Microsoft Sentinel Threat Intelligence API

openapi: 3.2.0
info:
  title: Security Insights Threat Intelligence API
  version: '2025-09-01'
  description: API spec for Microsoft.SecurityInsights (Azure Security Insights) resource provider
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Threat Intelligence
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/createIndicator
  : post:
      operationId: ThreatIntelligenceIndicator_CreateIndicator
      tags:
      - Threat Intelligence
      description: Create a new threat intelligence indicator.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      responses:
        '200':
          description: Resource 'ThreatIntelligenceInformation' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformation'
        '201':
          description: Resource 'ThreatIntelligenceInformation' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformation'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatIntelligenceIndicatorModel'
        description: The content of the action request
        required: true
      summary: Threat intelligence indicator create indicator
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators
  : get:
      operationId: ThreatIntelligenceIndicators_List
      tags:
      - Threat Intelligence
      description: Get all threat intelligence indicators.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: $filter
        in: query
        description: Filters the results, based on a Boolean condition. Optional.
        required: false
        schema:
          type: string
      - name: $top
        in: query
        description: Returns only the first n results. Optional.
        required: false
        schema:
          type: integer
          format: int32
      - name: $skipToken
        in: query
        description: Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
        required: false
        schema:
          type: string
      - name: $orderby
        in: query
        description: Sorts the results. Optional.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformationList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Threat intelligence indicators list
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}
  : get:
      operationId: ThreatIntelligenceIndicator_Get
      tags:
      - Threat Intelligence
      description: View a threat intelligence indicator by name.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: name
        in: path
        description: Threat intelligence indicator name field.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformation'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      summary: Threat intelligence indicator get
      x-summary-source: derived
    put:
      operationId: ThreatIntelligenceIndicator_Create
      tags:
      - Threat Intelligence
      description: Update a threat Intelligence indicator.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: name
        in: path
        description: Threat intelligence indicator name field.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'ThreatIntelligenceInformation' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformation'
        '201':
          description: Resource 'ThreatIntelligenceInformation' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformation'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatIntelligenceIndicatorModel'
        description: Properties of threat intelligence indicators to create and update.
        required: true
      summary: Threat intelligence indicator create
      x-summary-source: derived
    delete:
      operationId: ThreatIntelligenceIndicator_Delete
      tags:
      - Threat Intelligence
      description: Delete a threat intelligence indicator.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: name
        in: path
        description: Threat intelligence indicator name field.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      summary: Threat intelligence indicator delete
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/appendTags
  : post:
      operationId: ThreatIntelligenceIndicator_AppendTags
      tags:
      - Threat Intelligence
      description: Append tags to a threat intelligence indicator.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: name
        in: path
        description: Threat intelligence indicator name field.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The request has succeeded.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatIntelligenceAppendTags'
        description: The threat intelligence append tags request body
        required: true
      summary: Threat intelligence indicator append tags
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/indicators/{name}/replaceTags
  : post:
      operationId: ThreatIntelligenceIndicator_ReplaceTags
      tags:
      - Threat Intelligence
      description: Replace tags added to a threat intelligence indicator.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: name
        in: path
        description: Threat intelligence indicator name field.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformation'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatIntelligenceIndicatorModel'
        description: Tags in the threat intelligence indicator to be replaced.
        required: true
      summary: Threat intelligence indicator replace tags
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/metrics
  : get:
      operationId: ThreatIntelligenceIndicatorMetrics_List
      tags:
      - Threat Intelligence
      description: Get threat intelligence indicators metrics (Indicators counts by Type, Threat Type, Source).
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceMetricsList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      summary: Threat intelligence indicator metrics list
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/queryIndicators
  : post:
      operationId: ThreatIntelligenceIndicator_QueryIndicators
      tags:
      - Threat Intelligence
      description: Query threat intelligence indicators as per filtering criteria.
      parameters:
      - $ref: '#/components/parameters/ApiVersionParameter'
      - $ref: '#/components/parameters/SubscriptionIdParameter'
      - $ref: '#/components/parameters/ResourceGroupNameParameter'
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatIntelligenceInformationList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-pageable:
        nextLinkName: nextLink
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatIntelligenceFilteringCriteria'
        description: The content of the action request
        required: true
      summary: Threat intelligence indicator query indicators
      x-summary-source: derived
components:
  schemas:
    ThreatIntelligenceSortingOrder:
      type: string
      description: Sorting order (ascending/descending/unsorted).
      enum:
      - unsorted
      - ascending
      - descending
      x-ms-enum:
        name: ThreatIntelligenceSortingOrder
        modelAsString: true
        values:
        - name: unsorted
          value: unsorted
          description: unsorted
        - name: ascending
          value: ascending
          description: ascending
        - name: descending
          value: descending
          description: descending
    ThreatIntelligenceResourceInnerKind:
      type: string
      description: The kind of the threat intelligence entity
      enum:
      - indicator
      x-ms-enum:
        name: ThreatIntelligenceResourceInnerKind
        modelAsString: true
        values:
        - name: indicator
          value: indicator
          description: Entity represents threat intelligence indicator in the system.
    ThreatIntelligenceKillChainPhase:
      type: object
      description: Describes threat kill chain phase entity
      properties:
        killChainName:
          type: string
          description: Kill chainName name
        phaseName:
          type: string
          description: Phase name
    Resource:
      type: object
      title: Resource
      description: Common fields that are returned in the response for all Azure Resource Manager resources
      properties:
        id:
          type: string
          format: arm-id
          description: Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
          readOnly: true
        name:
          type: string
          description: The name of the resource
          readOnly: true
        type:
          type: string
          description: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
          readOnly: true
        systemData:
          $ref: '#/components/schemas/systemData'
          description: Azure Resource Manager metadata containing createdBy and modifiedBy information.
          readOnly: true
      x-ms-azure-resource: true
    ThreatIntelligenceExternalReference:
      type: object
      description: Describes external reference
      properties:
        description:
          type: string
          description: External reference description
        externalId:
          type: string
          description: External reference ID
        sourceName:
          type: string
          description: External reference source name
        url:
          type: string
          description: External reference URL
        hashes:
          type: object
          description: External reference hashes
          additionalProperties:
            type: string
    ThreatIntelligenceFilteringCriteria:
      type: object
      description: Filtering criteria for querying threat intelligence indicators.
      properties:
        pageSize:
          type: integer
          format: int32
          description: Page size
        minConfidence:
          type: integer
          format: int32
          description: Minimum confidence.
        maxConfidence:
          type: integer
          format: int32
          description: Maximum confidence.
        minValidUntil:
          type: string
          description: Start time for ValidUntil filter.
        maxValidUntil:
          type: string
          description: End time for ValidUntil filter.
        includeDisabled:
          type: boolean
          description: Parameter to include/exclude disabled indicators.
        sortBy:
          type: array
          description: Columns to sort by and sorting order
          items:
            $ref: '#/components/schemas/ThreatIntelligenceSortingCriteria'
          x-ms-identifiers: []
        sources:
          type: array
          description: Sources of threat intelligence indicators
          items:
            type: string
        patternTypes:
          type: array
          description: Pattern types
          items:
            type: string
        threatTypes:
          type: array
          description: Threat types of threat intelligence indicators
          items:
            type: string
        ids:
          type: array
          description: Ids of threat intelligence indicators
          items:
            type: string
        keywords:
          type: array
          description: Keywords for searching threat intelligence indicators
          items:
            type: string
        skipToken:
          type: string
          description: Skip token.
    ThreatIntelligenceInformation:
      type: object
      description: Threat intelligence information object.
      properties:
        kind:
          $ref: '#/components/schemas/ThreatIntelligenceResourceInnerKind'
          description: Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type.  If supported, the resource provider must validate and persist this value.
        etag:
          type: string
          description: Etag of the azure resource
      discriminator:
        propertyName: kind
      required:
      - kind
      allOf:
      - $ref: '#/components/schemas/ProxyResource'
    ThreatIntelligenceIndicatorProperties:
      type: object
      description: Describes threat intelligence entity properties
      properties:
        threatIntelligenceTags:
          type: array
          description: List of tags
          items:
            type: string
        lastUpdatedTimeUtc:
          type: string
          description: Last updated time in UTC
        source:
          type: string
          description: Source of a threat intelligence entity
        displayName:
          type: string
          description: Display name of a threat intelligence entity
        description:
          type: string
          description: Description of a threat intelligence entity
        indicatorTypes:
          type: array
          description: Indicator types of threat intelligence entities
          items:
            type: string
        pattern:
          type: string
          description: Pattern of a threat intelligence entity
        patternType:
          type: string
          description: Pattern type of a threat intelligence entity
        patternVersion:
          type: string
          description: Pattern version of a threat intelligence entity
        killChainPhases:
          type: array
          description: Kill chain phases
          items:
            $ref: '#/components/schemas/ThreatIntelligenceKillChainPhase'
          x-ms-identifiers: []
        parsedPattern:
          type: array
          description: Parsed patterns
          items:
            $ref: '#/components/schemas/ThreatIntelligenceParsedPattern'
          x-ms-identifiers: []
        externalId:
          type: string
          description: External ID of threat intelligence entity
        createdByRef:
          type: string
          description: Created by reference of threat intelligence entity
        defanged:
          type: boolean
          description: Is threat intelligence entity defanged
        externalLastUpdatedTimeUtc:
          type: string
          description: External last updated time in UTC
        externalReferences:
          type: array
          description: External References
          items:
            $ref: '#/components/schemas/ThreatIntelligenceExternalReference'
          x-ms-identifiers: []
        granularMarkings:
          type: array
          description: Granular Markings
          items:
            $ref: '#/components/schemas/ThreatIntelligenceGranularMarkingModel'
          x-ms-identifiers: []
        labels:
          type: array
          description: Labels  of threat intelligence entity
          items:
            type: string
        revoked:
          type: boolean
          description: Is threat intelligence entity revoked
        confidence:
          type: integer
          format: int32
          description: Confidence of threat intelligence entity
        objectMarkingRefs:
          type: array
          description: Threat intelligence entity object marking references
          items:
            type: string
        language:
          type: string
          description: Language of threat intelligence entity
        threatTypes:
          type: array
          description: Threat types
          items:
            type: string
        validFrom:
          type: string
          description: Valid from
        validUntil:
          type: string
          description: Valid until
        created:
          type: string
          description: Created by
        modified:
          type: string
          description: Modified by
        extensions:
          type: object
          description: Extensions map
          additionalProperties: {}
      allOf:
      - $ref: '#/components/schemas/EntityCommonProperties'
    ThreatIntelligenceMetrics:
      type: object
      description: Threat intelligence metrics.
      properties:
        properties:
          $ref: '#/components/schemas/ThreatIntelligenceMetric'
          description: Threat intelligence metrics.
    ProxyResource:
      type: object
      title: Proxy Resource
      description: The resource model definition for a Azure Resource Manager proxy resource. It will not have tags and a location
      allOf:
      - $ref: '#/components/schemas/Resource'
    ThreatIntelligenceAppendTags:
      type: object
      description: Array of tags to be appended to the threat intelligence indicator.
      properties:
        threatIntelligenceTags:
          type: array
          description: List of tags to be appended.
          items:
            type: string
    ThreatIntelligenceSortingCriteria:
      type: object
      description: List of available columns for sorting
      properties:
        itemKey:
          type: string
          description: Column name
        sortOrder:
          $ref: '#/components/schemas/ThreatIntelligenceSortingOrder'
          description: Sorting order (ascending/descending/unsorted).
    ThreatIntelligenceMetricsList:
      type: object
      description: List of all the threat intelligence metric fields (type/threat type/source).
      properties:
        value:
          type: array
          description: Array of threat intelligence metric fields (type/threat type/source).
          items:
            $ref: '#/components/schemas/ThreatIntelligenceMetrics'
          x-ms-identifiers: []
      required:
      - value
    ThreatIntelligenceIndicatorModel:
      type: object
      description: Threat intelligence indicator entity.
      properties:
        properties:
          $ref: '#/components/schemas/ThreatIntelligenceIndicatorProperties'
          description: Threat Intelligence Entity properties
          x-ms-client-flatten: true
      allOf:
      - $ref: '#/components/schemas/ThreatIntelligenceInformation'
      x-ms-discriminator-value: indicator
    ThreatIntelligenceParsedPatternTypeValue:
      type: object
      description: Describes threat kill chain phase entity
      properties:
        valueType:
          type: string
          description: Type of the value
        value:
          type: string
          description: Value of parsed pattern
    ThreatIntelligenceInformationList:
      type: object
      description: List of all the threat intelligence information objects.
      properties:
        value:
          type: array
          description: The ThreatIntelligenceInformation items on this page
          items:
            $ref: '#/components/schemas/ThreatIntelligenceInformation'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
          readOnly: true
      required:
      - value
    ThreatIntelligenceGranularMarkingModel:
      type: object
      description: Describes threat granular marking model entity
      properties:
        language:
          type: string
          description: Language granular marking model
        markingRef:
          type: integer
          format: int32
          description: marking reference granular marking model
        selectors:
          type: array
          description: granular marking model selectors
          items:
            type: string
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
    ThreatIntelligenceMetricEntity:
      type: object
      description: Describes threat intelligence metric entity
      properties:
        metricName:
          type: string
          description: Metric name
        metricValue:
          type: integer
          format: int32
          description: Metric value
    ThreatIntelligenceMetric:
      type: object
      description: Describes threat intelligence metric
      properties:
        lastUpdatedTimeUtc:
          type: string
          description: Last updated indicator metric
        threatTypeMetrics:
          type: array
          description: Threat type metrics
          items:
            $ref: '#/components/schemas/ThreatIntelligenceMetricEntity'
          x-ms-identifiers: []
        patternTypeMetrics:
          type: array
          description: Pattern type metrics
          items:
            $ref: '#/components/schemas/ThreatIntelligenceMetricEntity'
          x-ms-identifiers: []
        sourceMetrics:
          type: array
          description: Source metrics
          items:
            $ref: '#/components/schemas/ThreatIntelligenceMetricEntity'
          x-ms-identifiers: []
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    ThreatIntelligenceParsedPattern:
      type: object
      description: Describes parsed pattern entity
      properties:
        patternTypeKey:
          type: string
          description: Pattern type key
        patternTypeValues:
          type: array
          description: Pattern type keys
          items:
            $ref: '#/components/schemas/ThreatIntelligenceParsedPatternTypeValue'
          x-ms-identifiers: []
    EntityCommonProperties:
      type: object
      description: Entity common property bag.
      properties:
        additionalData:
          type: object
          description: A bag of custom fields that should be part of the entity and will be presented to the user.
          additionalProperties: {}
          readOnly: true
        friendlyName:
          type: string
          description: The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated.
          readOnly: true
  parameters:
    ApiVersionParameter:
      name: api-version
      in: query
      description: The API version to use for this operation.
      required: true
      schema:
        type: string
        minLength: 1
    ResourceGroupNameParameter:
      name: resourceGroupName
      in: path
      description: The name of the resource group. The name is case insensitive.
      required: true
      x-ms-parameter-location: method
      schema:
        type: string
        maxLength: 90
        minLength: 1
    SubscriptionIdParameter:
      name: subscriptionId
      in: path
      description: The ID of the target subscription. The value must be an UUID.
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.