Azure Log Analytics Data Sources API

openapi: 3.2.0
info:
  title: Azure Log Analytics Network Security Perimeter Data Sources…
  version: '2026-03-01'
  description: Provides NSP operations for working with Log Analytics.
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Data Sources
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/dataSources
  : get:
      operationId: DataSources_ListByWorkspace
      tags:
      - Data Sources
      description: Gets the first page of data source instances in a workspace with the link to the next page.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 63
          minLength: 4
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: $filter
        in: query
        description: The filter to apply on the operation.
        required: true
        schema:
          type: string
      - name: $skiptoken
        in: query
        description: Starting point of the collection of data source instances.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataSourceListResult'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Data sources list by workspace
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/dataSources/{dataSourceName}
  : get:
      operationId: DataSources_Get
      tags:
      - Data Sources
      description: Gets a datasource instance.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 63
          minLength: 4
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: dataSourceName
        in: path
        description: Name of the datasource
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataSource'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      summary: Data sources get
      x-summary-source: derived
    put:
      operationId: DataSources_CreateOrUpdate
      tags:
      - Data Sources
      description: Create or update a data source.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 63
          minLength: 4
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: dataSourceName
        in: path
        description: Name of the datasource
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'DataSource' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataSource'
        '201':
          description: Resource 'DataSource' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataSource'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DataSource'
        description: The parameters required to create or update a datasource.
        required: true
      summary: Data sources create or update
      x-summary-source: derived
    delete:
      operationId: DataSources_Delete
      tags:
      - Data Sources
      description: Deletes a data source instance.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 63
          minLength: 4
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: dataSourceName
        in: path
        description: Name of the datasource
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      summary: Data sources delete
      x-summary-source: derived
components:
  schemas:
    Resource:
      type: object
      title: Resource
      description: Common fields that are returned in the response for all Azure Resource Manager resources
      properties:
        id:
          type: string
          format: arm-id
          description: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
          readOnly: true
        name:
          type: string
          description: The name of the resource
          readOnly: true
        type:
          type: string
          description: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
          readOnly: true
        systemData:
          $ref: '#/components/schemas/systemData'
          description: Azure Resource Manager metadata containing createdBy and modifiedBy information.
          readOnly: true
      x-ms-azure-resource: true
    DataSourceListResult:
      type: object
      description: The response of a DataSource list operation.
      properties:
        value:
          type: array
          description: The DataSource items on this page
          items:
            $ref: '#/components/schemas/DataSource'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
      required:
      - value
    DataSource:
      type: object
      description: Datasources under OMS Workspace.
      properties:
        properties:
          description: The data source properties in raw json format, each kind of data source have it's own schema.
        etag:
          type: string
          description: The ETag of the data source.
        kind:
          $ref: '#/components/schemas/DataSourceKind'
          description: The kind of the DataSource.
        tags:
          type: object
          description: Resource tags.
          additionalProperties:
            type: string
          x-ms-mutability:
          - read
          - update
          - create
      required:
      - properties
      - kind
      allOf:
      - $ref: '#/components/schemas/ProxyResource'
      x-ms-azure-resource: true
    ErrorResponse:
      type: object
      title: Error response
      description: Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
      properties:
        error:
          $ref: '#/components/schemas/ErrorDetail'
          description: The error object.
    ProxyResource:
      type: object
      title: Proxy Resource
      description: The resource model definition for a Azure Resource Manager proxy resource. It will not have tags and a location
      allOf:
      - $ref: '#/components/schemas/Resource'
    DataSourceKind:
      type: string
      description: The kind of the DataSource.
      enum:
      - WindowsEvent
      - WindowsPerformanceCounter
      - IISLogs
      - LinuxSyslog
      - LinuxSyslogCollection
      - LinuxPerformanceObject
      - LinuxPerformanceCollection
      - CustomLog
      - CustomLogCollection
      - AzureAuditLog
      - AzureActivityLog
      - GenericDataSource
      - ChangeTrackingCustomPath
      - ChangeTrackingPath
      - ChangeTrackingServices
      - ChangeTrackingDataTypeConfiguration
      - ChangeTrackingDefaultRegistry
      - ChangeTrackingRegistry
      - ChangeTrackingLinuxPath
      - LinuxChangeTrackingPath
      - ChangeTrackingContentLocation
      - WindowsTelemetry
      - Office365
      - SecurityWindowsBaselineConfiguration
      - SecurityCenterSecurityWindowsBaselineConfiguration
      - SecurityEventCollectionConfiguration
      - SecurityInsightsSecurityEventCollectionConfiguration
      - ImportComputerGroup
      - NetworkMonitoring
      - Itsm
      - DnsAnalytics
      - ApplicationInsights
      - SqlDataClassification
      x-ms-enum:
        name: DataSourceKind
        modelAsString: true
        values:
        - name: WindowsEvent
          value: WindowsEvent
          description: WindowsEvent
        - name: WindowsPerformanceCounter
          value: WindowsPerformanceCounter
          description: WindowsPerformanceCounter
        - name: IISLogs
          value: IISLogs
          description: IISLogs
        - name: LinuxSyslog
          value: LinuxSyslog
          description: LinuxSyslog
        - name: LinuxSyslogCollection
          value: LinuxSyslogCollection
          description: LinuxSyslogCollection
        - name: LinuxPerformanceObject
          value: LinuxPerformanceObject
          description: LinuxPerformanceObject
        - name: LinuxPerformanceCollection
          value: LinuxPerformanceCollection
          description: LinuxPerformanceCollection
        - name: CustomLog
          value: CustomLog
          description: CustomLog
        - name: CustomLogCollection
          value: CustomLogCollection
          description: CustomLogCollection
        - name: AzureAuditLog
          value: AzureAuditLog
          description: AzureAuditLog
        - name: AzureActivityLog
          value: AzureActivityLog
          description: AzureActivityLog
        - name: GenericDataSource
          value: GenericDataSource
          description: GenericDataSource
        - name: ChangeTrackingCustomPath
          value: ChangeTrackingCustomPath
          description: ChangeTrackingCustomPath
        - name: ChangeTrackingPath
          value: ChangeTrackingPath
          description: ChangeTrackingPath
        - name: ChangeTrackingServices
          value: ChangeTrackingServices
          description: ChangeTrackingServices
        - name: ChangeTrackingDataTypeConfiguration
          value: ChangeTrackingDataTypeConfiguration
          description: ChangeTrackingDataTypeConfiguration
        - name: ChangeTrackingDefaultRegistry
          value: ChangeTrackingDefaultRegistry
          description: ChangeTrackingDefaultRegistry
        - name: ChangeTrackingRegistry
          value: ChangeTrackingRegistry
          description: ChangeTrackingRegistry
        - name: ChangeTrackingLinuxPath
          value: ChangeTrackingLinuxPath
          description: ChangeTrackingLinuxPath
        - name: LinuxChangeTrackingPath
          value: LinuxChangeTrackingPath
          description: LinuxChangeTrackingPath
        - name: ChangeTrackingContentLocation
          value: ChangeTrackingContentLocation
          description: ChangeTrackingContentLocation
        - name: WindowsTelemetry
          value: WindowsTelemetry
          description: WindowsTelemetry
        - name: Office365
          value: Office365
          description: Office365
        - name: SecurityWindowsBaselineConfiguration
          value: SecurityWindowsBaselineConfiguration
          description: SecurityWindowsBaselineConfiguration
        - name: SecurityCenterSecurityWindowsBaselineConfiguration
          value: SecurityCenterSecurityWindowsBaselineConfiguration
          description: SecurityCenterSecurityWindowsBaselineConfiguration
        - name: SecurityEventCollectionConfiguration
          value: SecurityEventCollectionConfiguration
          description: SecurityEventCollectionConfiguration
        - name: SecurityInsightsSecurityEventCollectionConfiguration
          value: SecurityInsightsSecurityEventCollectionConfiguration
          description: SecurityInsightsSecurityEventCollectionConfiguration
        - name: ImportComputerGroup
          value: ImportComputerGroup
          description: ImportComputerGroup
        - name: NetworkMonitoring
          value: NetworkMonitoring
          description: NetworkMonitoring
        - name: Itsm
          value: Itsm
          description: Itsm
        - name: DnsAnalytics
          value: DnsAnalytics
          description: DnsAnalytics
        - name: ApplicationInsights
          value: ApplicationInsights
          description: ApplicationInsights
        - name: SqlDataClassification
          value: SqlDataClassification
          description: SqlDataClassification
  parameters:
    ApiVersionParameter:
      name: api-version
      in: query
      description: The API version to use for this operation.
      required: true
      schema:
        type: string
        minLength: 1
    ResourceGroupNameParameter:
      name: resourceGroupName
      in: path
      description: The name of the resource group. The name is case insensitive.
      required: true
      x-ms-parameter-location: method
      schema:
        type: string
        maxLength: 90
        minLength: 1
    SubscriptionIdParameter:
      name: subscriptionId
      in: path
      description: The ID of the target subscription. The value must be an UUID.
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.