Azure Log Analytics Clusters API

openapi: 3.2.0
info:
  title: Azure Log Analytics Network Security Perimeter Clusters API
  version: '2026-03-01'
  description: Provides NSP operations for working with Log Analytics.
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Clusters
paths:
  /subscriptions/{subscriptionId}/providers/Microsoft.OperationalInsights/clusters:
    get:
      operationId: Clusters_List
      tags:
      - Clusters
      description: Gets the Log Analytics clusters in a subscription.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClusterListResult'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Clusters list
      x-summary-source: derived
  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/clusters:
    get:
      operationId: Clusters_ListByResourceGroup
      tags:
      - Clusters
      description: Gets Log Analytics clusters in a resource group.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClusterListResult'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Clusters list by resource group
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/clusters/{clusterName}
  : get:
      operationId: Clusters_Get
      tags:
      - Clusters
      description: Gets a Log Analytics cluster instance.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: clusterName
        in: path
        description: Name of the Log Analytics Cluster.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cluster'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      summary: Clusters get
      x-summary-source: derived
    put:
      operationId: Clusters_CreateOrUpdate
      tags:
      - Clusters
      description: Create or update a Log Analytics cluster.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: clusterName
        in: path
        description: Name of the Log Analytics Cluster.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'Cluster' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cluster'
        '202':
          description: Resource operation accepted.
          headers:
            Azure-AsyncOperation:
              description: A link to the status monitor
              schema:
                type: string
                format: uri
            Location:
              description: The Location header contains the URL where the status of the long running operation can be checked.
              schema:
                type: string
            Retry-After:
              description: The Retry-After header can indicate how long the client should wait before polling the operation status.
              schema:
                type: integer
                format: int32
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-ms-long-running-operation-options:
        final-state-via: location
        final-state-schema: '#/definitions/Cluster'
      x-ms-long-running-operation: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cluster'
        description: The parameters required to create or update a Log Analytics cluster.
        required: true
      summary: Clusters create or update
      x-summary-source: derived
    patch:
      operationId: Clusters_Update
      tags:
      - Clusters
      description: Updates a Log Analytics cluster.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: clusterName
        in: path
        description: Name of the Log Analytics Cluster.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cluster'
        '202':
          description: Resource update request accepted.
          headers:
            Azure-AsyncOperation:
              description: A link to the status monitor
              schema:
                type: string
                format: uri
            Location:
              description: The Location header contains the URL where the status of the long running operation can be checked.
              schema:
                type: string
            Retry-After:
              description: The Retry-After header can indicate how long the client should wait before polling the operation status.
              schema:
                type: integer
                format: int32
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-ms-long-running-operation-options:
        final-state-via: location
        final-state-schema: '#/definitions/Cluster'
      x-ms-long-running-operation: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClusterPatch'
        description: The parameters required to patch a Log Analytics cluster.
        required: true
      summary: Clusters update
      x-summary-source: derived
    delete:
      operationId: Clusters_Delete
      tags:
      - Clusters
      description: Deletes a cluster instance.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: clusterName
        in: path
        description: Name of the Log Analytics Cluster.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '202':
          description: Resource deletion accepted.
          headers:
            Location:
              description: The Location header contains the URL where the status of the long running operation can be checked.
              schema:
                type: string
            Retry-After:
              description: The Retry-After header can indicate how long the client should wait before polling the operation status.
              schema:
                type: integer
                format: int32
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-ms-long-running-operation-options:
        final-state-via: location
      x-ms-long-running-operation: true
      summary: Clusters delete
      x-summary-source: derived
components:
  schemas:
    BillingType:
      type: string
      description: Configures whether billing will be only on the cluster or each workspace will be billed by its proportional use. This does not change the overall billing, only how it will be distributed. Default value is 'Cluster'
      enum:
      - Cluster
      - Workspaces
      x-ms-enum:
        name: BillingType
        modelAsString: true
        values:
        - name: Cluster
          value: Cluster
          description: Cluster
        - name: Workspaces
          value: Workspaces
          description: Workspaces
    ClusterPatchProperties:
      type: object
      description: Log Analytics cluster patch properties.
      properties:
        keyVaultProperties:
          $ref: '#/components/schemas/keyVaultProperties'
          description: The associated key properties.
        billingType:
          $ref: '#/components/schemas/BillingType'
          description: The cluster's billing type.
    ClusterPatch:
      type: object
      description: The top level Log Analytics cluster resource container.
      properties:
        properties:
          $ref: '#/components/schemas/ClusterPatchProperties'
          description: Log Analytics cluster properties.
          x-ms-client-flatten: true
        identity:
          $ref: '#/components/schemas/ManagedServiceIdentity'
          description: Resource's identity.
        sku:
          $ref: '#/components/schemas/ClusterSku'
          description: The sku properties.
        tags:
          type: object
          description: Resource tags.
          additionalProperties:
            type: string
          x-ms-mutability:
          - read
          - update
          - create
    ClusterEntityStatus:
      type: string
      description: The provisioning state of the cluster.
      enum:
      - Creating
      - Succeeded
      - Failed
      - Canceled
      - Deleting
      - ProvisioningAccount
      - Updating
      x-ms-enum:
        name: ClusterEntityStatus
        modelAsString: true
        values:
        - name: Creating
          value: Creating
          description: Creating
        - name: Succeeded
          value: Succeeded
          description: Succeeded
        - name: Failed
          value: Failed
          description: Failed
        - name: Canceled
          value: Canceled
          description: Canceled
        - name: Deleting
          value: Deleting
          description: Deleting
        - name: ProvisioningAccount
          value: ProvisioningAccount
          description: ProvisioningAccount
        - name: Updating
          value: Updating
          description: Updating
    TrackedResource:
      type: object
      title: Tracked Resource
      description: The resource model definition for an Azure Resource Manager tracked top level resource which has 'tags' and a 'location'
      properties:
        tags:
          type: object
          description: Resource tags.
          additionalProperties:
            type: string
          x-ms-mutability:
          - read
          - create
          - update
        location:
          type: string
          description: The geo-location where the resource lives
          x-ms-mutability:
          - read
          - create
      required:
      - location
      allOf:
      - $ref: '#/components/schemas/Resource'
    CapacityReservationProperties:
      type: object
      description: The Capacity Reservation properties.
      properties:
        lastSkuUpdate:
          type: string
          format: date-time
          description: The last time Sku was updated.
          readOnly: true
        minCapacity:
          type: integer
          format: int64
          description: Minimum CapacityReservation value in Gigabytes.
          readOnly: true
    ClusterReplicationState:
      type: string
      description: The provisioning state of the cluster replication.
      enum:
      - Succeeded
      - EnableRequested
      - Enabling
      - DisableRequested
      - Disabling
      - RollbackRequested
      - RollingBack
      - Failed
      - Canceled
      x-ms-enum:
        name: ClusterReplicationState
        modelAsString: true
        values:
        - name: Succeeded
          value: Succeeded
          description: Succeeded
        - name: EnableRequested
          value: EnableRequested
          description: EnableRequested
        - name: Enabling
          value: Enabling
          description: Enabling
        - name: DisableRequested
          value: DisableRequested
          description: DisableRequested
        - name: Disabling
          value: Disabling
          description: Disabling
        - name: RollbackRequested
          value: RollbackRequested
          description: RollbackRequested
        - name: RollingBack
          value: RollingBack
          description: RollingBack
        - name: Failed
          value: Failed
          description: Failed
        - name: Canceled
          value: Canceled
          description: Canceled
    ClusterSku:
      type: object
      description: The cluster sku definition.
      properties:
        capacity:
          type:
          - integer
          - 'null'
          format: int64
          description: The capacity reservation level in Gigabytes for this cluster.
        name:
          $ref: '#/components/schemas/ClusterSkuNameEnum'
          description: The SKU (tier) of a cluster.
    ErrorResponse:
      type: object
      title: Error response
      description: Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
      properties:
        error:
          $ref: '#/components/schemas/ErrorDetail'
          description: The error object.
    ClusterProperties:
      type: object
      description: Cluster properties.
      properties:
        clusterId:
          type: string
          description: The ID associated with the cluster.
          readOnly: true
        provisioningState:
          $ref: '#/components/schemas/ClusterEntityStatus'
          description: The provisioning state of the cluster.
          readOnly: true
        isDoubleEncryptionEnabled:
          type: boolean
          description: Configures whether cluster will use double encryption. This Property can not be modified after cluster creation. Default value is 'true'
          x-ms-mutability:
          - read
          - create
        isAvailabilityZonesEnabled:
          type: boolean
          description: Sets whether the cluster will support availability zones. This can be set as true only in regions where Azure Data Explorer support Availability Zones. This Property can not be modified after cluster creation. Default value is 'true' if region supports Availability Zones.
        billingType:
          $ref: '#/components/schemas/BillingType'
          description: The cluster's billing type.
        keyVaultProperties:
          $ref: '#/components/schemas/keyVaultProperties'
          description: The associated key properties.
        lastModifiedDate:
          type: string
          format: date-time
          description: The last time the cluster was updated.
          readOnly: true
        createdDate:
          type: string
          format: date-time
          description: The cluster creation time
          readOnly: true
        associatedWorkspaces:
          type: array
          description: The list of Log Analytics workspaces associated with the cluster
          items:
            $ref: '#/components/schemas/AssociatedWorkspace'
          x-ms-identifiers:
          - workspaceId
        capacityReservationProperties:
          $ref: '#/components/schemas/CapacityReservationProperties'
          description: Additional properties for capacity reservation
        replication:
          $ref: '#/components/schemas/ClusterReplicationProperties'
          description: Cluster's replication properties.
    ClusterListResult:
      type: object
      description: The response of a Cluster list operation.
      properties:
        value:
          type: array
          description: The Cluster items on this page
          items:
            $ref: '#/components/schemas/Cluster'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
      required:
      - value
    Resource:
      type: object
      title: Resource
      description: Common fields that are returned in the response for all Azure Resource Manager resources
      properties:
        id:
          type: string
          format: arm-id
          description: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
          readOnly: true
        name:
          type: string
          description: The name of the resource
          readOnly: true
        type:
          type: string
          description: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
          readOnly: true
        systemData:
          $ref: '#/components/schemas/systemData'
          description: Azure Resource Manager metadata containing createdBy and modifiedBy information.
          readOnly: true
      x-ms-azure-resource: true
    Cluster:
      type: object
      description: The top level Log Analytics cluster resource container.
      properties:
        properties:
          $ref: '#/components/schemas/ClusterProperties'
          description: Log Analytics cluster properties.
          x-ms-client-flatten: true
        identity:
          $ref: '#/components/schemas/ManagedServiceIdentity'
          description: The managed service identities assigned to this resource.
        sku:
          $ref: '#/components/schemas/ClusterSku'
          description: The sku properties.
      allOf:
      - $ref: '#/components/schemas/TrackedResource'
    ManagedServiceIdentity:
      type: object
      description: Managed service identity (system assigned and/or user assigned identities)
      properties:
        principalId:
          type: string
          format: uuid
          description: The service principal ID of the system assigned identity. This property will only be provided for a system assigned identity.
          readOnly: true
        tenantId:
          type: string
          format: uuid
          description: The tenant ID of the system assigned identity. This property will only be provided for a system assigned identity.
          readOnly: true
        type:
          $ref: '#/components/schemas/ManagedServiceIdentityType'
        userAssignedIdentities:
          $ref: '#/components/schemas/UserAssignedIdentities'
      required:
      - type
    keyVaultProperties:
      type: object
      description: The key vault properties.
      properties:
        keyVaultUri:
          type: string
          description: The Key Vault uri which holds they key associated with the Log Analytics cluster.
        keyName:
          type: string
          description: The name of the key associated with the Log Analytics cluster.
        keyVersion:
          type: string
          description: The version of the key associated with the Log Analytics cluster.
        keyRsaSize:
          type: integer
          format: int32
          description: Selected key minimum required size.
    ClusterSkuNameEnum:
      type: string
      description: The SKU (tier) of a cluster.
      enum:
      - CapacityReservation
      x-ms-enum:
        name: ClusterSkuNameEnum
        modelAsString: true
        values:
        - name: CapacityReservation
          value: CapacityReservation
          description: CapacityReservation
    AssociatedWorkspace:
      type: object
      description: The list of Log Analytics workspaces associated with the cluster.
      properties:
        workspaceId:
          type: string
          format: uuid
          description: Associated workspace immutable id.
          readOnly: true
        workspaceName:
          type: string
          description: Associated workspace resource name.
          readOnly: true
        resourceId:
          type: string
          format: arm-id
          description: 'Associated workspace arm resource id, in the form of: ''/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}.'
          readOnly: true
          x-ms-arm-id-details:
            allowedResources:
            - type: Microsoft.OperationalInsights/workspaces
        associateDate:
          type: string
          format: date-time
          description: The time of workspace association.
          readOnly: true
    ClusterReplicationProperties:
      type: object
      description: Cluster replication properties.
      properties:
        location:
          type: string
          description: The secondary location of the replication. If replication is being enabled, enabled must be provided.
          x-ms-mutability:
          - read
          - create
        enabled:
          type: boolean
          description: Specifies whether the replication is enabled or not. When true the cluster is replicate to the specified location.
        isAvailabilityZonesEnabled:
          type: boolean
          description: Should enable AvailabilityZones for the given replicated cluster
        provisioningState:
          $ref: '#/components/schemas/ClusterReplicationState'
          description: The provisioning state of the cluster replication.
          readOnly: true
        createdDate:
          type: string
          format: date-time
          description: The cluster's replication creation time
          readOnly: true
        lastModifiedDate:
          type: string
          format: date-time
          description: The last time the cluster's replication was updated.
          readOnly: true
  parameters:
    ResourceGroupNameParameter:
      name: resourceGroupName
      in: path
      description: The name of the resource group. The name is case insensitive.
      required: true
      x-ms-parameter-location: method
      schema:
        type: string
        maxLength: 90
        minLength: 1
    ApiVersionParameter:
      name: api-version
      in: query
      description: The API version to use for this operation.
      required: true
      schema:
        type: string
        minLength: 1
    SubscriptionIdParameter:
      name: subscriptionId
      in: path
      description: The ID of the target subscription. The value must be an UUID.
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.