Skip to content
CrowdStrike Developer Center

User Management

The User Management service collection provides operations for managing users, roles, and permissions within your CrowdStrike Falcon environment. Create and delete user accounts, assign and revoke roles, and query user grants across direct and Flight Control (MSSP) contexts. Retrieve available role definitions and aggregate user data for auditing and compliance.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
aggregateUsersV1
aggregate_users		Get host aggregates as specified via json in request body.
combinedUserRolesV1
get_user_grants_v1		Deprecated : Please use GET /user-management/combined/user-roles/v2.
deprecated
CombinedUserRolesV2
get_user_grants		Get User Grant(s).
CreateUser
create_user		Deprecated : Please use POST /user-management/entities/users/v1.
deprecated
createUserV1
create_user_mssp		Create a new user.
DeleteUser
delete_user		Deprecated : Please use DELETE /user-management/entities/users/v1.
deprecated
deleteUserV1
delete_user_mssp		Delete a user permanently.
entitiesRolesGETV2
get_roles_mssp		Get info about a role
entitiesRolesV1
get_roles_mssp_v1		Get info about a role
deprecated
GetAvailableRoleIds
get_available_role_ids		Deprecated : Please use GET /user-management/queries/roles/v1.
deprecated
GetRoles
get_roles		Deprecated : Please use GET /user-management/entities/roles/v1.
deprecated
GetUserRoleIds
get_user_role_ids		Deprecated : Please use GET /user-management/combined/user-roles/v1.
deprecated
GrantUserRoleIds
grant_user_role_ids		Deprecated : Please use POST /user-management/entities/user-role-actions/v1.
deprecated
queriesRolesV1
query_roles		Show role IDs for all roles available in your customer account.
queryUserV1
query_users		List user IDs for all users in your customer account.
RetrieveEmailsByCID
retrieve_emails_by_cid		Deprecated : Please use POST /user-management/entities/users/GET/v1.
deprecated
retrieveUser
retrieve_user		Deprecated : Please use POST /user-management/entities/users/GET/v1.
deprecated
RetrieveUser
retrieve_user		Deprecated : Please use retrieveUsersGETV1.
deprecated
retrieveUsersGETV1
retrieve_users		Get info about users including their name, UID and CID by providing user UUIDs
RetrieveUserUUID
retrieve_user_uuid		Deprecated : Please use GET /user-management/queries/users/v1.
deprecated
RetrieveUserUUIDsByCID
retrieve_user_uuids_by_cid		Deprecated : Please use GET /user-management/queries/users/v1.
deprecated
RevokeUserRoleIds
revoke_user_role_ids		Deprecated : Please use POST /user-management/entities/user-role-actions/v1.
deprecated
UpdateUser
update_user		Deprecated : Please use PATCH /user-management/entities/users/v1.
deprecated
updateUserV1
update_user_mssp		Modify an existing user’s first or last name.
userActionV1
user_action		Apply actions to one or more User.
userRolesActionV1
user_roles_action		Grant or Revoke one or more role(s) to a user against a CID.

aggregateUsersV1

Section titled “aggregateUsersV1”

Get host aggregates as specified via json in request body.

Method POST
Route /user-management/aggregates/users/v1
Scope User management: WRITE
PEP 8 aggregate_users

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.
exclude body · string
Fields to exclude.
extended_bounds body · object
Extended bounds.
field body · string
Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.
filter body · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
filters_spec body · object
from body · integer
include body · string
Fields to include.
interval body · string
Available values (6)
yearmonthweek
dayhourminute
max_doc_count body · integer
Maximum number of documents.
min_doc_count body · integer
Minimum number of documents.
missing body · string
name body · string
Scan name.
percents body · array
q body · string
FQL syntax.
ranges body · array
size body · integer
sort body · string
FQL syntax.
Available values (2)
_count
sort by document count
_term
sort by the string value alphabetically
sub_aggregates body · array
time_zone body · string
type body · string
Available values (10)
date_histogram
Aggregates counts on a specified time interval. Requires use of “interval” field.
date_range
Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.
terms
Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.
range
Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.
cardinality
Returns the count of distinct values in a specified field.
max
Returns the maximum value of a specified field.
min
Returns the minimum value of a specified field.
avg
Returns the average value of the specified field.
sum
Returns the total sum of all values for the specified field.
percentiles
Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.aggregate_users(date_ranges=[{"key": "value"}],
                                  exclude="string",
                                  extended_bounds={},
                                  field="string",
                                  filter="string",
                                  from=integer,
                                  include="string",
                                  interval="string",
                                  max_doc_count=integer,
                                  min_doc_count=integer,
                                  missing="string",
                                  name="string",
                                  q="string",
                                  ranges=[{"key": "value"}],
                                  size=integer,
                                  sort="string",
                                  sub_aggregates=["string"],
                                  time_zone="string",
                                  type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

combinedUserRolesV1

Section titled “combinedUserRolesV1”

Deprecated : Please use GET /user-management/combined/user-roles/v2.

Method GET
Route /user-management/combined/user-roles/v1
Scope User management: READ
PEP 8 get_user_grants_v1

Parameters

Section titled “Parameters”
user_uuid query · string
User UUID to get available roles for.
cid query · string
Customer ID to get grants for. Empty CID would result in Role IDs for user against current CID in view.
direct_only query · boolean
Specifies if to request direct Only role grants or all role grants between user and CID (specified in query params)
filter query · string
Filter using a query in Falcon Query Language (FQL). Supported filters:
Available values (3)
expires_atrole_idrole_name
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort by
Available values (15)
cidcid|asccid|desc
expires_atexpires_at|ascexpires_at|desc
role_namerole_name|ascrole_name|desc
typetype|asctype|desc
user_uuiduser_uuid|ascuser_uuid|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.get_user_grants_v1(cid="string",
                                     direct_only=boolean,
                                     filter="string",
                                     limit=integer,
                                     offset=integer,
                                     sort="string",
                                     user_uuid="string")
print(response)
Responses
[
  {
    "cid": "string",
    "cid_group_id": "string",
    "cid_group_name": "string",
    "grant_type": "string",
    "parent_cid": "string",
    "role_id": "string",
    "role_name": "string",
    "user_group_id": "string",
    "user_group_name": "string",
    "uuid": "string"
  }
]

CombinedUserRolesV2

Section titled “CombinedUserRolesV2”

Get User Grant(s).

Method GET
Route /user-management/combined/user-roles/v2
Scope User management: READ
PEP 8 get_user_grants

Parameters

Section titled “Parameters”
user_uuid query · string
User UUID to get available roles for.
cid query · string
Customer ID to get grants for. Empty CID would result in Role IDs for user against current CID in view.
direct_only query · boolean
Specifies if to request direct Only role grants or all role grants between user and CID (specified in query params)
filter query · string
Filter using a query in Falcon Query Language (FQL). Supported filters:
Available values (3)
expires_atrole_idrole_name
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort by
Available values (15)
cidcid|asccid|desc
expires_atexpires_at|ascexpires_at|desc
role_namerole_name|ascrole_name|desc
typetype|asctype|desc
user_uuiduser_uuid|ascuser_uuid|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.get_user_grants(cid="string",
                                  direct_only=boolean,
                                  filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string",
                                  user_uuid="string")
print(response)
Responses
[
  {
    "cid": "string",
    "cid_group_id": "string",
    "cid_group_name": "string",
    "expires_at": "string",
    "grant_type": "string",
    "parent_cid": "string",
    "role_id": "string",
    "role_name": "string",
    "user_group_id": "string",
    "user_group_name": "string",
    "user_type": "string",
    "uuid": "string"
  }
]

CreateUser

Section titled “CreateUser”

Deprecated : Please use POST /user-management/entities/users/v1.

Method POST
Route /users/entities/users/v1
Scope User management: WRITE
PEP 8 create_user

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
first_name body · string
First name of the user. (Can also use firstName)
firstName body · string
First name of the user. (Can also use firstName)
FirstName body · string
First name of the user. (Can also use firstName)
last_name body · string
Last name of the user. (Can also use lastName)
lastName body · string
Last name of the user. (Can also use lastName)
LastName body · string
Last name of the user. (Can also use lastName)
password body · string
The password to assign to the newly created account. As a best practice, we recommend ommitting password. If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password. The user should use the activation email to set their own password.
uid body · string
The user’s email address, which will be the assigned username. Must be provided as a keyword or as part of the body payload.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.create_user(first_name="string",
                              last_name="string",
                              uid="string",
                              password="string")
print(response)
Responses
[
  {
    "customer": "string",
    "firstName": "string",
    "lastName": "string",
    "status": "string",
    "uid": "string",
    "uuid": "string"
  }
]

createUserV1

Section titled “createUserV1”

Create a new user.

Method POST
Route /user-management/entities/users/v1
Scope User management: WRITE
PEP 8 create_user_mssp

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
cid body · string
Customer ID of the tenant to create the user within. When empty, the current CID is assumed.
first_name body · string
First name of the user. (Can also use firstName)
last_name body · string
Last name of the user. (Can also use lastName)
password body · string
The password to assign to the newly created account. As a best practice, we recommend ommitting password. If single sign-on is enabled for your customer account, the password attribute is ignored. If single sign-on is not enabled, we send a user activation request to their email address when you create the user with no password. The user should use the activation email to set their own password.
uid body · string
The user’s email address, which will be the assigned username. Must be provided as a keyword or as part of the body payload.
validate_only query · boolean
Validate of user is allowed, but do not create user.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.create_user_mssp(cid="string",
                                   first_name="string",
                                   last_name="string",
                                   uid="string",
                                   password="string")
print(response)
Responses
[
  {
    "access_granted_at": "string",
    "cid": "string",
    "created_at": "string",
    "factors": [],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
  }
]

DeleteUser

Section titled “DeleteUser”

Deprecated : Please use DELETE /user-management/entities/users/v1.

Method DELETE
Route /users/entities/users/v1
Scope User management: WRITE
PEP 8 delete_user

Parameters

Section titled “Parameters”
user_uuid query · string
ID of a user. Find a user’s ID from /users/entities/user/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.delete_user(user_uuid="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

deleteUserV1

Section titled “deleteUserV1”

Delete a user permanently.

Method DELETE
Route /user-management/entities/users/v1
Scope User management: WRITE
PEP 8 delete_user_mssp

Parameters

Section titled “Parameters”
user_uuid query · string
User UUID.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.delete_user_mssp(user_uuid="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

entitiesRolesGETV2

Section titled “entitiesRolesGETV2”

Get info about a role

Method POST
Route /user-management/entities/roles/GET/v2
Scope User management: READ
PEP 8 get_roles_mssp

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
List of role IDs to retrieve. Comma-delimited strings accepted. Must be provided as a keyword, argument or part of the body payload.
cid query · string
Customer ID to get available roles for. Empty CID would result in Role IDs for current CID in view.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_roles_mssp(cid="string", ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "description": "string",
    "display_name": "string",
    "id": "string",
    "is_global": false,
    "type": "string"
  }
]

entitiesRolesV1

Section titled “entitiesRolesV1”

Get info about a role

Method GET
Route /user-management/entities/roles/v1
Scope User management: READ
PEP 8 get_roles_mssp_v1

Parameters

Section titled “Parameters”
cid query · string
Customer ID to get available roles for. Empty CID would result in Role IDs for current CID in view.
ids query · string or list of strings
ID of a role. Find a role ID from /user-management/queries/roles/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_roles_mssp_v1(cid="string", ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "description": "string",
    "display_name": "string",
    "id": "string",
    "is_global": false,
    "type": "string"
  }
]

GetAvailableRoleIds

Section titled “GetAvailableRoleIds”

Deprecated : Please use GET /user-management/queries/roles/v1.

Method GET
Route /user-roles/queries/user-role-ids-by-cid/v1
Scope User management: READ
PEP 8 get_available_role_ids
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.get_available_role_ids()
print(response)
Responses
[
  "string"
]

GetRoles

Section titled “GetRoles”

Deprecated : Please use GET /user-management/entities/roles/v1.

Method GET
Route /user-roles/entities/user-roles/v1
Scope User management: READ
PEP 8 get_roles

Parameters

Section titled “Parameters”
ids query · string or list of strings
ID of a role. Find a role ID from /customer/queries/roles/v1 or /users/queries/roles/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_roles(ids=id_list)
print(response)
Responses
[
  {
    "cid": "string",
    "description": "string",
    "display_name": "string",
    "id": "string"
  }
]

GetUserRoleIds

Section titled “GetUserRoleIds”

Deprecated : Please use GET /user-management/combined/user-roles/v1.

Method GET
Route /user-roles/queries/user-role-ids-by-user-uuid/v1
Scope User management: READ
PEP 8 get_user_role_ids

Parameters

Section titled “Parameters”
user_uuid query · string
ID of a user. Find a user’s ID from /users/entities/user/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.get_user_role_ids(user_uuid="string")
print(response)
Responses
[
  "string"
]

GrantUserRoleIds

Section titled “GrantUserRoleIds”

Deprecated : Please use POST /user-management/entities/user-role-actions/v1.

Method POST
Route /user-roles/entities/user-roles/v1
Scope User management: WRITE
PEP 8 grant_user_role_ids

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
role_ids body · array
Role IDs you want to assign to the user id. (Can also use roleIds.) Must be provided as a keyword or as part of the body payload.
roleIds body · array
Role IDs you want to assign to the user id. (Can also use roleIds.) Must be provided as a keyword or as part of the body payload.
RoleIds body · array
Role IDs you want to assign to the user id. (Can also use roleIds.) Must be provided as a keyword or as part of the body payload.
user_uuid query · string
ID of a user. Find a user’s ID from /users/entities/user/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.grant_user_role_ids(role_ids=id_list, user_uuid="string")
print(response)
Responses
[
  "string"
]

queriesRolesV1

Section titled “queriesRolesV1”

Show role IDs for all roles available in your customer account.

Method GET
Route /user-management/queries/roles/v1
Scope User management: READ
PEP 8 query_roles

Parameters

Section titled “Parameters”
cid query · string
Customer ID to get available roles for. Empty CID would result in Role IDs for current CID in view.
user_uuid query · string
User UUID to get available roles for. Empty User UUID would returns all roles IDs available for customer.
action query · string
Actionable purpose of the query
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.query_roles(action="string", cid="string", user_uuid="string")
print(response)
Responses
[
  "string"
]

queryUserV1

Section titled “queryUserV1”

List user IDs for all users in your customer account.

Method GET
Route /user-management/queries/users/v1
Scope User management: READ
PEP 8 query_users

Parameters

Section titled “Parameters”
filter query · string
Filter using a query in Falcon Query Language (FQL). Supported filters:
Available values (13)
assigned_cidsciddirect_assigned_cids
factorsfirst_namehas_temporary_roles
last_namenamenon_ancestor_assigned_cids
statustemporarily_assigned_cidsuid
uuid
offset query · integer
The offset to start retrieving records from
limit query · integer
The maximum records to return. [1-500]
sort query · string
The property to sort by
Available values (30)
cid_namecid_name|asccid_name|desc
created_atcreated_at|asccreated_at|desc
first_namefirst_name|ascfirst_name|desc
has_temporary_roleshas_temporary_roles|aschas_temporary_roles|desc
last_login_atlast_login_at|asclast_login_at|desc
last_namelast_name|asclast_name|desc
namename|ascname|desc
statusstatus|ascstatus|desc
temporarily_assigned_cidstemporarily_assigned_cids|asctemporarily_assigned_cids|desc
uiduid|ascuid|desc
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.query_users(filter="string",
                              limit=integer,
                              offset=integer,
                              sort="string")
print(response)
Responses
[
  "string"
]

RetrieveEmailsByCID

Section titled “RetrieveEmailsByCID”

Deprecated : Please use POST /user-management/entities/users/GET/v1.

Method GET
Route /users/queries/emails-by-cid/v1
Scope User management: READ
PEP 8 retrieve_emails_by_cid
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.retrieve_emails_by_cid()
print(response)
Responses
[
  "string"
]

retrieveUser

Section titled “retrieveUser”

Deprecated : Please use POST /user-management/entities/users/GET/v1.

Method GET
Route /users/entities/users/v1
Scope User management: READ
PEP 8 retrieve_user

Parameters

Section titled “Parameters”
ids query · string or list of strings
ID of a user. Find a user’s ID from /users/entities/user/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.retrieve_user(ids=id_list)
print(response)
Responses
[
  {
    "customer": "string",
    "firstName": "string",
    "lastName": "string",
    "status": "string",
    "uid": "string",
    "uuid": "string"
  }
]

RetrieveUser

Section titled “RetrieveUser”

Deprecated : Please use retrieveUsersGETV1.

Method GET
Route /users/entities/users/v1
Scope User management: READ
PEP 8 retrieve_user

Parameters

Section titled “Parameters”
ids query · string or list of strings
ID of a user. Find a user’s ID from queryUserV1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.retrieve_user(ids=id_list)
print(response)

retrieveUsersGETV1

Section titled “retrieveUsersGETV1”

Get info about users including their name, UID and CID by providing user UUIDs

Method POST
Route /user-management/entities/users/GET/v1
Scope User management: READ
PEP 8 retrieve_users

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
List of role IDs to retrieve. Comma-delimited strings accepted. Must be provided as an argument, keyword, or part of the body payload.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.retrieve_users(ids=id_list)
print(response)
Responses
[
  {
    "access_granted_at": "string",
    "cid": "string",
    "created_at": "string",
    "factors": [],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
  }
]

RetrieveUserUUID

Section titled “RetrieveUserUUID”

Deprecated : Please use GET /user-management/queries/users/v1.

Method GET
Route /users/queries/user-uuids-by-email/v1
Scope User management: READ
PEP 8 retrieve_user_uuid

Parameters

Section titled “Parameters”
uid query · string or list of strings
A username. This is usually the user’s email address, but may vary based on your configuration.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.retrieve_user_uuid(uid=id_list)
print(response)
Responses
[
  "string"
]

RetrieveUserUUIDsByCID

Section titled “RetrieveUserUUIDsByCID”

Deprecated : Please use GET /user-management/queries/users/v1.

Method GET
Route /users/queries/user-uuids-by-cid/v1
Scope User management: READ
PEP 8 retrieve_user_uuids_by_cid
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.retrieve_user_uuids_by_cid()
print(response)
Responses
[
  "string"
]

RevokeUserRoleIds

Section titled “RevokeUserRoleIds”

Deprecated : Please use POST /user-management/entities/user-role-actions/v1.

Method DELETE
Route /user-roles/entities/user-roles/v1
Scope User management: WRITE
PEP 8 revoke_user_role_ids

Parameters

Section titled “Parameters”
user_uuid query · string
ID of a user. Find a user’s ID from /users/entities/user/v1.
ids query · string or list of strings
One or more role IDs to revoke. Find a role’s ID from /users/queries/roles/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.revoke_user_role_ids(ids=id_list, user_uuid="string")
print(response)
Responses
[
  "string"
]

UpdateUser

Section titled “UpdateUser”

Deprecated : Please use PATCH /user-management/entities/users/v1.

Method PATCH
Route /users/entities/users/v1
Scope User management: WRITE
PEP 8 update_user

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
first_name body · string
First name to apply to the user. (Can also use firstName)
firstName body · string
First name to apply to the user. (Can also use firstName)
FirstName body · string
First name to apply to the user. (Can also use firstName)
last_name body · string
Last name to apply to the user. (Can also use lastName)
lastName body · string
Last name to apply to the user. (Can also use lastName)
LastName body · string
Last name to apply to the user. (Can also use lastName)
user_uuid query · string
ID of a user. Find a user’s ID from /users/entities/user/v1.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.update_user(first_name="string",
                              last_name="string",
                              user_uuid="string")
print(response)
Responses
[
  {
    "customer": "string",
    "firstName": "string",
    "lastName": "string",
    "status": "string",
    "uid": "string",
    "uuid": "string"
  }
]

updateUserV1

Section titled “updateUserV1”

Modify an existing user’s first or last name.

Method PATCH
Route /user-management/entities/users/v1
Scope User management: WRITE
PEP 8 update_user_mssp

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
first_name body · string
First name to apply to the user. (Can also use firstName)
last_name body · string
Last name to apply to the user. (Can also use lastName)
user_uuid query · string
user uuid
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


response = falcon.update_user_mssp(first_name="string",
                                   last_name="string",
                                   user_uuid="string")
print(response)
Responses
[
  {
    "access_granted_at": "string",
    "cid": "string",
    "created_at": "string",
    "factors": [],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
  }
]

userActionV1

Section titled “userActionV1”

Apply actions to one or more User.

Method POST
Route /user-management/entities/user-actions/v1
Scope User management: WRITE
PEP 8 user_action

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
action body · object
ids body · array
User ID(s).
action_name body · string
Action to perform. Allowed values:
Available values (2)
reset_2fareset_password
action_value body · string
Value to provide for action.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.user_action(action_name="string",
                              action_value="string",
                              ids=id_list)
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

userRolesActionV1

Section titled “userRolesActionV1”

Grant or Revoke one or more role(s) to a user against a CID.

Method POST
Route /user-management/entities/user-role-actions/v1
Scope User management: WRITE
PEP 8 user_roles_action

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
action body · string
’grant’ or ‘revoke’
Available values (3)
grantrevokebody
cid body · string
Customer ID of the tenant to take the action within. Must be provided as a keyword or as part of the body payload.
expires_at body · string
expiration date time of the role in RFC3339 format
role_ids body · array
Role IDs you want to adjust within the user id. Must be provided as a keyword or as part of the body payload.
uuid body · string
User ID to grant roles access to. Must be provided as a keyword or as part of the body payload.
Code Examples
from falconpy import UserManagement


falcon = UserManagement(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.user_roles_action(action="string",
                                    cid="string",
                                    role_ids=id_list,
                                    uuid="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use