Microsoft Fabric SQL Audit Settings API
The SQLAuditSettings API from Microsoft Fabric — 5 operation(s) for sqlauditsettings.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/microsoft-fabric:microsoft-fabric-sqlauditsettings-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Microsoft Fabric Workload Items REST SQL Audit Settings API
version: v1
x-source: 'https://github.com/microsoft/fabric-rest-api-specs (bundled from openapi/_original/fabric-rest-api-specs: anomalyDetector/swagger.json, apacheAirflowJob/swagger.json, appBackend/swagger.json, azureDatabricksStorage/swagger.json, copyJob/swagger.json, cosmosDbDatabase/swagger.json, dashboard/swagger.json, dataAgent/swagger.json, dataBuildToolJob/swagger.json, dataPipeline/swagger.json, dataflow/swagger.json, datamart/swagger.json, deploymentPlan/swagger.json, digitalTwinBuilder/swagger.json, digitalTwinBuilderFlow/swagger.json, environment/swagger.json, eventSchemaSet/swagger.json, eventhouse/swagger.json, eventstream/swagger.json, graphModel/swagger.json, graphQLApi/swagger.json, graphQuerySet/swagger.json, kqlDashboard/swagger.json, kqlDatabase/swagger.json, kqlQueryset/swagger.json, lakehouse/swagger.json, map/swagger.json, mirroredAzureDatabricksCatalog/swagger.json, mirroredCatalog/swagger.json, mirroredDatabase/swagger.json, mirroredWarehouse/swagger.json, mlExperiment/swagger.json, mlModel/swagger.json, monitoring/swagger.json, mountedDataFactory/swagger.json, notebook/swagger.json, ontology/swagger.json, operationsAgent/swagger.json, orgApp/swagger.json, orgAppAudience/swagger.json, paginatedReport/swagger.json, plan/swagger.json, policySet/swagger.json, realTimeIntelligence/swagger.json, reflex/swagger.json, report/swagger.json, semanticModel/swagger.json, snowflakeDatabase/swagger.json, spark/swagger.json, sparkjobdefinition/swagger.json, sqlDatabase/swagger.json, sqlEndpoint/swagger.json, userDataFunction/swagger.json, variableLibrary/swagger.json, warehouse/swagger.json)'
servers:
- url: https://api.fabric.microsoft.com/v1
security: []
tags:
- name: SQLAuditSettings
paths:
/workspaces/{workspaceId}/sqlDatabases/{sqlDatabaseId}/settings/sqlAudit:
get:
tags:
- SQLAuditSettings
operationId: SQLAuditSettings_GetSQLAuditSettings
summary: Gets the auditing settings on the specified SQL database
description: '## Permissions
The caller must have reader or higher item permission.
## Required Delegated Scopes
SQLDatabase.Read.All or SQLDatabase.ReadWrite.All or Item.Read.All or Item.ReadWrite.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
parameters:
- in: path
name: workspaceId
description: The workspace identifier.
required: true
schema:
type: string
format: uuid
- in: path
name: sqlDatabaseId
description: The SQL database ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SqlDatabaseAuditSettings'
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
patch:
tags:
- SQLAuditSettings
operationId: SQLAuditSettings_UpdateSQLAuditSettings
summary: Updates the auditing settings on the specified SQL database
description: '## Permissions
The caller must have *read and write* permissions for the SQL database.
## Required Delegated Scopes
SQLDatabase.ReadWrite.All or Item.ReadWrite.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
parameters:
- in: path
name: workspaceId
description: The workspace identifier.
required: true
schema:
type: string
format: uuid
- in: path
name: sqlDatabaseId
description: The SQL database ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SqlDatabaseAuditSettings'
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SqlDatabaseAuditSettingsUpdate'
description: Update SQL audit settings request payload.
/workspaces/{workspaceId}/sqlEndpoints/{itemId}/settings/sqlAudit:
patch:
summary: Update settings associated with the SQL endpoint
description: '## Permissions
The caller must have *audit* item permission.
## Required Delegated Scopes
Item.Audit.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
tags:
- SQLAuditSettings
operationId: sqlEndpoint_SQLAuditSettings_UpdateSQLAuditSettings
parameters:
- in: path
name: workspaceId
description: The workspace ID.
required: true
schema:
type: string
format: uuid
- in: path
name: itemId
description: The item ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SqlAuditSettings'
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-original-operationId: SQLAuditSettings_UpdateSQLAuditSettings
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SqlAuditSettingsUpdate'
description: Update SQL audit settings request payload.
get:
summary: Returns the settings associated with the SQL endpoint
description: '## Permissions
The caller must have *reader* or higher item permission.
## Required Delegated Scopes
SQLEndpoint.Read.All or SQLEndpoint.ReadWrite.All or Item.Read.All or Item.ReadWrite.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
tags:
- SQLAuditSettings
operationId: sqlEndpoint_SQLAuditSettings_GetSQLAuditSettings
parameters:
- in: path
name: workspaceId
description: The workspace ID.
required: true
schema:
type: string
format: uuid
- in: path
name: itemId
description: The item ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SqlAuditSettings'
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-original-operationId: SQLAuditSettings_GetSQLAuditSettings
/workspaces/{workspaceId}/sqlEndpoints/{itemId}/settings/sqlAudit/setAuditActionsAndGroups:
post:
summary: Update the audit actions and groups for this SQL endpoint
description: '## Permissions
The caller must have *audit* item permission.
## Required Delegated Scopes
Item.Audit.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
tags:
- SQLAuditSettings
operationId: SQLAuditSettings_SetAuditActionsAndGroups
parameters:
- in: path
name: workspaceId
description: The workspace ID.
required: true
schema:
type: string
format: uuid
- in: path
name: itemId
description: The item ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
requestBody:
content:
application/json:
schema:
type: array
items:
type: string
example:
- SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP
- FAILED_DATABASE_AUTHENTICATION_GROUP
- BATCH_COMPLETED_GROUP
description: Set audit actions and groups request payload.
required: true
/workspaces/{workspaceId}/warehouses/{itemId}/settings/sqlAudit:
patch:
summary: Update settings associated with the warehouse
description: '## Permissions
The caller must have *audit* item permission.
## Required Delegated Scopes
Item.Audit.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
tags:
- SQLAuditSettings
operationId: warehouse_SQLAuditSettings_UpdateSQLAuditSettings
parameters:
- in: path
name: workspaceId
description: The workspace ID.
required: true
schema:
type: string
format: uuid
- in: path
name: itemId
description: The item ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SqlAuditSettings'
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-original-operationId: SQLAuditSettings_UpdateSQLAuditSettings
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/SqlAuditSettingsUpdate'
description: Update SQL audit settings request payload.
required: true
get:
summary: Returns the settings associated with the warehouse
description: '## Permissions
The caller must have *reader* or higher item permission.
## Required Delegated Scopes
Warehouse.Read.All or Warehouse.ReadWrite.All or Item.Read.All or Item.ReadWrite.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
tags:
- SQLAuditSettings
operationId: warehouse_SQLAuditSettings_GetSQLAuditSettings
parameters:
- in: path
name: workspaceId
description: The workspace ID.
required: true
schema:
type: string
format: uuid
- in: path
name: itemId
description: The item ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SqlAuditSettings'
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-original-operationId: SQLAuditSettings_GetSQLAuditSettings
/workspaces/{workspaceId}/warehouses/{itemId}/settings/sqlAudit/setAuditActionsAndGroups:
post:
summary: Update the audit actions and groups for this warehouse
description: '## Permissions
The caller must have *audit* item permission.
## Required Delegated Scopes
Item.Audit.All
## Microsoft Entra supported identities
This API supports the Microsoft identities listed in this section.
| Identity | Support |
|-|-|
| User | Yes |
| Service principal and Managed identities | Yes |
## Interface'
tags:
- SQLAuditSettings
operationId: warehouse_SQLAuditSettings_SetAuditActionsAndGroups
parameters:
- in: path
name: workspaceId
description: The workspace ID.
required: true
schema:
type: string
format: uuid
- in: path
name: itemId
description: The item ID.
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Request completed successfully.
'429':
description: The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests.
x-ms-error-response: true
headers:
Retry-After:
description: The number of seconds to wait before retrying the request.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
default:
description: 'Common error codes:
* ItemNotFound - The requested item was not found.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
x-original-operationId: SQLAuditSettings_SetAuditActionsAndGroups
requestBody:
content:
application/json:
schema:
type: array
items:
type: string
example:
- SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP
- FAILED_DATABASE_AUTHENTICATION_GROUP
- BATCH_COMPLETED_GROUP
description: Set audit actions and groups request payload.
required: true
components:
schemas:
ErrorResponse:
description: The error response.
required:
- message
- errorCode
allOf:
- $ref: '#/components/schemas/ErrorResponseDetails'
properties:
requestId:
type: string
format: uuid
description: ID of the request associated with the error.
readOnly: true
moreDetails:
description: List of additional error details.
type: array
items:
$ref: '#/components/schemas/ErrorResponseDetails'
readOnly: true
isRetriable:
type: boolean
description: When true, the request can be retried. Use the `Retry-After` response header to determine the delay, if available.
readOnly: true
ErrorParameter:
description: A structured parameter providing additional machine-readable context about an error.
type: object
properties:
name:
type: string
description: The parameter identifier.
readOnly: true
value:
type: string
description: The parameter value.
readOnly: true
message:
type: string
description: A human-readable description of the parameter's meaning.
readOnly: true
SqlAuditSettingsUpdate:
type: object
description: Audit settings update request.
properties:
state:
$ref: '#/components/schemas/AuditSettingsState'
retentionDays:
description: Retention days.
type: integer
default: 0
predicateExpression:
description: "The predicate expression that determines whether an audit event is processed. Specify only the `<predicate_expression>` value; don't include the `WHERE` keyword. The expression uses the following syntax from [CREATE SERVER AUDIT (Transact-SQL)](https://learn.microsoft.com/sql/t-sql/statements/create-server-audit-transact-sql?view=sql-server-ver17):\n\n```syntaxsql\n<predicate_expression> ::=\n { [ NOT ] <predicate_factor>\n [ { AND | OR } [ NOT ] { <predicate_factor> } ] [ ,... n ] }\n\n<predicate_factor> ::=\n event_field_name { = | < > | != | > | >= | < | <= | LIKE }\n { number | 'string' }\n```\n\nEvent field names correspond to the audit record columns documented in [sys.fn_get_audit_file (Transact-SQL)](https://learn.microsoft.com/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql?view=sql-server-ver17&tabs=sqlserver). All documented fields can be used except `file_name`, `audit_file_offset`, and `event_time`. Although `action_id` and `class_type` are returned as strings, they can only be compared with numeric values in a predicate. String comparisons don't perform implicit type conversion. The maximum expression length is 3,000 characters. When SQL auditing is enabled for the first time, omitting this property applies no predicate. On subsequent updates, omitting this property leaves the existing predicate unchanged. Specify an empty string to remove the existing predicate."
type: string
maxLength: 3000
readOnly: false
SqlDatabaseAuditSettings:
type: object
description: The current state of audit settings for a database.
required:
- state
- retentionDays
- auditActionsAndGroups
- storageEndpoint
- predicateExpression
properties:
state:
$ref: '#/components/schemas/SqlAuditSettingsState'
retentionDays:
description: Retention days. 0 indicates indefinite retention period.
type: integer
default: 0
auditActionsAndGroups:
description: Audit actions and groups.
type: array
items:
type: string
default:
- BATCH_COMPLETED_GROUP
- FAILED_DATABASE_AUTHENTICATION_GROUP
- SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP
storageEndpoint:
description: The storage endpoint where audit logs are stored.
type: string
predicateExpression:
description: The predicate expression used to filter audit logs.
type: string
SqlAuditSettingsState:
description: Sql Audit settings state. When enabling the audit policy for the first time after database creation (by setting state to 'Enabled' without other properties), default values are applied. For all subsequent enable/disable operations, the previous policy settings are preserved. Additional SqlAuditSettingsState may be added over time.
type: string
enum:
- Enabled
- Disabled
x-ms-enum:
name: SqlAuditSettingsState
modelAsString: true
values:
- value: Enabled
description: Enable the SQL audit.
- value: Disabled
description: Disable the SQL audit.
ErrorResponseDetails:
description: The error response details.
type: object
required:
- message
- errorCode
properties:
errorCode:
type: string
description: A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
readOnly: true
message:
type: string
description: A human readable representation of the error.
readOnly: true
relatedResource:
$ref: '#/components/schemas/ErrorRelatedResource'
parameters:
description: Structured parameters providing additional machine-readable context about the error.
type: array
items:
$ref: '#/components/schemas/ErrorParameter'
readOnly: true
ErrorRelatedResource:
description: The error related resource details object.
type: object
required:
- resourceId
- resourceType
properties:
resourceId:
type: string
description: The resource ID that's involved in the error.
readOnly: true
resourceType:
type: string
description: The type of the resource that's involved in the error.
readOnly: true
AuditSettingsState:
description: Audit settings state. Additional AuditSettingsState may be added over time.
type: string
enum:
- Enabled
- Disabled
x-ms-enum:
name: AuditSettingsState
modelAsString: true
values:
- value: Enabled
description: Enable the SQL audit.
- value: Disabled
description: Disable the SQL audit.
SqlDatabaseAuditSettingsUpdate:
type: object
description: Database audit settings update request.
properties:
state:
$ref: '#/components/schemas/SqlAuditSettingsState'
retentionDays:
description: Retention days. For the first time, when state is set to Enabled and this property is not provided, retentionDays will be set to 0 (indefinite retention period) by default.
type: integer
auditActionsAndGroups:
description: Audit actions and groups. For the first time, when state is set to Enabled and this property is not provided, default audit actions and groups will be applied.
type: array
items:
type: string
predicateExpression:
description: The predicate expression used to filter audit logs. For the first time, when state is set to Enabled and this property is not provided, no predicate expression will be applied by default.
type: string
SqlAuditSettings:
type: object
description: The current state of audit settings for an item.
required:
- state
- retentionDays
- auditActionsAndGroups
properties:
state:
$ref: '#/components/schemas/AuditSettingsState'
retentionDays:
description: Retention days. 0 indicates indefinite retention period.
type: integer
auditActionsAndGroups:
description: Audit actions and groups.
type: array
items:
type: string
predicateExpression:
description: "The predicate expression that determines whether an audit event is processed. Specify only the `<predicate_expression>` value; don't include the `WHERE` keyword. The expression uses the following syntax from [CREATE SERVER AUDIT (Transact-SQL)](https://learn.microsoft.com/sql/t-sql/statements/create-server-audit-transact-sql?view=sql-server-ver17):\n\n```syntaxsql\n<predicate_expression> ::=\n { [ NOT ] <predicate_factor>\n [ { AND | OR } [ NOT ] { <predicate_factor> } ] [ ,... n ] }\n\n<predicate_factor> ::=\n event_field_name { = | < > | != | > | >= | < | <= | LIKE }\n { number | 'string' }\n```\n\nEvent field names correspond to the audit record columns documented in [sys.fn_get_audit_file (Transact-SQL)](https://learn.microsoft.com/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql?view=sql-server-ver17&tabs=sqlserver). All documented fields can be used except `file_name`, `audit_file_offset`, and `event_time`. Although `action_id` and `class_type` are returned as strings, they can only be compared with numeric values in a predicate. String comparisons don't perform implicit type conversion. The maximum expression length is 3,000 characters. An empty string means that no predicate is applied."
type: string
maxLength: 3000
readOnly: true