_by_cid;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = retrieve_emails_by_cid(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.retrieve_emails_by_cid

puts response

---

RetrieveUserUUIDsByCID

List user IDs for all users in your customer account. For more information on each user, provide the user ID to RetrieveUser.

GET /users/queries/user-uuids-by-cid/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 retrieve_user_uuids_by_cid

No keywords or arguments accepted.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.retrieve_user_uuids_by_cid()
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.RetrieveUserUUIDsByCID()
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RetrieveUserUUIDsByCID")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.RetrieveUserUUIDsByCID(
    &user_management.RetrieveUserUUIDsByCIDParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.retrieveUserUUIDsByCID();

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::retrieve_user_uuids_by_cid;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = retrieve_user_uuids_by_cid(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.retrieve_user_uuids_by_cid

puts response

---

RetrieveUserUUID

Get a user’s ID by providing a username (usually an email address)

GET /users/queries/user-uuids-by-email/v1

Scope User Management: READ Consumes · Produces application/json

PEP 8 retrieve_user_uuid

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
uid	query	string or list of strings	List of User names to retrieve.

Code Examples

Python

PEP 8

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.retrieve_user_uuid(uid=id_list)
print(response)

Operation ID

from falconpy import UserManagement

falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RetrieveUserUUID(uid=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RetrieveUserUUID",
                          uid=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/user_management"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.UserManagement.RetrieveUserUUID(
    &user_management.RetrieveUserUUIDParams{
      UID: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.userManagement.retrieveUserUUID(["ID1", "ID2", "ID3"]);  // uid

console.log(response);

Rust

use rusty_falcon::apis::user_management_api::retrieve_user_uuid;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = retrieve_user_uuid(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // uid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UserManagement.new

response = api.retrieve_user_uuid(['ID1', 'ID2', 'ID3'])

puts response