The IncidentBookmarks API from Microsoft Sentinel — 1 operation(s) for incidentbookmarks.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/microsoft-sentinel:microsoft-sentinel-incidentbookmarks-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Microsoft Sentinel Incident Bookmarks API
version: '2025-09-01'
x-typespec-generated:
- emitter: '@azure-tools/typespec-autorest'
description: 'Operations tagged IncidentBookmarks across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
- user_impersonation
tags:
- name: IncidentBookmarks
paths:
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/bookmarks
: post:
operationId: Incidents_ListBookmarks
tags:
- IncidentBookmarks
description: Gets all bookmarks for an incident.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: incidentId
in: path
description: Incident ID
required: true
schema:
type: string
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentBookmarkList'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get all incident bookmarks.:
$ref: ./examples/incidents/GetAllIncidentBookmarks.json
summary: Incidents list bookmarks
x-summary-source: derived
servers:
- url: https://management.azure.com
components:
schemas:
Azure.Core.uuid:
type: string
format: uuid
description: Universally Unique Identifier
EntityCommonProperties:
type: object
description: Entity common property bag.
properties:
additionalData:
type: object
description: A bag of custom fields that should be part of the entity and will be presented to the user.
additionalProperties: {}
readOnly: true
friendlyName:
type: string
description: The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.
readOnly: true
IncidentInfo:
type: object
description: Describes related incident information for the bookmark
properties:
incidentId:
type: string
description: Incident Id
severity:
$ref: '#/components/schemas/IncidentSeverity'
description: The severity of the incident
title:
type: string
description: The title of the incident
relationName:
type: string
description: Relation Name
CloudErrorBody:
type: object
description: Error details.
properties:
code:
type: string
description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
readOnly: true
message:
type: string
description: A message describing the error, intended to be suitable for display in a user interface.
readOnly: true
HuntingBookmark:
type: object
description: Represents a Hunting bookmark entity.
properties:
properties:
$ref: '#/components/schemas/HuntingBookmarkProperties'
description: HuntingBookmark entity properties
x-ms-client-flatten: true
allOf:
- $ref: '#/components/schemas/Entity'
x-ms-discriminator-value: Bookmark
UserInfo:
type: object
description: User information that made some action
properties:
email:
type: string
description: The email of the user.
readOnly: true
name:
type: string
description: The name of the user.
readOnly: true
objectId:
$ref: '#/components/schemas/Azure.Core.uuid'
description: The object id of the user.
IncidentSeverity:
type: string
description: The severity of the incident
enum:
- High
- Medium
- Low
- Informational
x-ms-enum:
name: IncidentSeverity
modelAsString: true
values:
- name: High
value: High
description: High severity
- name: Medium
value: Medium
description: Medium severity
- name: Low
value: Low
description: Low severity
- name: Informational
value: Informational
description: Informational severity
HuntingBookmarkProperties:
type: object
description: Describes bookmark properties
properties:
created:
type: string
format: date-time
description: The time the bookmark was created
createdBy:
$ref: '#/components/schemas/UserInfo'
description: Describes a user that created the bookmark
displayName:
type: string
description: The display name of the bookmark
eventTime:
type: string
format: date-time
description: The time of the event
labels:
type: array
description: List of labels relevant to this bookmark
items:
type: string
notes:
type: string
description: The notes of the bookmark
query:
type: string
description: The query of the bookmark.
queryResult:
type: string
description: The query result of the bookmark.
updated:
type: string
format: date-time
description: The last time the bookmark was updated
updatedBy:
$ref: '#/components/schemas/UserInfo'
description: Describes a user that updated the bookmark
incidentInfo:
$ref: '#/components/schemas/IncidentInfo'
description: Describes an incident that relates to bookmark
required:
- displayName
- query
allOf:
- $ref: '#/components/schemas/EntityCommonProperties'
EntityKindEnum:
type: string
description: The kind of the entity
enum:
- Account
- Host
- File
- AzureResource
- CloudApplication
- DnsResolution
- FileHash
- Ip
- Malware
- Process
- RegistryKey
- RegistryValue
- SecurityGroup
- Url
- IoTDevice
- SecurityAlert
- Bookmark
- MailCluster
- MailMessage
- Mailbox
- SubmissionMail
x-ms-enum:
name: EntityKindEnum
modelAsString: true
values:
- name: Account
value: Account
description: Entity represents account in the system.
- name: Host
value: Host
description: Entity represents host in the system.
- name: File
value: File
description: Entity represents file in the system.
- name: AzureResource
value: AzureResource
description: Entity represents azure resource in the system.
- name: CloudApplication
value: CloudApplication
description: Entity represents cloud application in the system.
- name: DnsResolution
value: DnsResolution
description: Entity represents dns resolution in the system.
- name: FileHash
value: FileHash
description: Entity represents file hash in the system.
- name: Ip
value: Ip
description: Entity represents ip in the system.
- name: Malware
value: Malware
description: Entity represents malware in the system.
- name: Process
value: Process
description: Entity represents process in the system.
- name: RegistryKey
value: RegistryKey
description: Entity represents registry key in the system.
- name: RegistryValue
value: RegistryValue
description: Entity represents registry value in the system.
- name: SecurityGroup
value: SecurityGroup
description: Entity represents security group in the system.
- name: Url
value: Url
description: Entity represents url in the system.
- name: IoTDevice
value: IoTDevice
description: Entity represents IoT device in the system.
- name: SecurityAlert
value: SecurityAlert
description: Entity represents security alert in the system.
- name: Bookmark
value: Bookmark
description: Entity represents bookmark in the system.
- name: MailCluster
value: MailCluster
description: Entity represents mail cluster in the system.
- name: MailMessage
value: MailMessage
description: Entity represents mail message in the system.
- name: Mailbox
value: Mailbox
description: Entity represents mailbox in the system.
- name: SubmissionMail
value: SubmissionMail
description: Entity represents submission mail in the system.
IncidentBookmarkList:
type: object
description: List of incident bookmarks.
properties:
value:
type: array
description: Array of incident bookmarks.
items:
$ref: '#/components/schemas/HuntingBookmark'
x-ms-identifiers: []
required:
- value
Entity:
type: object
description: Specific entity.
properties:
kind:
$ref: '#/components/schemas/EntityKindEnum'
description: Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value.
discriminator:
propertyName: kind
required:
- kind
allOf:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
CloudError:
type: object
description: Error response structure.
properties:
error:
$ref: '#/components/schemas/CloudErrorBody'
description: Error data
securitySchemes:
azure_auth:
type: oauth2
flows:
implicit:
scopes:
user_impersonation: impersonate your user account
authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml