The WatchlistItems API from Microsoft Sentinel — 2 operation(s) for watchlistitems.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/microsoft-sentinel:microsoft-sentinel-watchlistitems-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Microsoft Sentinel Watchlist Items API
version: '2025-09-01'
x-typespec-generated:
- emitter: '@azure-tools/typespec-autorest'
description: 'Operations tagged WatchlistItems across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
- user_impersonation
tags:
- name: WatchlistItems
paths:
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems
: get:
operationId: WatchlistItems_List
tags:
- WatchlistItems
description: Get all watchlist Items.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: watchlistAlias
in: path
description: The watchlist alias
required: true
schema:
type: string
- name: $skipToken
in: query
description: Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
required: false
schema:
type: string
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/WatchlistItemList'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get all watchlist Items.:
$ref: ./examples/watchlists/GetWatchlistItems.json
x-ms-pageable:
nextLinkName: nextLink
summary: Watchlist items list
x-summary-source: derived
servers:
- url: https://management.azure.com
? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}
: get:
operationId: WatchlistItems_Get
tags:
- WatchlistItems
description: Get a watchlist item.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: watchlistAlias
in: path
description: The watchlist alias
required: true
schema:
type: string
- name: watchlistItemId
in: path
description: The watchlist item id (GUID)
required: true
schema:
type: string
responses:
'200':
description: Azure operation completed successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/WatchlistItem'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Get a watchlist item.:
$ref: ./examples/watchlists/GetWatchlistItemById.json
summary: Watchlist items get
x-summary-source: derived
put:
operationId: WatchlistItems_CreateOrUpdate
tags:
- WatchlistItems
description: Create or update a watchlist item.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: watchlistAlias
in: path
description: The watchlist alias
required: true
schema:
type: string
- name: watchlistItemId
in: path
description: The watchlist item id (GUID)
required: true
schema:
type: string
responses:
'200':
description: Resource 'WatchlistItem' update operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/WatchlistItem'
'201':
description: Resource 'WatchlistItem' create operation succeeded
content:
application/json:
schema:
$ref: '#/components/schemas/WatchlistItem'
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Create or update a watchlist item.:
$ref: ./examples/watchlists/CreateWatchlistItem.json
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/WatchlistItem'
description: The watchlist item
required: true
summary: Watchlist items create or update
x-summary-source: derived
delete:
operationId: WatchlistItems_Delete
tags:
- WatchlistItems
description: Delete a watchlist item.
parameters:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
- name: workspaceName
in: path
description: The name of the monitor workspace.
required: true
schema:
type: string
maxLength: 90
minLength: 1
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
- name: watchlistAlias
in: path
description: The watchlist alias
required: true
schema:
type: string
- name: watchlistItemId
in: path
description: The watchlist item id (GUID)
required: true
schema:
type: string
responses:
'200':
description: Resource deleted successfully.
'204':
description: Resource does not exist.
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/CloudError'
x-ms-examples:
Delete a watchlist item.:
$ref: ./examples/watchlists/DeleteWatchlistItem.json
summary: Watchlist items delete
x-summary-source: derived
servers:
- url: https://management.azure.com
components:
schemas:
Azure.Core.uuid:
type: string
format: uuid
description: Universally Unique Identifier
WatchlistItemList:
type: object
description: List all the watchlist items.
properties:
value:
type: array
description: The WatchlistItem items on this page
items:
$ref: '#/components/schemas/WatchlistItem'
nextLink:
type: string
format: uri
description: The link to the next page of items
readOnly: true
required:
- value
UserInfo:
type: object
description: User information that made some action
properties:
email:
type: string
description: The email of the user.
readOnly: true
name:
type: string
description: The name of the user.
readOnly: true
objectId:
$ref: '#/components/schemas/Azure.Core.uuid'
description: The object id of the user.
CloudErrorBody:
type: object
description: Error details.
properties:
code:
type: string
description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
readOnly: true
message:
type: string
description: A message describing the error, intended to be suitable for display in a user interface.
readOnly: true
WatchlistItem:
type: object
description: Represents a Watchlist Item in Azure Security Insights.
properties:
properties:
$ref: '#/components/schemas/WatchlistItemProperties'
description: Watchlist Item properties
x-ms-client-flatten: true
etag:
type: string
description: Etag of the azure resource
allOf:
- $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
CloudError:
type: object
description: Error response structure.
properties:
error:
$ref: '#/components/schemas/CloudErrorBody'
description: Error data
WatchlistItemProperties:
type: object
description: Describes watchlist item properties
properties:
watchlistItemType:
type: string
description: The type of the watchlist item
watchlistItemId:
type: string
description: The id (a Guid) of the watchlist item
tenantId:
type: string
description: The tenantId to which the watchlist item belongs to
isDeleted:
type: boolean
description: A flag that indicates if the watchlist item is deleted or not
created:
type: string
format: date-time
description: The time the watchlist item was created
updated:
type: string
format: date-time
description: The last time the watchlist item was updated
createdBy:
$ref: '#/components/schemas/UserInfo'
description: Describes a user that created the watchlist item
updatedBy:
$ref: '#/components/schemas/UserInfo'
description: Describes a user that updated the watchlist item
itemsKeyValue:
description: key-value pairs for a watchlist item
entityMapping:
description: key-value pairs for a watchlist item entity mapping
required:
- itemsKeyValue
securitySchemes:
azure_auth:
type: oauth2
flows:
implicit:
scopes:
user_impersonation: impersonate your user account
authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml