The ContentTemplates API from Microsoft Sentinel — 2 operation(s) for contenttemplates.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/microsoft-sentinel:microsoft-sentinel-contenttemplates-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Microsoft Sentinel Content Templates API
version: '2025-09-01'
x-typespec-generated:
- emitter: '@azure-tools/typespec-autorest'
description: 'Operations tagged ContentTemplates across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
- user_impersonation
tags:
- name: ContentTemplates
paths:
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates
: get:
operationId: ContentTemplates_List
tags:
- ContentTemplates
description: 'Gets all installed templates.
Expandable properties:
- properties/mainTemplate
- properties/dependantTemplates'
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: $filter
in: query
description: Filters the results, based on a Boolean condition. Optional.
required: false
schema:
type: string
- name: $orderby
in: query
description: Sorts the results. Optional.
required: false
schema:
type: string
- name: $expand
in: query
description: Expands the object with optional fiends that are not included by default. Optional.
required: false
schema:
type: string
- name: $search
in: query
description: Searches for a substring in the response. Optional.
required: false
schema:
type: string
- name: $count
in: query
description: Instructs the server to return only object count without actual body. Optional.
required: false
schema:
type: boolean
- name: $top
in: query
description: Returns only the first n results. Optional.
required: false
schema:
type: integer
format: int32
- name: $skip
in: query
description: Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
required: false
schema:
type: integer
format: int32
- name: $skipToken
in: query
description: Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
required: false
schema:
type: string
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/templateList'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get all installed templates.:
$ref: ./examples/contentTemplates/GetTemplates.json
x-ms-pageable:
nextLinkName: nextLink
summary: Content templates list
x-summary-source: derived
servers:
- url: https://management.azure.com
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/contentTemplates/{templateId}
: get:
operationId: ContentTemplate_Get
tags:
- ContentTemplates
description: 'Gets a template byt its identifier.
Expandable properties:
- properties/mainTemplate
- properties/dependantTemplates'
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: templateId
in: path
description: template Id
required: true
schema:
type: string
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/templateModel'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get a template.:
$ref: ./examples/contentTemplates/GetTemplateById.json
summary: Content template get
x-summary-source: derived
put:
operationId: ContentTemplate_Install
tags:
- ContentTemplates
description: Install a template.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: templateId
in: path
description: template Id
required: true
schema:
type: string
responses:
'200':
description: Resource 'TemplateModel' update operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/templateModel'
'201':
description: Resource 'TemplateModel' create operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/templateModel'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get a template.:
$ref: ./examples/contentTemplates/InstallTemplate.json
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/templateModel'
description: Template installation properties
required: true
summary: Content template install
x-summary-source: derived
delete:
operationId: ContentTemplate_Delete
tags:
- ContentTemplates
description: Delete an installed template.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: templateId
in: path
description: template Id
required: true
schema:
type: string
responses:
'200':
description: Resource deleted successfully.
'204':
description: Resource does not exist.
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Delete metadata.:
$ref: ./examples/contentTemplates/DeleteTemplate.json
summary: Content template delete
x-summary-source: derived
servers:
- url: https://management.azure.com
components:
schemas:
Flag:
type: string
description: The boolean value the metadata is for.
enum:
- 'true'
- 'false'
x-ms-enum:
name: Flag
modelAsString: true
values:
- name: 'true'
value: 'true'
description: 'true'
- name: 'false'
value: 'false'
description: 'false'
Kind:
type: string
description: The kind of content the metadata is for.
enum:
- DataConnector
- DataType
- Workbook
- WorkbookTemplate
- Playbook
- PlaybookTemplate
- AnalyticsRuleTemplate
- AnalyticsRule
- HuntingQuery
- InvestigationQuery
- Parser
- Watchlist
- WatchlistTemplate
- Solution
- AzureFunction
- LogicAppsCustomConnector
- AutomationRule
- ResourcesDataConnector
- Notebook
- Standalone
- SummaryRule
x-ms-enum:
name: Kind
modelAsString: true
values:
- name: DataConnector
value: DataConnector
description: DataConnector
- name: DataType
value: DataType
description: DataType
- name: Workbook
value: Workbook
description: Workbook
- name: WorkbookTemplate
value: WorkbookTemplate
description: WorkbookTemplate
- name: Playbook
value: Playbook
description: Playbook
- name: PlaybookTemplate
value: PlaybookTemplate
description: PlaybookTemplate
- name: AnalyticsRuleTemplate
value: AnalyticsRuleTemplate
description: AnalyticsRuleTemplate
- name: AnalyticsRule
value: AnalyticsRule
description: AnalyticsRule
- name: HuntingQuery
value: HuntingQuery
description: HuntingQuery
- name: InvestigationQuery
value: InvestigationQuery
description: InvestigationQuery
- name: Parser
value: Parser
description: Parser
- name: Watchlist
value: Watchlist
description: Watchlist
- name: WatchlistTemplate
value: WatchlistTemplate
description: WatchlistTemplate
- name: Solution
value: Solution
description: Solution
- name: AzureFunction
value: AzureFunction
description: AzureFunction
- name: LogicAppsCustomConnector
value: LogicAppsCustomConnector
description: LogicAppsCustomConnector
- name: AutomationRule
value: AutomationRule
description: AutomationRule
- name: ResourcesDataConnector
value: ResourcesDataConnector
description: ResourcesDataConnector
- name: Notebook
value: Notebook
description: Notebook
- name: Standalone
value: Standalone
description: Standalone
- name: SummaryRule
value: SummaryRule
description: SummaryRule
SourceKind:
type: string
description: Source type of the content
enum:
- LocalWorkspace
- Community
- Solution
- SourceRepository
x-ms-enum:
name: SourceKind
modelAsString: true
values:
- name: LocalWorkspace
value: LocalWorkspace
description: LocalWorkspace
- name: Community
value: Community
description: Community
- name: Solution
value: Solution
description: Solution
- name: SourceRepository
value: SourceRepository
description: SourceRepository
MetadataDependencyOperator:
type: string
description: Operator used for list of dependencies in criteria array.
enum:
- AND
- OR
x-ms-enum:
name: MetadataDependencyOperator
modelAsString: true
values:
- name: AND
value: AND
description: AND
- name: OR
value: OR
description: OR
CloudErrorBody:
type: object
description: Error details.
properties:
code:
type: string
description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
readOnly: true
message:
type: string
description: A message describing the error, intended to be suitable for display in a user interface.
readOnly: true
metadataCategories:
type: object
description: ies for the solution content item
properties:
domains:
type: array
description: domain for the solution content item
items:
type: string
verticals:
type: array
description: Industry verticals for the solution content item
items:
type: string
templateModel:
type: object
description: Template resource definition.
properties:
properties:
$ref: '#/components/schemas/templateProperties'
description: template properties
x-ms-client-flatten: true
etag:
type: string
description: Etag of the azure resource
allOf:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
metadataDependencies:
type: object
description: Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
properties:
contentId:
type: string
description: Id of the content item we depend on
kind:
$ref: '#/components/schemas/Kind'
description: Type of the content item we depend on
version:
type: string
description: Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
name:
type: string
description: Name of the content item
operator:
$ref: '#/components/schemas/MetadataDependencyOperator'
description: Operator used for list of dependencies in criteria array.
criteria:
type: array
description: This is the list of dependencies we must fulfill, according to the AND/OR operator
items:
$ref: '#/components/schemas/metadataDependencies'
x-ms-identifiers:
- contentId
metadataSupport:
type: object
description: Support information for the content item.
properties:
tier:
$ref: '#/components/schemas/SupportTier'
description: Type of support for content item
name:
type: string
description: Name of the support contact. Company or person.
email:
type: string
description: Email of support contact
link:
type: string
description: Link for support help, like to support page to open a ticket etc.
required:
- tier
SupportTier:
type: string
description: Type of support for content item
enum:
- Microsoft
- Partner
- Community
x-ms-enum:
name: SupportTier
modelAsString: true
values:
- name: Microsoft
value: Microsoft
description: Microsoft
- name: Partner
value: Partner
description: Partner
- name: Community
value: Community
description: Community
metadataAuthor:
type: object
description: Publisher or creator of the content item.
properties:
name:
type: string
description: Name of the author. Company or person.
email:
type: string
description: Email of author contact
link:
type: string
description: Link for author/vendor page
templateList:
type: object
description: List of all the template.
properties:
value:
type: array
description: The TemplateModel items on this page
items:
$ref: '#/components/schemas/templateModel'
nextLink:
type: string
format: uri
description: The link to the next page of items
readOnly: true
required:
- value
PackageKind:
type: string
description: The package kind
enum:
- Solution
- Standalone
x-ms-enum:
name: PackageKind
modelAsString: true
values:
- name: Solution
value: Solution
description: Solution
- name: Standalone
value: Standalone
description: Standalone
CloudError:
type: object
description: Error response structure.
properties:
error:
$ref: '#/components/schemas/CloudErrorBody'
description: Error data
metadataSource:
type: object
description: The original source of the content item, where it comes from.
properties:
kind:
$ref: '#/components/schemas/SourceKind'
description: Source type of the content
name:
type: string
description: Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId:
type: string
description: ID of the content source. The solution ID, workspace ID, etc
required:
- kind
templateProperties:
type: object
description: Template property bag.
properties:
contentId:
type: string
description: Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Dynamic for user-created. This is the resource name
contentProductId:
type: string
description: Unique ID for the content. It should be generated based on the contentId of the package, contentId of the template, contentKind of the template and the contentVersion of the template
packageVersion:
type: string
description: Version of the package. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
version:
type: string
description: Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM metadata best practices. Can also be any string, but then we cannot guarantee any version checks
displayName:
type: string
description: The display name of the template
contentKind:
$ref: '#/components/schemas/Kind'
description: The kind of content the template is for.
source:
$ref: '#/components/schemas/metadataSource'
description: Source of the content. This is where/how it was created.
author:
$ref: '#/components/schemas/metadataAuthor'
description: The creator of the content item.
support:
$ref: '#/components/schemas/metadataSupport'
description: Support information for the template - type, name, contact information
dependencies:
$ref: '#/components/schemas/metadataDependencies'
description: Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
categories:
$ref: '#/components/schemas/metadataCategories'
description: Categories for the item
providers:
type: array
description: Providers for the content item
items:
type: string
firstPublishDate:
type: string
format: date
description: first publish date content item
lastPublishDate:
type: string
format: date
description: last publish date for the content item
customVersion:
type: string
description: The custom version of the content. A optional free text
contentSchemaVersion:
type: string
description: Schema version of the content. Can be used to distinguish between different flow based on the schema version
icon:
type: string
description: the icon identifier. this id can later be fetched from the content metadata
threatAnalysisTactics:
type: array
description: the tactics the resource covers
items:
type: string
threatAnalysisTechniques:
type: array
description: the techniques the resource covers, these have to be aligned with the tactics being used
items:
type: string
previewImages:
type: array
description: preview image file names. These will be taken from the solution artifacts
items:
type: string
previewImagesDark:
type: array
description: preview image file names. These will be taken from the solution artifacts. used for dark theme support
items:
type: string
packageId:
type: string
description: the package Id contains this template
packageKind:
$ref: '#/components/schemas/PackageKind'
description: the packageKind of the package contains this template
packageName:
type: string
description: the name of the package contains this template
isDeprecated:
$ref: '#/components/schemas/Flag'
description: Flag indicates if this template is deprecated
readOnly: true
mainTemplate:
description: The JSON of the ARM template to deploy active content. Expandable.
dependantTemplates:
type: array
description: Dependant templates. Expandable.
items:
$ref: '#/components/schemas/templateProperties'
readOnly: true
x-ms-identifiers:
- contentId
securitySchemes:
azure_auth:
type: oauth2
flows:
implicit:
scopes:
user_impersonation: impersonate your user account
authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml