{ "openapi": "3.1.0", "info": { "title": "CIPP API", "version": "auto", "description": "The CIPP HTTP API. Every path maps one-to-one onto a PowerShell entrypoint:\nNew-CippCoreRequest resolves /api/ to Invoke-, so the path segment is\nthe function name and is case-sensitive.\n\nThis spec is generated from the PowerShell AST of those entrypoints on every\nbuild. Request schemas describe the fields the backend actually reads, including\nnested ones: a property typed as LabelValue is read as `$Field.value` by the\nbackend and must be sent as an object, not a bare string.", "x-cipp-docs": "https://docs.cipp.app" }, "servers": [ { "url": "/", "description": "This CIPP deployment" } ], "security": [ { "bearerAuth": [] } ], "tags": [ { "name": "CIPP > Core" }, { "name": "CIPP > Extensions" }, { "name": "CIPP > MCP" }, { "name": "CIPP > Scheduler" }, { "name": "CIPP > Settings" }, { "name": "CIPP > Setup" }, { "name": "Email-Exchange > Administration" }, { "name": "Email-Exchange > Administration > Contacts" }, { "name": "Email-Exchange > Administration > Mailbox Retention" }, { "name": "Email-Exchange > Reports" }, { "name": "Email-Exchange > Resources" }, { "name": "Email-Exchange > Spamfilter" }, { "name": "Email-Exchange > Tools" }, { "name": "Email-Exchange > Transport" }, { "name": "Endpoint > Applications" }, { "name": "Endpoint > Autopilot" }, { "name": "Endpoint > MEM" }, { "name": "Endpoint > Reports" }, { "name": "Identity > Administration > Devices" }, { "name": "Identity > Administration > Groups" }, { "name": "Identity > Administration > Roles" }, { "name": "Identity > Administration > Users" }, { "name": "Identity > Reports" }, { "name": "Security > Compliance-DLP" }, { "name": "Security > Compliance-Retention" }, { "name": "Security > Compliance-SensitivityLabel" }, { "name": "Security > Compliance-SIT" }, { "name": "Security > Defender" }, { "name": "Security > Incidents" }, { "name": "Security > Safe-Links-Policy" }, { "name": "Teams-Sharepoint" }, { "name": "Tenant > Administration > Alerts" }, { "name": "Tenant > Administration > Application Approval" }, { "name": "Tenant > Administration > Domains" }, { "name": "Tenant > Administration > Tenant" }, { "name": "Tenant > AI" }, { "name": "Tenant > Conditional" }, { "name": "Tenant > GDAP" }, { "name": "Tenant > Reports" }, { "name": "Tenant > SecuritySimulations" }, { "name": "Tenant > Standards" }, { "name": "Tenant > Tests" }, { "name": "Tenant > Tools" }, { "name": "Tools > Breach-Lookup" }, { "name": "Tools > Custom-Scripts" }, { "name": "Tools > GitHub" }, { "name": "Tools > Report-Builder" } ], "components": { "securitySchemes": { "bearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "Entra ID bearer token, obtained via MSAL against the CIPP API app registration." } }, "parameters": { "tenantFilter": { "name": "tenantFilter", "in": "query", "description": "Target tenant: the tenant's default domain, its tenant ID, or 'AllTenants'.", "required": true, "schema": { "type": "string" } }, "selectedTenants": { "name": "selectedTenants", "in": "query", "description": "Tenant domains to act on, for bulk operations.", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } }, "schemas": { "LabelValue": { "type": "object", "description": "CIPP's autocomplete/select shape. The backend reads $Field.value, so this must be sent as an object - a bare string resolves to null and the field is silently ignored.", "properties": { "label": { "type": "string", "description": "Display text. Ignored by the backend." }, "value": { "type": "string", "description": "The value the backend reads." } }, "required": [ "value" ] }, "LabelValueNumber": { "type": "object", "description": "Autocomplete/select shape whose value is numeric.", "properties": { "label": { "type": "string" }, "value": { "type": "number" } }, "required": [ "value" ] }, "StandardResults": { "type": "object", "description": "Standard CIPP action response envelope.", "properties": { "Results": { "description": "A message, or one message per operation for bulk actions. Mixes success and error text." } } } } }, "paths": { "/api/AddAlert": { "post": { "summary": "AddAlert", "operationId": "AddAlert", "tags": [ "Tenant > Administration > Alerts" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "actions": { "type": "string" }, "AlertComment": { "type": "string" }, "becActions": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Which containment actions the 'becremediate' action runs (ListBECRemediationActions ids); empty = the default six." }, "conditions": { "type": "array", "items": { "type": "object", "properties": { "Operator": { "$ref": "#/components/schemas/LabelValue" }, "Property": { "type": "object", "properties": { "label": { "type": "string" } } } } } }, "CustomSubject": { "type": "string" }, "excludedTenants": { "type": "string" }, "logbook": { "$ref": "#/components/schemas/LabelValue" }, "PsaTicketPriority": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "The