The Metadata API from Microsoft Sentinel — 2 operation(s) for metadata.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/microsoft-sentinel:microsoft-sentinel-metadata-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Microsoft Sentinel Metadata API
version: '2025-09-01'
x-typespec-generated:
- emitter: '@azure-tools/typespec-autorest'
description: 'Operations tagged Metadata across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
- user_impersonation
tags:
- name: Metadata
paths:
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata
: get:
operationId: Metadata_List
tags:
- Metadata
description: List of all metadata
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: $filter
in: query
description: Filters the results, based on a Boolean condition. Optional.
required: false
schema:
type: string
- name: $orderby
in: query
description: Sorts the results. Optional.
required: false
schema:
type: string
- name: $top
in: query
description: Returns only the first n results. Optional.
required: false
schema:
type: integer
format: int32
- name: $skip
in: query
description: Used to skip n elements in the OData query (offset). Returns a nextLink to the next page of results if there are any left.
required: false
schema:
type: integer
format: int32
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/MetadataList'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get all metadata with OData filter/orderby/skip/top:
$ref: ./examples/metadata/GetAllMetadataOData.json
Get all metadata.:
$ref: ./examples/metadata/GetAllMetadata.json
x-ms-pageable:
nextLinkName: nextLink
summary: Metadata list
x-summary-source: derived
servers:
- url: https://management.azure.com
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/metadata/{metadataName}
: get:
operationId: Metadata_Get
tags:
- Metadata
description: Get a Metadata.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: metadataName
in: path
description: The Metadata name.
required: true
schema:
type: string
pattern: ^\S+$
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/MetadataModel'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get single metadata by name:
$ref: ./examples/metadata/GetMetadata.json
summary: Metadata get
x-summary-source: derived
put:
operationId: Metadata_Create
tags:
- Metadata
description: Create a Metadata.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: metadataName
in: path
description: The Metadata name.
required: true
schema:
type: string
pattern: ^\S+$
responses:
'200':
description: Resource 'MetadataModel' update operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/MetadataModel'
'201':
description: Resource 'MetadataModel' create operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/MetadataModel'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Create/update full metadata.:
$ref: ./examples/metadata/PutMetadata.json
Create/update minimal metadata.:
$ref: ./examples/metadata/PutMetadataMinimal.json
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MetadataModel'
description: Metadata resource.
required: true
summary: Metadata create
x-summary-source: derived
patch:
operationId: Metadata_Update
tags:
- Metadata
description: Update an existing Metadata.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: metadataName
in: path
description: The Metadata name.
required: true
schema:
type: string
pattern: ^\S+$
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/MetadataModel'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Update metadata.:
$ref: ./examples/metadata/PatchMetadata.json
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/metadataPatch'
description: Partial metadata request.
required: true
summary: Metadata update
x-summary-source: derived
delete:
operationId: Metadata_Delete
tags:
- Metadata
description: Delete a Metadata.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: metadataName
in: path
description: The Metadata name.
required: true
schema:
type: string
pattern: ^\S+$
responses:
'200':
description: Resource deleted successfully.
'204':
description: Resource does not exist.
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Delete metadata.:
$ref: ./examples/metadata/DeleteMetadata.json
summary: Metadata delete
x-summary-source: derived
servers:
- url: https://management.azure.com
components:
schemas:
ResourceWithEtag:
type: object
description: An azure resource object with an Etag property
properties:
etag:
type: string
description: Etag of the azure resource
allOf:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/Resource
Kind:
type: string
description: The kind of content the metadata is for.
enum:
- DataConnector
- DataType
- Workbook
- WorkbookTemplate
- Playbook
- PlaybookTemplate
- AnalyticsRuleTemplate
- AnalyticsRule
- HuntingQuery
- InvestigationQuery
- Parser
- Watchlist
- WatchlistTemplate
- Solution
- AzureFunction
- LogicAppsCustomConnector
- AutomationRule
- ResourcesDataConnector
- Notebook
- Standalone
- SummaryRule
x-ms-enum:
name: Kind
modelAsString: true
values:
- name: DataConnector
value: DataConnector
description: DataConnector
- name: DataType
value: DataType
description: DataType
- name: Workbook
value: Workbook
description: Workbook
- name: WorkbookTemplate
value: WorkbookTemplate
description: WorkbookTemplate
- name: Playbook
value: Playbook
description: Playbook
- name: PlaybookTemplate
value: PlaybookTemplate
description: PlaybookTemplate
- name: AnalyticsRuleTemplate
value: AnalyticsRuleTemplate
description: AnalyticsRuleTemplate
- name: AnalyticsRule
value: AnalyticsRule
description: AnalyticsRule
- name: HuntingQuery
value: HuntingQuery
description: HuntingQuery
- name: InvestigationQuery
value: InvestigationQuery
description: InvestigationQuery
- name: Parser
value: Parser
description: Parser
- name: Watchlist
value: Watchlist
description: Watchlist
- name: WatchlistTemplate
value: WatchlistTemplate
description: WatchlistTemplate
- name: Solution
value: Solution
description: Solution
- name: AzureFunction
value: AzureFunction
description: AzureFunction
- name: LogicAppsCustomConnector
value: LogicAppsCustomConnector
description: LogicAppsCustomConnector
- name: AutomationRule
value: AutomationRule
description: AutomationRule
- name: ResourcesDataConnector
value: ResourcesDataConnector
description: ResourcesDataConnector
- name: Notebook
value: Notebook
description: Notebook
- name: Standalone
value: Standalone
description: Standalone
- name: SummaryRule
value: SummaryRule
description: SummaryRule
SourceKind:
type: string
description: Source type of the content
enum:
- LocalWorkspace
- Community
- Solution
- SourceRepository
x-ms-enum:
name: SourceKind
modelAsString: true
values:
- name: LocalWorkspace
value: LocalWorkspace
description: LocalWorkspace
- name: Community
value: Community
description: Community
- name: Solution
value: Solution
description: Solution
- name: SourceRepository
value: SourceRepository
description: SourceRepository
MetadataDependencyOperator:
type: string
description: Operator used for list of dependencies in criteria array.
enum:
- AND
- OR
x-ms-enum:
name: MetadataDependencyOperator
modelAsString: true
values:
- name: AND
value: AND
description: AND
- name: OR
value: OR
description: OR
metadataCategories:
type: object
description: ies for the solution content item
properties:
domains:
type: array
description: domain for the solution content item
items:
type: string
verticals:
type: array
description: Industry verticals for the solution content item
items:
type: string
CloudErrorBody:
type: object
description: Error details.
properties:
code:
type: string
description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
readOnly: true
message:
type: string
description: A message describing the error, intended to be suitable for display in a user interface.
readOnly: true
metadataPatch:
type: object
description: Metadata patch request body.
properties:
properties:
$ref: '#/components/schemas/metadataPropertiesPatch'
description: Metadata patch request body
x-ms-client-flatten: true
allOf:
- $ref: '#/components/schemas/ResourceWithEtag'
MetadataList:
type: object
description: List of all the metadata.
properties:
value:
type: array
description: The MetadataModel items on this page
items:
$ref: '#/components/schemas/MetadataModel'
nextLink:
type: string
format: uri
description: The link to the next page of items
readOnly: true
required:
- value
metadataSupport:
type: object
description: Support information for the content item.
properties:
tier:
$ref: '#/components/schemas/SupportTier'
description: Type of support for content item
name:
type: string
description: Name of the support contact. Company or person.
email:
type: string
description: Email of support contact
link:
type: string
description: Link for support help, like to support page to open a ticket etc.
required:
- tier
SupportTier:
type: string
description: Type of support for content item
enum:
- Microsoft
- Partner
- Community
x-ms-enum:
name: SupportTier
modelAsString: true
values:
- name: Microsoft
value: Microsoft
description: Microsoft
- name: Partner
value: Partner
description: Partner
- name: Community
value: Community
description: Community
metadataProperties:
type: object
description: Metadata property bag.
properties:
contentId:
type: string
description: Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Can be optionally set for user created content to define dependencies. If an active content item is made from a template, both will have the same contentId.
parentId:
type: string
description: Full parent resource ID of the content item the metadata is for. This is the full resource ID including the scope (subscription and resource group)
version:
type: string
description: Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot guarantee any version checks
kind:
type: string
description: The kind of content the metadata is for.
source:
$ref: '#/components/schemas/metadataSource'
description: Source of the content. This is where/how it was created.
author:
$ref: '#/components/schemas/metadataAuthor'
description: The creator of the content item.
support:
$ref: '#/components/schemas/metadataSupport'
description: Support information for the metadata - type, name, contact information
dependencies:
$ref: '#/components/schemas/metadataDependencies'
description: Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
categories:
$ref: '#/components/schemas/metadataCategories'
description: Categories for the solution content item
providers:
type: array
description: Providers for the solution content item
items:
type: string
firstPublishDate:
type: string
format: date
description: first publish date of solution content item
lastPublishDate:
type: string
format: date
description: last publish date of solution content item
customVersion:
type: string
description: The custom version of the content. A optional free text
contentSchemaVersion:
type: string
description: Schema version of the content. Can be used to distinguish between different flow based on the schema version
icon:
type: string
description: the icon identifier. this id can later be fetched from the solution template
threatAnalysisTactics:
type: array
description: the tactics the resource covers
items:
type: string
threatAnalysisTechniques:
type: array
description: the techniques the resource covers, these have to be aligned with the tactics being used
items:
type: string
previewImages:
type: array
description: preview image file names. These will be taken from the solution artifacts
items:
type: string
previewImagesDark:
type: array
description: preview image file names. These will be taken from the solution artifacts. used for dark theme support
items:
type: string
required:
- parentId
- kind
MetadataModel:
type: object
description: Metadata resource definition.
properties:
properties:
$ref: '#/components/schemas/metadataProperties'
description: Metadata properties
x-ms-client-flatten: true
etag:
type: string
description: Etag of the azure resource
allOf:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
CloudError:
type: object
description: Error response structure.
properties:
error:
$ref: '#/components/schemas/CloudErrorBody'
description: Error data
metadataPropertiesPatch:
type: object
description: Metadata property bag for patch requests. This is the same as the MetadataProperties, but with nothing required
properties:
contentId:
type: string
description: Static ID for the content. Used to identify dependencies and content from solutions or community. Hard-coded/static for out of the box content and solutions. Can be optionally set for user created content to define dependencies. If an active content item is made from a template, both will have the same contentId.
parentId:
type: string
description: Full parent resource ID of the content item the metadata is for. This is the full resource ID including the scope (subscription and resource group)
version:
type: string
description: Version of the content. Default and recommended format is numeric (e.g. 1, 1.0, 1.0.0, 1.0.0.0), following ARM template best practices. Can also be any string, but then we cannot guarantee any version checks
kind:
type: string
description: The kind of content the metadata is for.
source:
$ref: '#/components/schemas/metadataSource'
description: Source of the content. This is where/how it was created.
author:
$ref: '#/components/schemas/metadataAuthor'
description: The creator of the content item.
support:
$ref: '#/components/schemas/metadataSupport'
description: Support information for the metadata - type, name, contact information
dependencies:
$ref: '#/components/schemas/metadataDependencies'
description: Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex formats.
categories:
$ref: '#/components/schemas/metadataCategories'
description: Categories for the solution content item
providers:
type: array
description: Providers for the solution content item
items:
type: string
firstPublishDate:
type: string
format: date
description: first publish date of solution content item
lastPublishDate:
type: string
format: date
description: last publish date of solution content item
customVersion:
type: string
description: The custom version of the content. A optional free text
contentSchemaVersion:
type: string
description: Schema version of the content. Can be used to distinguish between different flow based on the schema version
icon:
type: string
description: the icon identifier. this id can later be fetched from the solution template
threatAnalysisTactics:
type: array
description: the tactics the resource covers
items:
type: string
threatAnalysisTechniques:
type: array
description: the techniques the resource covers, these have to be aligned with the tactics being used
items:
type: string
previewImages:
type: array
description: preview image file names. These will be taken from the solution artifacts
items:
type: string
previewImagesDark:
type: array
description: preview image file names. These will be taken from the solution artifacts. used for dark theme support
items:
type: string
metadataDependencies:
type: object
description: Dependencies for the content item, what other content items it requires to work. Can describe more complex dependencies using a recursive/nested structure. For a single dependency an id/kind/version can be supplied or operator/criteria for complex dependencies.
properties:
contentId:
type: string
description: Id of the content item we depend on
kind:
$ref: '#/components/schemas/Kind'
description: Type of the content item we depend on
version:
type: string
description: Version of the the content item we depend on. Can be blank, * or missing to indicate any version fulfills the dependency. If version does not match our defined numeric format then an exact match is required.
name:
type: string
description: Name of the content item
operator:
$ref: '#/components/schemas/MetadataDependencyOperator'
description: Operator used for list of dependencies in criteria array.
criteria:
type: array
description: This is the list of dependencies we must fulfill, according to the AND/OR operator
items:
$ref: '#/components/schemas/metadataDependencies'
x-ms-identifiers:
- contentId
metadataAuthor:
type: object
description: Publisher or creator of the content item.
properties:
name:
type: string
description: Name of the author. Company or person.
email:
type: string
description: Email of author contact
link:
type: string
description: Link for author/vendor page
metadataSource:
type: object
description: The original source of the content item, where it comes from.
properties:
kind:
$ref: '#/components/schemas/SourceKind'
description: Source type of the content
name:
type: string
description: Name of the content source. The repo name, solution name, LA workspace name etc.
sourceId:
type: string
description: ID of the content source. The solution ID, workspace ID, etc
required:
- kind
securitySchemes:
azure_auth:
type: oauth2
flows:
implicit:
scopes:
user_impersonation: impersonate your user account
authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml