Microsoft Sentinel

Microsoft Sentinel Operations API

The Operations API from Microsoft Sentinel — 1 operation(s) for operations.

Documentation GitHub OpenAPI

Operations 1

GET /providers/Microsoft.SecurityInsights/operations Operations list #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/microsoft-sentinel:microsoft-sentinel-operations-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Microsoft Sentinel Operations API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged Operations across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Operations
paths:
  /providers/Microsoft.SecurityInsights/operations:
    get:
      operationId: Operations_List
      tags:
      - Operations
      description: Lists all operations available Azure Security Insights Resource Provider.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperationsList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get all operations.:
          $ref: ./examples/operations/ListOperations.json
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Operations list
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    Operation:
      type: object
      description: Operation provided by provider
      properties:
        display:
          $ref: '#/components/schemas/OperationDisplay'
          description: Properties of the operation
        name:
          type: string
          description: Name of the operation
        origin:
          type: string
          description: The origin of the operation
        isDataAction:
          type: boolean
          description: Indicates whether the operation is a data action
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    OperationDisplay:
      type: object
      description: Properties of the operation
      properties:
        description:
          type: string
          description: Description of the operation
        operation:
          type: string
          description: Operation name
        provider:
          type: string
          description: Provider name
        resource:
          type: string
          description: Resource name
    OperationsList:
      type: object
      description: Lists the operations available in the SecurityInsights RP.
      properties:
        nextLink:
          type: string
          description: URL to fetch the next set of operations.
          readOnly: true
        value:
          type: array
          description: Array of operations
          items:
            $ref: '#/components/schemas/Operation'
          x-ms-identifiers: []
      required:
      - value
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml