Microsoft Azure ServicePrincipal API

swagger: '2.0'
info:
  version: 2020-08-01-preview
  title: Microsoft Azure AccessControlClient AccessConnector ServicePrincipal API
schemes:
- https
tags:
- name: ServicePrincipal
paths:
  /{tenantID}/servicePrincipals:
    post:
      tags:
      - ServicePrincipal
      operationId: microsoftAzureServiceprincipalsCreate
      description: Creates a service principal in the directory.
      parameters:
      - name: parameters
        in: body
        required: true
        schema:
          $ref: '#/definitions/ServicePrincipalCreateParameters'
        description: Parameters to create a service principal.
      - $ref: '#/parameters/ApiVersionParameter'
      - $ref: '#/parameters/tenantIDInPath'
      responses:
        '201':
          description: The service principal was created successfully.
          schema:
            $ref: '#/definitions/ServicePrincipal'
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: '#/definitions/GraphError'
      summary: Microsoft Azure Post Tenantid Serviceprincipals
    get:
      tags:
      - ServicePrincipal
      operationId: microsoftAzureServiceprincipalsList
      description: Gets a list of service principals from the current tenant.
      parameters:
      - name: $filter
        in: query
        required: false
        type: string
        description: The filter to apply to the operation.
      - $ref: '#/parameters/ApiVersionParameter'
      - $ref: '#/parameters/tenantIDInPath'
      responses:
        '200':
          description: OK. The operation was successful.
          schema:
            $ref: '#/definitions/ServicePrincipalListResult'
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: '#/definitions/GraphError'
      x-ms-pageable:
        nextLinkName: odata.nextLink
        operationName: ServicePrincipals_ListNext
      x-ms-odata: '#/definitions/ServicePrincipal'
      summary: Microsoft Azure Get Tenantid Serviceprincipals
  /{tenantID}/servicePrincipals/{objectId}:
    patch:
      tags:
      - ServicePrincipal
      operationId: microsoftAzureServiceprincipalsUpdate
      description: Updates a service principal in the directory.
      parameters:
      - name: objectId
        in: path
        required: true
        type: string
        description: The object ID of the service principal to delete.
      - name: parameters
        in: body
        required: true
        schema:
          $ref: '#/definitions/ServicePrincipalUpdateParameters'
        description: Parameters to update a service principal.
      - $ref: '#/parameters/ApiVersionParameter'
      - $ref: '#/parameters/tenantIDInPath'
      responses:
        '204':
          description: No Content
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: '#/definitions/GraphError'
      summary: Microsoft Azure Patch Tenantid Serviceprincipals Objectid
    delete:
      tags:
      - ServicePrincipal
      operationId: microsoftAzureServiceprincipalsDelete
      description: Deletes a service principal from the directory.
      parameters:
      - name: objectId
        in: path
        required: true
        type: string
        description: The object ID of the service principal to delete.
      - $ref: '#/parameters/ApiVersionParameter'
      - $ref: '#/parameters/tenantIDInPath'
      responses:
        '204':
          description: No Content
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: '#/definitions/GraphError'
      summary: Microsoft Azure Delete Tenantid Serviceprincipals Objectid
    get:
      tags:
      - ServicePrincipal
      operationId: microsoftAzureServiceprincipalsGet
      description: Gets service principal information from the directory. Query by objectId or pass a filter to query by appId
      parameters:
      - name: objectId
        in: path
        required: true
        type: string
        description: The object ID of the service principal to get.
      - $ref: '#/parameters/ApiVersionParameter'
      - $ref: '#/parameters/tenantIDInPath'
      responses:
        '200':
          description: OK. The operation was successful.
          schema:
            $ref: '#/definitions/ServicePrincipal'
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: '#/definitions/GraphError'
      summary: Microsoft Azure Get Tenantid Serviceprincipals Objectid
definitions:
  ErrorMessage:
    type: object
    properties:
      value:
        type: string
        x-ms-client-name: message
        description: Error message value.
    description: Active Directory error message.
  GraphError:
    type: object
    properties:
      odata.error:
        type: object
        x-ms-client-flatten: true
        $ref: '#/definitions/OdataError'
        description: A Graph API error.
    description: Active Directory error information.
  DirectoryObject:
    type: object
    discriminator: objectType
    properties:
      objectId:
        type: string
        description: The object ID.
        readOnly: true
      objectType:
        type: string
        description: The object type.
      deletionTimestamp:
        type: string
        format: date-time
        description: The time at which the directory object was deleted.
        readOnly: true
        x-nullable: true
    required:
    - objectType
    additionalProperties:
      type: object
    description: Represents an Azure Active Directory object.
  ServicePrincipalListResult:
    type: object
    properties:
      value:
        type: array
        items:
          $ref: '#/definitions/ServicePrincipal'
        description: the list of service principals.
      odata.nextLink:
        type: string
        description: the URL to get the next set of results.
    description: Server response for get tenant service principals API call.
  OAuth2Permission:
    type: object
    description: Represents an OAuth 2.0 delegated permission scope. The specified OAuth 2.0 delegated permission scopes may be requested by client applications (through the requiredResourceAccess collection on the Application object) when calling a resource application. The oauth2Permissions property of the ServicePrincipal entity and of the Application entity is a collection of OAuth2Permission.
    properties:
      adminConsentDescription:
        description: Permission help text that appears in the admin consent and app assignment experiences.
        type: string
      adminConsentDisplayName:
        description: Display name for the permission that appears in the admin consent and app assignment experiences.
        type: string
      id:
        description: Unique scope permission identifier inside the oauth2Permissions collection.
        type: string
      isEnabled:
        description: 'When creating or updating a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed. '
        type: boolean
      type:
        description: Specifies whether this scope permission can be consented to by an end user, or whether it is a tenant-wide permission that must be consented to by a Company Administrator. Possible values are "User" or "Admin".
        type: string
      userConsentDescription:
        description: Permission help text that appears in the end user consent experience.
        type: string
      userConsentDisplayName:
        description: Display name for the permission that appears in the end user consent experience.
        type: string
      value:
        description: The value of the scope claim that the resource application should expect in the OAuth 2.0 access token.
        type: string
  ServicePrincipal:
    type: object
    description: Active Directory service principal information.
    allOf:
    - $ref: '#/definitions/DirectoryObject'
    properties:
      accountEnabled:
        description: whether or not the service principal account is enabled
        type: boolean
      alternativeNames:
        description: alternative names
        type: array
        items:
          type: string
      appDisplayName:
        description: The display name exposed by the associated application.
        readOnly: true
        type: string
      appId:
        type: string
        description: The application ID.
      appOwnerTenantId:
        readOnly: true
        type: string
      appRoleAssignmentRequired:
        description: Specifies whether an AppRoleAssignment to a user or group is required before Azure AD will issue a user or access token to the application.
        type: boolean
      appRoles:
        type: array
        items:
          $ref: '#/definitions/AppRole'
        description: The collection of application roles that an application may declare. These roles can be assigned to users, groups or service principals.
      displayName:
        type: string
        description: The display name of the service principal.
      errorUrl:
        type: string
        description: A URL provided by the author of the associated application to report errors when using the application.
      homepage:
        description: The URL to the homepage of the associated application.
        type: string
      keyCredentials:
        description: The collection of key credentials associated with the service principal.
        type: array
        items:
          $ref: '#/definitions/KeyCredential'
      logoutUrl:
        type: string
        description: A URL provided by the author of the associated application to logout
      oauth2Permissions:
        description: The OAuth 2.0 permissions exposed by the associated application.
        readOnly: true
        type: array
        items:
          $ref: '#/definitions/OAuth2Permission'
      passwordCredentials:
        description: The collection of password credentials associated with the service principal.
        type: array
        items:
          $ref: '#/definitions/PasswordCredential'
      preferredTokenSigningKeyThumbprint:
        description: The thumbprint of preferred certificate to sign the token
        type: string
      publisherName:
        description: The publisher's name of the associated application
        type: string
      replyUrls:
        description: The URLs that user tokens are sent to for sign in with the associated application.  The redirect URIs that the oAuth 2.0 authorization code and access tokens are sent to for the associated application.
        type: array
        items:
          type: string
      samlMetadataUrl:
        type: string
        description: The URL to the SAML metadata of the associated application
      servicePrincipalNames:
        type: array
        items:
          type: string
        description: A collection of service principal names.
      servicePrincipalType:
        type: string
        description: the type of the service principal
      tags:
        description: Optional list of tags that you can apply to your service principals. Not nullable.
        type: array
        items:
          type: string
  AppRole:
    type: object
    properties:
      id:
        type: string
        description: Unique role identifier inside the appRoles collection.
      allowedMemberTypes:
        type: array
        items:
          type: string
        description: 'Specifies whether this app role definition can be assigned to users and groups by setting to ''User'', or to other applications (that are accessing this application in daemon service scenarios) by setting to ''Application'', or to both. '
      description:
        type: string
        description: Permission help text that appears in the admin app assignment and consent experiences.
      displayName:
        type: string
        description: Display name for the permission that appears in the admin consent and app assignment experiences.
      isEnabled:
        type: boolean
        description: When creating or updating a role definition, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.
      value:
        type: string
        description: Specifies the value of the roles claim that the application should expect in the authentication and access tokens.
  PasswordCredential:
    type: object
    properties:
      startDate:
        type: string
        format: date-time
        description: Start date.
      endDate:
        type: string
        format: date-time
        description: End date.
      keyId:
        type: string
        description: Key ID.
      value:
        type: string
        description: Key value.
      customKeyIdentifier:
        type: string
        format: byte
        description: Custom Key Identifier
    additionalProperties:
      type: object
    description: Active Directory Password Credential information.
  ServicePrincipalCreateParameters:
    type: object
    allOf:
    - $ref: '#/definitions/ServicePrincipalBase'
    properties:
      appId:
        type: string
        description: The application ID.
    required:
    - appId
    description: Request parameters for creating a new service principal.
  KeyCredential:
    type: object
    properties:
      startDate:
        type: string
        format: date-time
        description: Start date.
      endDate:
        type: string
        format: date-time
        description: End date.
      value:
        type: string
        description: Key value.
      keyId:
        type: string
        description: Key ID.
      usage:
        type: string
        description: Usage. Acceptable values are 'Verify' and 'Sign'.
      type:
        type: string
        description: Type. Acceptable values are 'AsymmetricX509Cert' and 'Symmetric'.
      customKeyIdentifier:
        type: string
        description: Custom Key Identifier
    additionalProperties:
      type: object
    description: Active Directory Key Credential information.
  ServicePrincipalBase:
    type: object
    description: Active Directory service principal common properties shared among GET, POST and PATCH
    properties:
      accountEnabled:
        description: whether or not the service principal account is enabled
        type: boolean
      appRoleAssignmentRequired:
        description: Specifies whether an AppRoleAssignment to a user or group is required before Azure AD will issue a user or access token to the application.
        type: boolean
      keyCredentials:
        description: The collection of key credentials associated with the service principal.
        type: array
        items:
          $ref: '#/definitions/KeyCredential'
      passwordCredentials:
        description: The collection of password credentials associated with the service principal.
        type: array
        items:
          $ref: '#/definitions/PasswordCredential'
      servicePrincipalType:
        type: string
        description: the type of the service principal
      tags:
        description: Optional list of tags that you can apply to your service principals. Not nullable.
        type: array
        items:
          type: string
  OdataError:
    type: object
    properties:
      code:
        type: string
        description: Error code.
      message:
        type: object
        x-ms-client-flatten: true
        $ref: '#/definitions/ErrorMessage'
        description: Error Message.
    description: Active Directory OData error information.
  ServicePrincipalUpdateParameters:
    type: object
    allOf:
    - $ref: '#/definitions/ServicePrincipalBase'
    description: Request parameters for update an existing service principal.
parameters:
  ApiVersionParameter:
    name: api-version
    in: query
    required: true
    type: string
    description: Client API version.
  tenantIDInPath:
    name: tenantID
    in: path
    required: true
    type: string
    description: The tenant ID.
    x-ms-parameter-location: client
x-ms-parameterized-host:
  hostTemplate: '{endpoint}'
  useSchemePrefix: false
  parameters:
  - $ref: '#/parameters/Endpoint'