Microsoft Graph roleManagement.roleManagement API

openapi: 3.2.0
info:
  title: Microsoft Graph Admin Admin.admin Role Management.role Management API
  description: 'Microsoft Graph API for managing administrative resources in Microsoft Entra ID.

    This API enables administrators to manage Microsoft Edge browser settings, Internet Explorer mode configurations,

    site lists, shared browser sites, Microsoft 365 Apps installation options, people insights, service announcements,

    SharePoint settings, Copilot administration, directory administrative units, and admin consent policies.'
  version: 1.0.0
  contact:
    name: Microsoft Graph API Support
    url: https://developer.microsoft.com/graph
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph API v1.0 endpoint
tags:
- name: roleManagement.roleManagement
  x-ms-docs-toc-type: page
paths:
  /roleManagement:
    description: Provides operations to manage the roleManagement singleton.
    get:
      tags:
      - roleManagement.roleManagement
      summary: Microsoft Graph Get roleManagement
      operationId: roleManagement.roleManagement.GetRoleManagement
      parameters:
      - name: $select
        in: query
        description: Select properties to be returned
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      - name: $expand
        in: query
        description: Expand related entities
        style: form
        explode: false
        schema:
          uniqueItems: true
          type: array
          items:
            type: string
      responses:
        2XX:
          description: Retrieved entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.roleManagement'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
    patch:
      tags:
      - roleManagement.roleManagement
      summary: Microsoft Graph Update roleManagement
      operationId: roleManagement.roleManagement.UpdateRoleManagement
      requestBody:
        description: New property values
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/microsoft.graph.roleManagement'
        required: true
      responses:
        2XX:
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/microsoft.graph.roleManagement'
        4XX:
          $ref: '#/components/responses/error'
        5XX:
          $ref: '#/components/responses/error'
      x-ms-docs-operation-type: operation
components:
  schemas:
    microsoft.graph.unifiedRoleEligibilityScheduleRequest:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.request'
      - title: unifiedRoleEligibilityScheduleRequest
        required:
        - '@odata.type'
        type: object
        properties:
          action:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.unifiedRoleScheduleRequestActions'
            - type: object
              nullable: true
            description: 'Represents the type of operation on the role eligibility request. The possible values are: adminAssign, adminUpdate, adminRemove, selfActivate, selfDeactivate, adminExtend, adminRenew, selfExtend, selfRenew, unknownFutureValue. adminAssign: For administrators to assign eligible roles to principals.adminRemove: For administrators to remove eligible roles from principals. adminUpdate: For administrators to change existing role eligibilities.adminExtend: For administrators to extend expiring role eligibilities.adminRenew: For administrators to renew expired eligibilities.selfActivate: For users to activate their assignments.selfDeactivate: For users to deactivate their active assignments.selfExtend: For users to request to extend their expiring assignments.selfRenew: For users to request to renew their expired assignments.'
          appScopeId:
            type: string
            description: Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal is eligible to access. App scopes are scopes that are defined and understood by this application only. Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Supports $filter (eq, ne, and on null values).
            nullable: true
          directoryScopeId:
            type: string
            description: Identifier of the directory object representing the scope of the role eligibility. The scope of a role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use / for tenant-wide scope. Use appScopeId to limit the scope to an application only. Supports $filter (eq, ne, and on null values).
            nullable: true
          isValidationOnly:
            type: boolean
            description: Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.
            nullable: true
          justification:
            type: string
            description: A message provided by users and administrators when create they create the unifiedRoleEligibilityScheduleRequest object.
            nullable: true
          principalId:
            type: string
            description: Identifier of the principal that has been granted the role eligibility. Can be a user or a role-assignable group. You can grant only active assignments service principals.Supports $filter (eq, ne).
            nullable: true
          roleDefinitionId:
            type: string
            description: Identifier of the unifiedRoleDefinition object that is being assigned to the principal. Supports $filter (eq, ne).
            nullable: true
          scheduleInfo:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.requestSchedule'
            - type: object
              nullable: true
            description: The period of the role eligibility. Recurring schedules are currently unsupported.
          targetScheduleId:
            type: string
            description: Identifier of the schedule object that's linked to the eligibility request. Supports $filter (eq, ne).
            nullable: true
          ticketInfo:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.ticketInfo'
            - type: object
              nullable: true
            description: Ticket details linked to the role eligibility request including details of the ticket number and ticket system. Optional.
          appScope:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.appScope'
            - type: object
              nullable: true
            description: Read-only property with details of the app-specific scope when the role eligibility is scoped to an app. Nullable. Supports $expand.
            x-ms-navigationProperty: true
          directoryScope:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.directoryObject'
            - type: object
              nullable: true
            description: The directory object that is the scope of the role eligibility. Read-only. Supports $expand.
            x-ms-navigationProperty: true
          principal:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.directoryObject'
            - type: object
              nullable: true
            description: The principal that's getting a role eligibility through the request. Supports $expand.
            x-ms-navigationProperty: true
          roleDefinition:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.unifiedRoleDefinition'
            - type: object
              nullable: true
            description: Detailed information for the unifiedRoleDefinition object that is referenced through the roleDefinitionId property. Supports $expand.
            x-ms-navigationProperty: true
          targetSchedule:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.unifiedRoleEligibilitySchedule'
            - type: object
              nullable: true
            description: The schedule for a role eligibility that is referenced through the targetScheduleId property. Supports $expand.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.unifiedRoleEligibilityScheduleRequest'
    microsoft.graph.ODataErrors.ErrorDetails:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
          nullable: true
    microsoft.graph.appScope:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: appScope
        required:
        - '@odata.type'
        type: object
        properties:
          displayName:
            type: string
            description: Provides the display name of the app-specific resource represented by the app scope. Read-only.
            nullable: true
          type:
            type: string
            description: Describes the type of app-specific resource represented by the app scope. Read-only.
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.appScope'
    microsoft.graph.request:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: request
        required:
        - '@odata.type'
        type: object
        properties:
          approvalId:
            type: string
            description: The identifier of the approval of the request.
            nullable: true
          completedDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The request completion date time.
            format: date-time
            nullable: true
          createdBy:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.identitySet'
            - type: object
              nullable: true
            description: The principal that created the request.
          createdDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The request creation date time.
            format: date-time
            nullable: true
          customData:
            type: string
            description: Free text field to define any custom data for the request. Not used.
            nullable: true
          status:
            type: string
            description: 'The status of the request. Not nullable. The possible values are: Canceled, Denied, Failed, Granted, PendingAdminDecision, PendingApproval, PendingProvisioning, PendingScheduleCreation, Provisioned, Revoked, and ScheduleCreated. Not nullable.'
          '@odata.type':
            type: string
        discriminator:
          propertyName: '@odata.type'
          mapping:
            '#microsoft.graph.privilegedAccessScheduleRequest': '#/components/schemas/microsoft.graph.privilegedAccessScheduleRequest'
            '#microsoft.graph.privilegedAccessGroupAssignmentScheduleRequest': '#/components/schemas/microsoft.graph.privilegedAccessGroupAssignmentScheduleRequest'
            '#microsoft.graph.privilegedAccessGroupEligibilityScheduleRequest': '#/components/schemas/microsoft.graph.privilegedAccessGroupEligibilityScheduleRequest'
            '#microsoft.graph.unifiedRoleAssignmentScheduleRequest': '#/components/schemas/microsoft.graph.unifiedRoleAssignmentScheduleRequest'
            '#microsoft.graph.unifiedRoleEligibilityScheduleRequest': '#/components/schemas/microsoft.graph.unifiedRoleEligibilityScheduleRequest'
            '#microsoft.graph.userConsentRequest': '#/components/schemas/microsoft.graph.userConsentRequest'
    microsoft.graph.expirationPatternType:
      title: expirationPatternType
      enum:
      - notSpecified
      - noExpiration
      - afterDateTime
      - afterDuration
      type: string
    microsoft.graph.identity:
      title: identity
      required:
      - '@odata.type'
      type: object
      properties:
        displayName:
          type: string
          description: The display name of the identity.For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta.
          nullable: true
        id:
          type: string
          description: Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review.
          nullable: true
        '@odata.type':
          type: string
      discriminator:
        propertyName: '@odata.type'
        mapping:
          '#microsoft.graph.azureCommunicationServicesUserIdentity': '#/components/schemas/microsoft.graph.azureCommunicationServicesUserIdentity'
          '#microsoft.graph.communicationsApplicationIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationIdentity'
          '#microsoft.graph.communicationsApplicationInstanceIdentity': '#/components/schemas/microsoft.graph.communicationsApplicationInstanceIdentity'
          '#microsoft.graph.communicationsEncryptedIdentity': '#/components/schemas/microsoft.graph.communicationsEncryptedIdentity'
          '#microsoft.graph.communicationsGuestIdentity': '#/components/schemas/microsoft.graph.communicationsGuestIdentity'
          '#microsoft.graph.communicationsPhoneIdentity': '#/components/schemas/microsoft.graph.communicationsPhoneIdentity'
          '#microsoft.graph.communicationsUserIdentity': '#/components/schemas/microsoft.graph.communicationsUserIdentity'
          '#microsoft.graph.emailIdentity': '#/components/schemas/microsoft.graph.emailIdentity'
          '#microsoft.graph.initiator': '#/components/schemas/microsoft.graph.initiator'
          '#microsoft.graph.provisionedIdentity': '#/components/schemas/microsoft.graph.provisionedIdentity'
          '#microsoft.graph.provisioningServicePrincipal': '#/components/schemas/microsoft.graph.provisioningServicePrincipal'
          '#microsoft.graph.provisioningSystem': '#/components/schemas/microsoft.graph.provisioningSystem'
          '#microsoft.graph.servicePrincipalIdentity': '#/components/schemas/microsoft.graph.servicePrincipalIdentity'
          '#microsoft.graph.sharePointIdentity': '#/components/schemas/microsoft.graph.sharePointIdentity'
          '#microsoft.graph.teamworkApplicationIdentity': '#/components/schemas/microsoft.graph.teamworkApplicationIdentity'
          '#microsoft.graph.teamworkConversationIdentity': '#/components/schemas/microsoft.graph.teamworkConversationIdentity'
          '#microsoft.graph.teamworkTagIdentity': '#/components/schemas/microsoft.graph.teamworkTagIdentity'
          '#microsoft.graph.teamworkUserIdentity': '#/components/schemas/microsoft.graph.teamworkUserIdentity'
          '#microsoft.graph.userIdentity': '#/components/schemas/microsoft.graph.userIdentity'
          '#microsoft.graph.callRecords.userIdentity': '#/components/schemas/microsoft.graph.callRecords.userIdentity'
    microsoft.graph.roleManagement:
      title: roleManagement
      required:
      - '@odata.type'
      type: object
      properties:
        directory:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.rbacApplication'
          - type: object
            nullable: true
          x-ms-navigationProperty: true
        entitlementManagement:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.rbacApplication'
          - type: object
            nullable: true
          description: Container for roles and assignments for entitlement management resources.
          x-ms-navigationProperty: true
        '@odata.type':
          type: string
    microsoft.graph.unifiedRoleAssignmentScheduleInstance:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.unifiedRoleScheduleInstanceBase'
      - title: unifiedRoleAssignmentScheduleInstance
        required:
        - '@odata.type'
        type: object
        properties:
          assignmentType:
            type: string
            description: The type of the assignment that can either be Assigned or Activated. Supports $filter (eq, ne).
            nullable: true
          endDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: The end date of the schedule instance.
            format: date-time
            nullable: true
          memberType:
            type: string
            description: How the assignment is inherited. It can either be Inherited, Direct, or Group. It can further imply whether the unifiedRoleAssignmentSchedule can be managed by the caller. Supports $filter (eq, ne).
            nullable: true
          roleAssignmentOriginId:
            type: string
            description: The identifier of the role assignment in Microsoft Entra. Supports $filter (eq, ne).
            nullable: true
          roleAssignmentScheduleId:
            type: string
            description: The identifier of the unifiedRoleAssignmentSchedule object from which this instance was created. Supports $filter (eq, ne).
            nullable: true
          startDateTime:
            pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
            type: string
            description: When this instance starts.
            format: date-time
            nullable: true
          activatedUsing:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.unifiedRoleEligibilityScheduleInstance'
            - type: object
              nullable: true
            description: If the request is from an eligible administrator to activate a role, this parameter shows the related eligible assignment for that activation. Otherwise, it's null. Supports $expand and $select nested in $expand.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.unifiedRoleAssignmentScheduleInstance'
    microsoft.graph.recurrencePattern:
      title: recurrencePattern
      required:
      - '@odata.type'
      type: object
      properties:
        dayOfMonth:
          maximum: 2147483647
          minimum: -2147483648
          type: number
          description: The day of the month on which the event occurs. Required if type is absoluteMonthly or absoluteYearly.
          format: int32
        daysOfWeek:
          type: array
          items:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.dayOfWeek'
            - type: object
              nullable: true
          description: 'A collection of the days of the week on which the event occurs. The possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday. If type is relativeMonthly or relativeYearly, and daysOfWeek specifies more than one day, the event falls on the first day that satisfies the pattern.  Required if type is weekly, relativeMonthly, or relativeYearly.'
        firstDayOfWeek:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.dayOfWeek'
          - type: object
            nullable: true
          description: 'The first day of the week. The possible values are: sunday, monday, tuesday, wednesday, thursday, friday, saturday. Default is sunday. Required if type is weekly.'
        index:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.weekIndex'
          - type: object
            nullable: true
          description: 'Specifies on which instance of the allowed days specified in daysOfWeek the event occurs, counted from the first instance in the month. The possible values are: first, second, third, fourth, last. Default is first. Optional and used if type is relativeMonthly or relativeYearly.'
        interval:
          maximum: 2147483647
          minimum: -2147483648
          type: number
          description: The number of units between occurrences, where units can be in days, weeks, months, or years, depending on the type. Required.
          format: int32
        month:
          maximum: 2147483647
          minimum: -2147483648
          type: number
          description: The month in which the event occurs.  This is a number from 1 to 12.
          format: int32
        type:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.recurrencePatternType'
          - type: object
            nullable: true
          description: 'The recurrence pattern type: daily, weekly, absoluteMonthly, relativeMonthly, absoluteYearly, relativeYearly. Required. For more information, see values of type property.'
        '@odata.type':
          type: string
    microsoft.graph.requestSchedule:
      title: requestSchedule
      required:
      - '@odata.type'
      type: object
      properties:
        expiration:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.expirationPattern'
          - type: object
            nullable: true
          description: When the eligible or active assignment expires.
        recurrence:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.patternedRecurrence'
          - type: object
            nullable: true
          description: The frequency of the  eligible or active assignment. This property is currently unsupported in PIM.
        startDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: When the  eligible or active assignment becomes active.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.unifiedRoleScheduleInstanceBase:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: unifiedRoleScheduleInstanceBase
        required:
        - '@odata.type'
        type: object
        properties:
          appScopeId:
            type: string
            description: Identifier of the app-specific scope when the assignment or role eligibility is scoped to an app. The scope of an assignment or role eligibility determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units.
            nullable: true
          directoryScopeId:
            type: string
            description: Identifier of the directory object representing the scope of the assignment or role eligibility. The scope of an assignment or role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use / for tenant-wide scope. Use appScopeId to limit the scope to an application only.
            nullable: true
          principalId:
            type: string
            description: Identifier of the principal that has been granted the role assignment or that's eligible for a role.
            nullable: true
          roleDefinitionId:
            type: string
            description: Identifier of the unifiedRoleDefinition object that is being assigned to the principal or that the principal is eligible for.
            nullable: true
          appScope:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.appScope'
            - type: object
              nullable: true
            description: Read-only property with details of the app-specific scope when the assignment or role eligibility is scoped to an app. Nullable.
            x-ms-navigationProperty: true
          directoryScope:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.directoryObject'
            - type: object
              nullable: true
            description: The directory object that is the scope of the assignment or role eligibility. Read-only.
            x-ms-navigationProperty: true
          principal:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.directoryObject'
            - type: object
              nullable: true
            description: The principal that's getting a role assignment or role eligibility through the request.
            x-ms-navigationProperty: true
          roleDefinition:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.unifiedRoleDefinition'
            - type: object
              nullable: true
            description: Detailed information for the roleDefinition object that is referenced through the roleDefinitionId property.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
        discriminator:
          propertyName: '@odata.type'
          mapping:
            '#microsoft.graph.unifiedRoleAssignmentScheduleInstance': '#/components/schemas/microsoft.graph.unifiedRoleAssignmentScheduleInstance'
            '#microsoft.graph.unifiedRoleEligibilityScheduleInstance': '#/components/schemas/microsoft.graph.unifiedRoleEligibilityScheduleInstance'
    microsoft.graph.ODataErrors.InnerError:
      title: InnerError
      required:
      - '@odata.type'
      type: object
      properties:
        request-id:
          type: string
          description: Request Id as tracked internally by the service
          nullable: true
        client-request-id:
          type: string
          description: Client request Id as sent by the client application.
          nullable: true
        date:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Date when the error occured.
          format: date-time
          nullable: true
        '@odata.type':
          type: string
    microsoft.graph.unifiedRoleAssignmentSchedule:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.unifiedRoleScheduleBase'
      - title: unifiedRoleAssignmentSchedule
        required:
        - '@odata.type'
        type: object
        properties:
          assignmentType:
            type: string
            description: The type of the assignment that can either be Assigned or Activated. Supports $filter (eq, ne).
            nullable: true
          memberType:
            type: string
            description: How the assignment is inherited. It can either be Inherited, Direct, or Group. It can further imply whether the unifiedRoleAssignmentSchedule can be managed by the caller. Supports $filter (eq, ne).
            nullable: true
          scheduleInfo:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.requestSchedule'
            - type: object
              nullable: true
            description: The period of the role assignment. It can represent a single occurrence or multiple recurrences.
          activatedUsing:
            anyOf:
            - $ref: '#/components/schemas/microsoft.graph.unifiedRoleEligibilitySchedule'
            - type: object
              nullable: true
            description: If the request is from an eligible administrator to activate a role, this parameter shows the related eligible assignment for that activation. Otherwise, it's null. Supports $expand.
            x-ms-navigationProperty: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.unifiedRoleAssignmentSchedule'
    microsoft.graph.expirationPattern:
      title: expirationPattern
      required:
      - '@odata.type'
      type: object
      properties:
        duration:
          pattern: ^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$
          type: string
          description: The requestor's desired duration of access represented in ISO 8601 format for durations. For example, PT3H refers to three hours.  If specified in a request, endDateTime should not be present and the type property should be set to afterDuration.
          format: duration
          nullable: true
        endDateTime:
          pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$
          type: string
          description: Timestamp of date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
          format: date-time
          nullable: true
        type:
          anyOf:
          - $ref: '#/components/schemas/microsoft.graph.expirationPatternType'
          - type: object
            nullable: true
          description: 'The requestor''s desired expiration pattern type. The possible values are: notSpecified, noExpiration, afterDateTime, afterDuration.'
        '@odata.type':
          type: string
    microsoft.graph.unifiedRbacResourceAction:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: unifiedRbacResourceAction
        required:
        - '@odata.type'
        type: object
        properties:
          actionVerb:
            type: string
            nullable: true
          authenticationContextId:
            type: string
            nullable: true
          description:
            type: string
            nullable: true
          isAuthenticationContextSettable:
            type: boolean
            nullable: true
          name:
            type: string
          resourceScopeId:
            type: string
            nullable: true
          '@odata.type':
            type: string
      x-ms-discriminator-value: '#microsoft.graph.unifiedRbacResourceAction'
    microsoft.graph.unifiedRoleAssignment:
      allOf:
      - $ref: '#/components/schemas/microsoft.graph.entity'
      - title: unifiedRoleAssignment
        required:
        - '@odata.type'
        type: object
        properties:
          appScopeId:
            type: string
            description: Identifier of the app specific scope when the assignment scope is app specific. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by a resource application only. For the entitlement management provider, use this property to specify a catalog. For example, /AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997. Supports $filter (eq, in). For example, /roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/{catalog id}'.
            nullable: true
          condition:
            type: string
            nullable: true
          directoryScopeId:
            type: string
            description: Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications, unlike app scopes that are defined and understood by a resource application only. Supports $filter (eq, in).
            

# --- truncated at 32 KB (186 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/openapi/microsoft-graph-rolemanagement-rolemanagement-api-openapi.yml