Microsoft Sentinel Manual Trigger API

openapi: 3.2.0
info:
  title: Microsoft Sentinel Manual Trigger API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged manualTrigger across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: manualTrigger
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/entities/{entityIdentifier}/runPlaybook
  : post:
      operationId: Entities_RunPlaybook
      tags:
      - manualTrigger
      description: Triggers playbook on a specific entity.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: entityIdentifier
        in: path
        description: entity ID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: There is no content to send for this request, but the headers may be useful.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Entities_RunPlaybook:
          $ref: ./examples/manualTrigger/Entities_RunPlaybook.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EntityManualTriggerRequestBody'
        description: Describes the request body for triggering a playbook on an entity.
      summary: Entities run playbook
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentIdentifier}/runPlaybook
  : post:
      operationId: Incidents_RunPlaybook
      tags:
      - manualTrigger
      description: Triggers playbook on a specific incident
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: incidentIdentifier
        in: path
        description: The incident identifier.
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Azure operation completed successfully.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Incidents_RunPlaybook:
          $ref: ./examples/manualTrigger/Incidents_RunPlaybook.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManualTriggerRequestBody'
        description: Describes the request body for triggering a playbook on an incident.
      summary: Incidents run playbook
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    Azure.Core.uuid:
      type: string
      format: uuid
      description: Universally Unique Identifier
    EntityManualTriggerRequestBody:
      type: object
      description: Describes the request body for triggering a playbook on an entity.
      properties:
        incidentArmId:
          type: string
          format: arm-id
          description: Incident ARM id.
          x-ms-arm-id-details:
            allowedResources:
            - scopes:
              - Extension
              type: Microsoft.SecurityInsights/incidents
        tenantId:
          $ref: '#/components/schemas/Azure.Core.uuid'
          description: The tenant id of the playbook resource.
        logicAppsResourceId:
          type: string
          format: arm-id
          description: The resource id of the playbook resource.
          x-ms-arm-id-details:
            allowedResources:
            - type: Microsoft.Logic/workflows
            - type: Microsoft.Web/sites
      required:
      - logicAppsResourceId
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    ManualTriggerRequestBody:
      type: object
      properties:
        tenantId:
          $ref: '#/components/schemas/Azure.Core.uuid'
        logicAppsResourceId:
          type: string
          format: arm-id
          description: Related Analytic rule resource id
          x-ms-arm-id-details:
            allowedResources:
            - type: Microsoft.Logic/workflows
            - type: Microsoft.Web/sites
      required:
      - logicAppsResourceId
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml