Microsoft Entra ID Directory Objects API
Generic directory object operations - check member groups and objects, resolve objects by id, validate properties - plus the tenant public key infrastructure.
Generic directory object operations - check member groups and objects, resolve objects by id, validate properties - plus the tenant public key infrastructure.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/azure-ad-directory-objects-api"
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
openapi: 3.0.4
info:
title: DirectoryObjects
version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
description: Core
paths:
/directory/publicKeyInfrastructure:
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: Get publicKeyInfrastructure from directory
description: The collection of public key infrastructure instances for the certificate-based authentication feature for users in a Microsoft Entra tenant.
operationId: directory_GetPublicKeyInfrastructure
parameters:
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.publicKeyInfrastructureRoot'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- directory.publicKeyInfrastructureRoot
summary: Update the navigation property publicKeyInfrastructure in directory
operationId: directory_UpdatePublicKeyInfrastructure
requestBody:
description: New navigation property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.publicKeyInfrastructureRoot'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.publicKeyInfrastructureRoot'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
delete:
tags:
- directory.publicKeyInfrastructureRoot
summary: Delete navigation property publicKeyInfrastructure for directory
operationId: directory_DeletePublicKeyInfrastructure
parameters:
- name: If-Match
in: header
description: ETag
style: simple
schema:
type: string
responses:
2XX:
description: Success
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations:
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: List certificateBasedAuthPki objects
description: Get a list of the certificateBasedAuthPki objects and their properties.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/publickeyinfrastructureroot-list-certificatebasedauthconfigurations?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure_ListCertificateBasedAuthConfiguration
parameters:
- $ref: '#/components/parameters/top'
- $ref: '#/components/parameters/skip'
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
- $ref: '#/components/parameters/count'
- name: $orderby
in: query
description: Order items by property values
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
$ref: '#/components/responses/microsoft.graph.certificateBasedAuthPkiCollectionResponse'
default:
$ref: '#/components/responses/error'
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
x-ms-docs-operation-type: operation
post:
tags:
- directory.publicKeyInfrastructureRoot
summary: Create certificateBasedAuthPki
description: Create a new certificateBasedAuthPki object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/publickeyinfrastructureroot-post-certificatebasedauthconfigurations?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure_CreateCertificateBasedAuthConfiguration
requestBody:
description: New navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
required: true
responses:
2XX:
description: Created navigation property.
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
'/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}':
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: Get certificateBasedAuthPki
description: Read the properties and relationships of a certificateBasedAuthPki object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificatebasedauthpki-get?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure_GetCertificateBasedAuthConfiguration
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- directory.publicKeyInfrastructureRoot
summary: Update certificateBasedAuthPki
description: Update the properties of a certificateBasedAuthPki object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificatebasedauthpki-update?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure_UpdateCertificateBasedAuthConfiguration
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
requestBody:
description: New navigation property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateBasedAuthPki'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
delete:
tags:
- directory.publicKeyInfrastructureRoot
summary: Delete certificateBasedAuthPki
description: Delete a certificateBasedAuthPki object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/publickeyinfrastructureroot-delete-certificatebasedauthconfigurations?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure_DeleteCertificateBasedAuthConfiguration
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- name: If-Match
in: header
description: ETag
style: simple
schema:
type: string
responses:
2XX:
description: Success
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
'/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities':
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: List certificateAuthorityDetail objects
description: Get a list of the certificateAuthorityDetail objects and their properties.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificatebasedauthpki-list-certificateauthorities?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_ListCertificateAuthority
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- $ref: '#/components/parameters/top'
- $ref: '#/components/parameters/skip'
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
- $ref: '#/components/parameters/count'
- name: $orderby
in: query
description: Order items by property values
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
$ref: '#/components/responses/microsoft.graph.certificateAuthorityDetailCollectionResponse'
default:
$ref: '#/components/responses/error'
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
x-ms-docs-operation-type: operation
post:
tags:
- directory.publicKeyInfrastructureRoot
summary: Create certificateAuthorityDetail
description: Create a new certificateAuthorityDetail object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificatebasedauthpki-post-certificateauthorities?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_CreateCertificateAuthority
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
requestBody:
description: New navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
required: true
responses:
2XX:
description: Created navigation property.
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
'/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities/{certificateAuthorityDetail-id}':
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: Get certificateAuthorities from directory
description: The collection of certificate authorities contained in this public key infrastructure resource.
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_GetCertificateAuthority
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- name: certificateAuthorityDetail-id
in: path
description: The unique identifier of certificateAuthorityDetail
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateAuthorityDetail
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved navigation property
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- directory.publicKeyInfrastructureRoot
summary: Update certificateAuthorityDetail
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificateauthoritydetail-update?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_UpdateCertificateAuthority
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- name: certificateAuthorityDetail-id
in: path
description: The unique identifier of certificateAuthorityDetail
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateAuthorityDetail
requestBody:
description: New navigation property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.certificateAuthorityDetail'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
delete:
tags:
- directory.publicKeyInfrastructureRoot
summary: Delete certificateAuthorityDetail
description: Delete a certificateAuthorityDetail object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificatebasedauthpki-delete-certificateauthorities?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_DeleteCertificateAuthority
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- name: certificateAuthorityDetail-id
in: path
description: The unique identifier of certificateAuthorityDetail
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateAuthorityDetail
- name: If-Match
in: header
description: ETag
style: simple
schema:
type: string
responses:
2XX:
description: Success
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
'/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/certificateAuthorities/$count':
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: Get the number of the resource
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration.certificateAuthority_GetCount
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
responses:
2XX:
$ref: '#/components/responses/ODataCountResponse'
default:
$ref: '#/components/responses/error'
'/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/{certificateBasedAuthPki-id}/microsoft.graph.upload':
post:
tags:
- directory.publicKeyInfrastructureRoot
summary: Invoke action upload
description: 'Append additional certificate authority details to a certificateBasedAuthPki resource. Only one operation can run at a time and this operation can take up to 30 minutes to complete. To know whether another upload is in progress, call the Get certificateBasedAuthPki. The status property will have the value running.'
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/certificatebasedauthpki-upload?view=graph-rest-1.0
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_upload
parameters:
- name: certificateBasedAuthPki-id
in: path
description: The unique identifier of certificateBasedAuthPki
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: certificateBasedAuthPki
requestBody:
description: Action parameters
content:
application/json:
schema:
type: object
properties:
uploadUrl:
type: string
sha256FileHash:
type: string
additionalProperties:
type: object
required: true
responses:
2XX:
description: Success
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: action
/directory/publicKeyInfrastructure/certificateBasedAuthConfigurations/$count:
get:
tags:
- directory.publicKeyInfrastructureRoot
summary: Get the number of the resource
operationId: directory.publicKeyInfrastructure.certificateBasedAuthConfiguration_GetCount
parameters:
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
responses:
2XX:
$ref: '#/components/responses/ODataCountResponse'
default:
$ref: '#/components/responses/error'
/directoryObjects:
get:
tags:
- directoryObjects.directoryObject
summary: Get entities from directoryObjects
operationId: directoryObject_ListDirectoryObject
parameters:
- name: ConsistencyLevel
in: header
description: 'Indicates the requested consistency level. Documentation URL: https://docs.microsoft.com/graph/aad-advanced-queries'
style: simple
schema:
type: string
examples:
example-1:
description: $search and $count queries require the client to set the ConsistencyLevel HTTP header to 'eventual'.
value: eventual
- $ref: '#/components/parameters/top'
- $ref: '#/components/parameters/skip'
- $ref: '#/components/parameters/search'
- $ref: '#/components/parameters/filter'
- $ref: '#/components/parameters/count'
- name: $orderby
in: query
description: Order items by property values
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
$ref: '#/components/responses/microsoft.graph.directoryObjectCollectionResponse'
default:
$ref: '#/components/responses/error'
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
x-ms-docs-operation-type: operation
post:
tags:
- directoryObjects.directoryObject
summary: Add new entity to directoryObjects
operationId: directoryObject_CreateDirectoryObject
requestBody:
description: New entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
required: true
responses:
2XX:
description: Created entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
'/directoryObjects/{directoryObject-id}':
get:
tags:
- directoryObjects.directoryObject
summary: Get directoryObject
description: Retrieve the properties and relationships of a directoryObject object.
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/directoryobject-get?view=graph-rest-1.0
operationId: directoryObject_GetDirectoryObject
parameters:
- name: directoryObject-id
in: path
description: The unique identifier of directoryObject
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: directoryObject
- name: $select
in: query
description: Select properties to be returned
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
- name: $expand
in: query
description: Expand related entities
style: form
explode: false
schema:
uniqueItems: true
type: array
items:
type: string
responses:
2XX:
description: Retrieved entity
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
patch:
tags:
- directoryObjects.directoryObject
summary: Update entity in directoryObjects
operationId: directoryObject_UpdateDirectoryObject
parameters:
- name: directoryObject-id
in: path
description: The unique identifier of directoryObject
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: directoryObject
requestBody:
description: New property values
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/microsoft.graph.directoryObject'
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
delete:
tags:
- directoryObjects.directoryObject
summary: Delete directoryObject
description: 'Delete a directory object, for example, a group, user, application, or service principal.'
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/directoryobject-delete?view=graph-rest-1.0
operationId: directoryObject_DeleteDirectoryObject
parameters:
- name: directoryObject-id
in: path
description: The unique identifier of directoryObject
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: directoryObject
- name: If-Match
in: header
description: ETag
style: simple
schema:
type: string
responses:
2XX:
description: Success
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: operation
'/directoryObjects/{directoryObject-id}/microsoft.graph.checkMemberGroups':
post:
tags:
- directoryObjects.directoryObject.Actions
summary: Invoke action checkMemberGroups
description: "Check for membership in a specified list of group IDs, and return from that list the IDs of groups where a specified object is a member. The specified object can be of one of the following types:\r\n- user\r\n- group\r\n- service principal\r\n- organizational contact\r\n- device\r\n- directory object This function is transitive. You can check up to a maximum of 20 groups per request. This function supports all groups provisioned in Microsoft Entra ID. Because Microsoft 365 groups cannot contain other groups, membership in a Microsoft 365 group is always direct."
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/directoryobject-checkmembergroups?view=graph-rest-1.0
operationId: directoryObject_checkMemberGroup
parameters:
- name: directoryObject-id
in: path
description: The unique identifier of directoryObject
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: directoryObject
requestBody:
description: Action parameters
content:
application/json:
schema:
type: object
properties:
groupIds:
type: array
items:
type: string
additionalProperties:
type: object
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
type: object
properties:
value:
type: array
items:
type: string
'@odata.nextLink':
type: string
nullable: true
additionalProperties:
type: object
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: action
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
'/directoryObjects/{directoryObject-id}/microsoft.graph.checkMemberObjects':
post:
tags:
- directoryObjects.directoryObject.Actions
summary: Invoke action checkMemberObjects
operationId: directoryObject_checkMemberObject
parameters:
- name: directoryObject-id
in: path
description: The unique identifier of directoryObject
required: true
style: simple
schema:
type: string
x-ms-docs-key-type: directoryObject
requestBody:
description: Action parameters
content:
application/json:
schema:
type: object
properties:
ids:
type: array
items:
type: string
additionalProperties:
type: object
required: true
responses:
2XX:
description: Success
content:
application/json:
schema:
type: object
properties:
value:
type: array
items:
type: string
'@odata.nextLink':
type: string
nullable: true
additionalProperties:
type: object
default:
$ref: '#/components/responses/error'
x-ms-docs-operation-type: action
x-ms-pageable:
nextLinkName: '@odata.nextLink'
operationName: listMore
'/directoryObjects/{directoryObject-id}/microsoft.graph.getMemberGroups':
post:
tags:
- directoryObjects.directoryObject.Actions
summary: Invoke action getMemberGroups
description: 'Return all the group IDs for the groups that the specified user, group, service principal, organizational contact, device, or directory object is a member of. This function is transitive. This API returns up to 11,000 group IDs. If more than 11,000 results are available, it returns a 400 Bad Request error with the DirectoryResultSizeLimitExceeded error code. If you get the DirectoryResultSizeLimitExceeded error code, use the List group transitive memberOf API instead.'
externalDocs:
description: Find more info here
url: https://learn.microsoft.com/graph/api/directoryobject-getmembergroups?view=graph-rest-1.0
operationId: directoryObject_getMemberGroup
parameters:
- name: directoryObject-id
in: path
description: The unique iden
# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/_original/azure-ad-graph-directoryobjects-openapi.yml