audit form posts the raw form values, so an autocomplete selection arrives as a {label, value} object - unwrap it to the bare Halo priority id before storing." }, "RowKey": { "type": "string" }, "tenantFilter": { "type": "array", "items": { "type": "string" } } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite" } }, "/api/AddAPDevice": { "post": { "summary": "AddAPDevice", "operationId": "AddAPDevice", "tags": [ "Endpoint > Autopilot" ], "description": "Adds Autopilot devices to a tenant via Partner Center API", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "autopilotData": { "type": "string" }, "Groupname": { "type": "string" }, "TenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/AddAppTemplate": { "post": { "summary": "AddAppTemplate", "operationId": "AddAppTemplate", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "apps": { "type": "string" }, "description": { "type": "string" }, "displayName": { "type": "string" }, "GUID": { "type": "string", "description": "Upsert: if GUID provided, update existing template" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddAssignmentFilter": { "post": { "summary": "AddAssignmentFilter", "operationId": "AddAssignmentFilter", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "assignmentFilterManagementType": { "type": "string" }, "description": { "type": "string" }, "displayName": { "type": "string" }, "platform": { "type": "string" }, "rule": { "type": "string" }, "tenantFilter": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-reads-via": [ "New-CIPPAssignmentFilter" ] } }, "/api/AddAssignmentFilterTemplate": { "post": { "summary": "AddAssignmentFilterTemplate", "operationId": "AddAssignmentFilterTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "assignmentFilterManagementType": { "type": "string" }, "description": { "type": "string" }, "displayName": { "type": "string", "description": "Normalize field names to handle different casing from various forms" }, "GUID": { "type": "string" }, "platform": { "type": "string" }, "rule": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddAutopilotConfig": { "post": { "summary": "AddAutopilotConfig", "operationId": "AddAutopilotConfig", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Assignto": { "type": "string" }, "Description": { "type": "string" }, "DisplayName": { "type": "string" }, "GroupIds": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "selectedTenants": { "$ref": "#/components/schemas/LabelValue" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/AddBaseline": { "post": { "summary": "AddBaseline", "operationId": "AddBaseline", "tags": [ "Tenant > Standards" ], "description": "Creates or updates a baseline. There is no baseline blob: the Baselines\ndelta rows (design doc §4.1) are the editable source of truth for every standard's\nconfiguration, and the BaselineRollouts row (§12.2) holds the baseline-level data -\nname, description, exclusions, alert destinations, and the ordered stage definitions.\nBaselines are reconstructed from those rows on read. The actual write lives in\nNew-CIPPBaseline, shared with the community-repo import.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "alertEmails": { "type": "string" }, "alertWebhookUrl": { "type": "string" }, "assignedTenants": { "type": "string" }, "description": { "type": "string" }, "disableAlerts": { "type": "boolean", "description": "'Disable Alerts': deviations are still detected and shown, but no email, webhook or PSA notification fires for this baseline. Negative flag on purpose: rows saved before the column existed keep alerting, exactly right." }, "disableScheduledRuns": { "type": "boolean", "description": "'Disable Scheduled Runs': the baseline only executes when an operator runs it. Negative flag on purpose: rows saved before the column existed default to scheduled, exactly right." }, "excludedTenants": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "The editor round-trips the tenant selector's own option objects ({label, value, type}) verbatim via assignedTo/excludedTo; the flat excludedTenants values keep the exclusion logic simple. Raw string values are accepted everywhere too." }, "GitHub": { "type": "object", "properties": { "FullName": { "type": "string" }, "Message": { "type": "string" } }, "description": "Optional. Pushes the saved baseline to a GitHub template repository after the save: FullName is the repository (owner/repo), Message is the commit message. Not stored on the baseline." }, "GUID": { "type": "string" }, "stages": { "type": "array", "items": { "type": "object", "properties": { "conditions": { "type": "string" }, "logic": { "type": "string" }, "name": { "type": "string" }, "standards": { "type": "string" } } }, "description": "Baseline-level record: metadata + ordered stage definitions (standards live on the deltas)." }, "templateName": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "alertEmails": { "x-cipp-field-source": "storage" }, "alertWebhookUrl": { "x-cipp-field-source": "storage" }, "assignedTo": { "x-cipp-field-source": "storage" }, "description": { "x-cipp-field-source": "storage" }, "disableAlerts": { "type": "boolean", "x-cipp-field-source": "storage" }, "disableScheduledRuns": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "excludedTenants": { "x-cipp-field-source": "storage" }, "excludedTo": { "x-cipp-field-source": "storage" }, "LocalChanges": { "type": "boolean", "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "Stages": { "x-cipp-field-source": "storage" }, "templateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "updatedAt": { "x-cipp-field-source": "storage" }, "updatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.ReadWrite", "x-cipp-reads-via": [ "New-CIPPBaseline" ] } }, "/api/AddCAPolicy": { "post": { "summary": "AddCAPolicy", "operationId": "AddCAPolicy", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CreateGroups": { "type": "string" }, "DisableSD": { "type": "string" }, "NewState": { "type": "string" }, "overwrite": { "type": "string" }, "RawJSON": { "type": "string" }, "replacename": { "type": "string" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/AddCATemplate": { "post": { "summary": "AddCATemplate", "operationId": "AddCATemplate", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "conditions": { "type": "object", "properties": { "applications": { "type": "object", "properties": { "includeAuthenticationContextClassReferences": { "type": "array", "items": { "type": "string" }, "description": "Convert authentication context class reference IDs to display names and store full objects" } }, "description": "Convert authentication context class reference IDs to display names and store full objects" }, "locations": { "type": "object", "properties": { "excludeLocations": { "type": "array", "items": { "type": "string" } }, "includeLocations": { "type": "array", "items": { "type": "string" } } } }, "users": { "type": "object", "properties": { "excludeGroups": { "type": "string" }, "excludeUsers": { "type": "string", "description": "Use the same type check for other user properties" }, "includeGroups": { "type": "string" }, "includeUsers": { "type": "string" } }, "description": "Check if conditions.users exists and is a PSCustomObject (not an array) before accessing properties" } }, "description": "Check if conditions.users exists and is a PSCustomObject (not an array) before accessing properties" }, "name": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite", "x-cipp-reads-via": [ "New-CIPPCATemplate" ] } }, "/api/AddChocoApp": { "post": { "summary": "AddChocoApp", "operationId": "AddChocoApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ApplicationName": { "type": "string" }, "AssignTo": { "type": "string" }, "customArguments": { "type": "string" }, "CustomGroup": { "type": "string" }, "customrepo": { "type": "string" }, "description": { "type": "string" }, "DisableRestart": { "type": "string" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped." }, "InstallAsSystem": { "type": "string" }, "InstallationIntent": { "type": "string" }, "PackageName": { "type": "string" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" } } } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddConnectionFilter": { "post": { "summary": "AddConnectionFilter", "operationId": "AddConnectionFilter", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.ConnectionFilter.ReadWrite" } }, "/api/AddConnectionFilterTemplate": { "post": { "summary": "AddConnectionFilterTemplate", "operationId": "AddConnectionFilterTemplate", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "PowerShellCommand": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.ConnectionFilter.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddContact": { "post": { "summary": "AddContact", "operationId": "AddContact", "tags": [ "Email-Exchange > Administration > Contacts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "City": { "type": "string" }, "Company": { "type": "string" }, "CountryOrRegion": { "type": "string" }, "displayName": { "type": "string", "description": "Log the result" }, "email": { "type": "string", "description": "Log the result" }, "firstName": { "type": "string" }, "hidefromGAL": { "type": "boolean", "description": "Only add HiddenFromAddressListsEnabled if we're actually hiding from GAL" }, "lastName": { "type": "string" }, "mailTip": { "type": "string", "description": "Add MailTip if provided" }, "mobilePhone": { "type": "string" }, "phone": { "type": "string" }, "PostalCode": { "type": "string" }, "State": { "type": "string" }, "StreetAddress": { "type": "string" }, "tenantid": { "type": "string" }, "Title": { "type": "string" }, "website": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite" } }, "/api/AddContactTemplates": { "post": { "summary": "AddContactTemplates", "operationId": "AddContactTemplates", "tags": [ "Email-Exchange > Administration > Contacts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string", "description": "Set name and comments first" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddCorporateDeviceIdentifier": { "post": { "summary": "AddCorporateDeviceIdentifier", "operationId": "AddCorporateDeviceIdentifier", "tags": [ "Endpoint > Autopilot" ], "description": "Uploads corporate device identifiers (manufacturer, model and serial number) for Windows Autopilot device preparation via the Graph importedDeviceIdentities API", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "devicePrepData": { "type": "string" }, "overwriteExisting": { "type": "boolean" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/AddCustomScript": { "post": { "summary": "AddCustomScript", "operationId": "AddCustomScript", "tags": [ "Tools > Custom-Scripts" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "DisableAlerts", "DisableScript", "EnableAlerts", "EnableScript", "SetResultMode" ] }, "AlertOnFailure": { "type": "string" }, "AlertStatuses": { "type": "string" }, "Category": { "type": "string" }, "Description": { "type": "string" }, "Enabled": { "type": "string" }, "ImplementationEffort": { "type": "string" }, "MarkdownTemplate": { "type": "string" }, "Pillar": { "type": "string" }, "RestoreToVersion": { "type": "string" }, "ResultMode": { "type": "string" }, "ResultSchema": { "type": "string" }, "ReturnType": { "type": "string" }, "Risk": { "type": "string" }, "ScriptContent": { "type": "string" }, "ScriptGuid": { "type": "string" }, "ScriptName": { "type": "string" }, "UserImpact": { "type": "string" } }, "required": [ "ImplementationEffort", "Pillar", "ScriptContent", "ScriptGuid", "ScriptName", "UserImpact" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AlertOnFailure": { "x-cipp-field-source": "storage" }, "AlertStatuses": { "x-cipp-field-source": "storage" }, "Category": { "x-cipp-field-source": "storage" }, "CreatedBy": { "x-cipp-field-source": "storage" }, "CreatedDate": { "x-cipp-field-source": "storage" }, "Description": { "x-cipp-field-source": "storage" }, "Enabled": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ImplementationEffort": { "x-cipp-field-source": "storage" }, "MarkdownTemplate": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Pillar": { "x-cipp-field-source": "storage" }, "ResultMode": { "x-cipp-field-source": "storage" }, "ResultSchema": { "x-cipp-field-source": "storage" }, "ReturnType": { "x-cipp-field-source": "storage" }, "Risk": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "ScriptContent": { "x-cipp-field-source": "storage" }, "ScriptGuid": { "x-cipp-field-source": "storage" }, "ScriptName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UserImpact": { "x-cipp-field-source": "storage" }, "Version": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Tests.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddDefenderDeployment": { "post": { "summary": "AddDefenderDeployment", "operationId": "AddDefenderDeployment", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ASR": { "type": "object", "properties": { "AssignTo": { "type": "string", "x-cipp-observed-values": [ "AllDevicesAndUsers", "none" ] }, "Mode": { "type": "string", "description": "Fallback to block mode" } } }, "Compliance": { "type": "object", "properties": { "allowPartnerToCollectIosCertificateMetadata": { "type": "boolean" }, "allowPartnerToCollectIosPersonalApplicationMetadata": { "type": "boolean" }, "allowPartnerToCollectIosPersonalCertificateMetadata": { "type": "boolean" }, "androidDeviceBlockedOnMissingPartnerData": { "type": "boolean" }, "AppSync": { "type": "boolean" }, "BlockunsupportedOS": { "type": "boolean" }, "ConnectAndroid": { "type": "boolean" }, "ConnectAndroidCompliance": { "type": "boolean" }, "ConnectIos": { "type": "boolean" }, "ConnectIosCompliance": { "type": "boolean" }, "ConnectMac": { "type": "boolean" }, "Connectwindows": { "type": "boolean" }, "grantMobileThreatDefensePartnerRole": { "type": "boolean" }, "iosDeviceBlockedOnMissingPartnerData": { "type": "boolean" }, "macDeviceBlockedOnMissingPartnerData": { "type": "boolean" }, "windowsDeviceBlockedOnMissingPartnerData": { "type": "boolean" }, "windowsMobileApplicationManagementEnabled": { "type": "boolean" } } }, "EDR": { "type": "object", "properties": { "AssignTo": { "type": "string", "x-cipp-observed-values": [ "AllDevicesAndUsers", "none" ] }, "Config": { "type": "string" }, "SampleSharing": { "type": "string" } } }, "Exclusion": { "type": "object", "properties": { "AssignTo": { "type": "string" }, "excludedExtensions": { "type": "string" }, "excludedPaths": { "type": "string" }, "excludedProcesses": { "type": "string" } } }, "Policy": { "type": "object", "properties": { "AllowOnAccessProtection": { "$ref": "#/components/schemas/LabelValue" }, "AssignTo": { "type": "string", "x-cipp-observed-values": [ "AllDevicesAndUsers", "None" ] }, "CloudBlockLevel": { "$ref": "#/components/schemas/LabelValue" }, "EnableNetworkProtection": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Dynamic choice settings (value derived from a sub-property)" }, "Remediation": { "type": "object", "properties": { "High": { "$ref": "#/components/schemas/LabelValue" }, "Low": { "$ref": "#/components/schemas/LabelValue" }, "Moderate": { "$ref": "#/components/schemas/LabelValue" }, "Severe": { "$ref": "#/components/schemas/LabelValue" } }, "description": "Remediation (unique nested group structure)" }, "SubmitSamplesConsent": { "$ref": "#/components/schemas/LabelValue" } } }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-reads-via": [ "Set-CIPPDefenderASRPolicy", "Set-CIPPDefenderAVPolicy", "Set-CIPPDefenderCompliancePolicy", "Set-CIPPDefenderEDRPolicy", "Set-CIPPDefenderExclusionPolicy" ] } }, "/api/AddDefenderTemplate": { "post": { "summary": "AddDefenderTemplate", "operationId": "AddDefenderTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ASR": { "type": "object", "properties": { "AssignTo": { "type": "string", "x-cipp-observed-values": [ "AllDevicesAndUsers", "none" ] }, "Mode": { "type": "string", "description": "Fallback to block mode" } } }, "EDR": { "type": "object", "properties": { "AssignTo": { "type": "string", "x-cipp-observed-values": [ "AllDevicesAndUsers", "none" ] }, "Config": { "type": "string" }, "SampleSharing": { "type": "string" } } }, "Exclusion": { "type": "object", "properties": { "AssignTo": { "type": "string" }, "excludedExtensions": { "type": "string" }, "excludedPaths": { "type": "string" }, "excludedProcesses": { "type": "string" } } }, "package": { "type": "string" }, "Policy": { "type": "object", "properties": { "AllowOnAccessProtection": { "$ref": "#/components/schemas/LabelValue" }, "AssignTo": { "type": "string", "x-cipp-observed-values": [ "AllDevicesAndUsers", "None" ] }, "CloudBlockLevel": { "$ref": "#/components/schemas/LabelValue" }, "EnableNetworkProtection": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Dynamic choice settings (value derived from a sub-property)" }, "Remediation": { "type": "object", "properties": { "High": { "$ref": "#/components/schemas/LabelValue" }, "Low": { "$ref": "#/components/schemas/LabelValue" }, "Moderate": { "$ref": "#/components/schemas/LabelValue" }, "Severe": { "$ref": "#/components/schemas/LabelValue" } }, "description": "Remediation (unique nested group structure)" }, "SubmitSamplesConsent": { "$ref": "#/components/schemas/LabelValue" } } }, "templateName": { "type": "string" } }, "required": [ "templateName" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-reads-via": [ "Set-CIPPDefenderASRPolicy", "Set-CIPPDefenderAVPolicy", "Set-CIPPDefenderEDRPolicy", "Set-CIPPDefenderExclusionPolicy" ] } }, "/api/AddDlpCompliancePolicy": { "post": { "summary": "AddDlpCompliancePolicy", "operationId": "AddDlpCompliancePolicy", "tags": [ "Security > Compliance-DLP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" } }, "/api/AddDlpCompliancePolicyTemplate": { "post": { "summary": "AddDlpCompliancePolicyTemplate", "operationId": "AddDlpCompliancePolicyTemplate", "tags": [ "Security > Compliance-DLP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" } }, "/api/AddDomain": { "post": { "summary": "AddDomain", "operationId": "AddDomain", "tags": [ "Tenant > Administration > Domains" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "domain": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "domain", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/AddEdgeApp": { "post": { "summary": "AddEdgeApp", "operationId": "AddEdgeApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignTo": { "type": "string" }, "CustomGroup": { "type": "string" }, "displayLanguageLocale": { "$ref": "#/components/schemas/LabelValue" }, "edgeChannel": { "$ref": "#/components/schemas/LabelValue" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped." }, "IntuneBody": { "type": "string" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" } } } } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true, "x-cipp-reads-via": [ "Get-CIPPEdgeAppBody" ] } }, "/api/AddEditTransportRule": { "post": { "summary": "AddEditTransportRule", "operationId": "AddEditTransportRule", "tags": [ "Email-Exchange > Transport" ], "description": "This function creates a new transport rule or edits an existing one (mail flow rule).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ActivationDate": { "type": "string" }, "AnyOfCcHeader": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "AnyOfCcHeaderMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "AnyOfRecipientAddressContainsWords": { "type": "array", "items": { "type": "string" } }, "AnyOfRecipientAddressMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "AnyOfToCcHeader": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "AnyOfToCcHeaderMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "AnyOfToHeader": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "AnyOfToHeaderMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ApplyClassification": { "type": "string" }, "ApplyHtmlDisclaimerFallbackAction": { "$ref": "#/components/schemas/LabelValue" }, "ApplyHtmlDisclaimerLocation": { "$ref": "#/components/schemas/LabelValue" }, "ApplyHtmlDisclaimerText": { "type": "string" }, "ApplyOME": { "type": "string" }, "AttachmentContainsWords": { "type": "array", "items": { "type": "string" } }, "AttachmentExtensionMatchesWords": { "type": "array", "items": { "type": "string" } }, "AttachmentHasExecutableContent": { "type": "string" }, "AttachmentIsPasswordProtected": { "type": "string" }, "AttachmentIsUnsupported": { "type": "string" }, "AttachmentMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "AttachmentNameMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "AttachmentProcessingLimitExceeded": { "type": "string" }, "AttachmentPropertyContainsWords": { "type": "array", "items": { "type": "string" } }, "AttachmentSizeOver": { "type": "string" }, "BlindCopyTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "Comments": { "type": "string" }, "CopyTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "DeleteMessage": { "type": "string", "description": "Extract action fields" }, "Enabled": { "type": "string" }, "ExceptIfAnyOfCcHeader": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfAnyOfCcHeaderMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfAnyOfRecipientAddressContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfAnyOfRecipientAddressMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfAnyOfToCcHeader": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfAnyOfToCcHeaderMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfAnyOfToHeader": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfAnyOfToHeaderMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfAttachmentContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfAttachmentExtensionMatchesWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfAttachmentHasExecutableContent": { "type": "string" }, "ExceptIfAttachmentIsPasswordProtected": { "type": "string" }, "ExceptIfAttachmentIsUnsupported": { "type": "string" }, "ExceptIfAttachmentMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfAttachmentNameMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfAttachmentProcessingLimitExceeded": { "type": "string" }, "ExceptIfAttachmentPropertyContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfAttachmentSizeOver": { "type": "string" }, "ExceptIfFrom": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } }, "description": "Extract exception fields (ExceptIf versions)" }, "ExceptIfFromAddressContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfFromAddressMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfFromMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfFromScope": { "$ref": "#/components/schemas/LabelValue" }, "ExceptIfHeaderContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfHeaderContainsWordsMessageHeader": { "type": "string" }, "ExceptIfHeaderMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfHeaderMatchesPatternsMessageHeader": { "type": "string" }, "ExceptIfMessageSizeOver": { "type": "string" }, "ExceptIfMessageTypeMatches": { "$ref": "#/components/schemas/LabelValue" }, "ExceptIfRecipientAddressContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfRecipientAddressMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfRecipientDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSCLOver": { "$ref": "#/components/schemas/LabelValue" }, "ExceptIfSenderDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSenderIpRanges": { "type": "array", "items": { "type": "string" } }, "ExceptIfSentTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSentToMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSentToScope": { "$ref": "#/components/schemas/LabelValue" }, "ExceptIfSubjectContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfSubjectMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfSubjectOrBodyContainsWords": { "type": "array", "items": { "type": "string" } }, "ExceptIfSubjectOrBodyMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "ExceptIfWithImportance": { "$ref": "#/components/schemas/LabelValue" }, "ExpiryDate": { "type": "string" }, "From": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } }, "description": "Extract condition fields" }, "FromAddressContainsWords": { "type": "array", "items": { "type": "string" } }, "FromAddressMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "FromMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "FromScope": { "$ref": "#/components/schemas/LabelValue" }, "GenerateIncidentReport": { "type": "array", "items": { "type": "string" } }, "GenerateNotification": { "type": "string" }, "HeaderContainsWords": { "type": "array", "items": { "type": "string" } }, "HeaderContainsWordsMessageHeader": { "type": "string" }, "HeaderMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "HeaderMatchesPatternsMessageHeader": { "type": "string" }, "IncidentReportContent": { "type": "array", "items": { "type": "string" } }, "MessageSizeOver": { "type": "string" }, "MessageTypeMatches": { "$ref": "#/components/schemas/LabelValue" }, "Mode": { "$ref": "#/components/schemas/LabelValue" }, "ModerateMessageByManager": { "type": "string" }, "ModerateMessageByUser": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "Name": { "type": "string" }, "PrependSubject": { "type": "string" }, "Priority": { "type": "string" }, "Quarantine": { "type": "string" }, "RecipientAddressContainsWords": { "type": "array", "items": { "type": "string" } }, "RecipientAddressMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "RecipientDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "RedirectMessageTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "RejectMessageEnhancedStatusCode": { "type": "string" }, "RejectMessageReasonText": { "type": "string" }, "RemoveHeader": { "type": "string" }, "RouteMessageOutboundConnector": { "type": "string" }, "ruleId": { "type": "string", "description": "Extract basic rule settings from body" }, "SCLOver": { "$ref": "#/components/schemas/LabelValue" }, "SenderAddressLocation": { "$ref": "#/components/schemas/LabelValue" }, "SenderDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "SenderIpRanges": { "type": "array", "items": { "type": "string" } }, "SentTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "SentToMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "SentToScope": { "$ref": "#/components/schemas/LabelValue" }, "SetAuditSeverity": { "$ref": "#/components/schemas/LabelValue" }, "SetHeaderName": { "type": "string" }, "SetHeaderValue": { "type": "string" }, "SetSCL": { "$ref": "#/components/schemas/LabelValue" }, "State": { "type": "string" }, "StopRuleProcessing": { "type": "string" }, "SubjectContainsWords": { "type": "array", "items": { "type": "string" } }, "SubjectMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "SubjectOrBodyContainsWords": { "type": "array", "items": { "type": "string" } }, "SubjectOrBodyMatchesPatterns": { "type": "array", "items": { "type": "string" } }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "WithImportance": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.ReadWrite", "x-cipp-reads-via": [ "ConvertTo-FieldArray" ] } }, "/api/AddEnrollment": { "post": { "summary": "AddEnrollment", "operationId": "AddEnrollment", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AllowFail": { "type": "string" }, "AllowReset": { "type": "string" }, "blockDevice": { "type": "string" }, "EnableLog": { "type": "string" }, "ErrorMessage": { "type": "string" }, "InstallWindowsUpdates": { "type": "string" }, "OBEEOnly": { "type": "string" }, "selectedTenants": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Input bindings are passed in via param block." }, "ShowProgress": { "type": "string" }, "TimeOutInMinutes": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/AddEquipmentMailbox": { "post": { "summary": "AddEquipmentMailbox", "operationId": "AddEquipmentMailbox", "tags": [ "Email-Exchange > Resources" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "tenantID": { "type": "string" }, "username": { "type": "string" }, "userPrincipalName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Equipment.ReadWrite" } }, "/api/AddExConnector": { "post": { "summary": "AddExConnector", "operationId": "AddExConnector", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddExConnectorTemplate": { "post": { "summary": "AddExConnectorTemplate", "operationId": "AddExConnectorTemplate", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "cippconnectortype": { "type": "string" }, "name": { "type": "string", "description": "Posted from the row action; without a name the template lists blank." } }, "required": [ "name" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddGroup": { "post": { "summary": "AddGroup", "operationId": "AddGroup", "tags": [ "Identity > Administration > Groups" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "aliases": { "type": "string" }, "allowExternal": { "type": "boolean", "description": "Set external sender restrictions if specified" }, "description": { "type": "string" }, "disableNesting": { "type": "boolean" }, "displayName": { "type": "string", "description": "Regular Distribution Group" }, "groupType": { "type": "string", "description": "Normalize group type for consistent handling (accept camelCase from templates)" }, "hideFromGAL": { "type": "string" }, "licenses": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Assign licenses for Security groups" }, "members": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Add members (only for non-dynamic groups)" }, "membershipRules": { "type": "string", "description": "Handle dynamic membership" }, "owners": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Add owners" }, "primaryEmailAddress": { "type": "string" }, "primDomain": { "$ref": "#/components/schemas/LabelValue" }, "subscribeMembers": { "type": "string" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" }, "username": { "type": "string", "description": "Username already contains an email address (e.g., from templates with @%tenantfilter%)" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.ReadWrite", "x-cipp-reads-via": [ "New-CIPPGroup" ] } }, "/api/AddGroupTeam": { "post": { "summary": "AddGroupTeam", "operationId": "AddGroupTeam", "tags": [ "Identity > Administration > Groups" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GroupId": { "type": "string" }, "TeamSettings": { "type": "string", "description": "Default team settings - can be customized via request body" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "allowExternalSenders": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "assignedLabels": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "autoSubscribeNewMembers": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "classification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "expirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "groupTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "hasMembersWithLicenseErrors": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromAddressLists": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromOutlookClients": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isArchived": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isAssignableToRole": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFavorite": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSubscribedByMail": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "licenseProcessingState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRule": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesNetBiosName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "organizationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "renewedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceBehaviorOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "resourceProvisioningOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "theme": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "unseenConversationsCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenMessagesCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "visibility": { "type": "string", "x-cipp-field-source": "graph-entity" }, "welcomeMessageEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "writebackConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.ReadWrite" } }, "/api/AddGroupTemplate": { "post": { "summary": "AddGroupTemplate", "operationId": "AddGroupTemplate", "tags": [ "Identity > Administration > Groups" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "aliases": { "type": "string", "description": "One per line, variables allowed" }, "allowExternal": { "type": "string" }, "description": { "type": "string" }, "displayName": { "type": "string", "description": "Normalize field names to handle different casing from various forms" }, "groupType": { "type": "string", "description": "Normalize group type to match New-CIPPGroup expectations Handle values from ListGroups calculatedGroupType and frontend form values" }, "GUID": { "type": "string" }, "hideFromGAL": { "type": "string" }, "licenses": { "type": "string" }, "membershipRules": { "type": "string", "description": "Override to dynamic if membership rules are provided (for backward compatibility) but only if it's not already a dynamicDistribution group" }, "username": { "type": "string", "description": "Can contain variables like @%tenantfilter%" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddGuest": { "post": { "summary": "AddGuest", "operationId": "AddGuest", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "mail": { "type": "string" }, "message": { "type": "string" }, "redirectUri": { "type": "string" }, "sendInvite": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/AddIntunePolicyClone": { "post": { "summary": "AddIntunePolicyClone", "operationId": "AddIntunePolicyClone", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "newDescription": { "type": "string" }, "newDisplayName": { "type": "string" }, "ODataType": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the body of the request." }, "URLName": { "type": "string" } }, "required": [ "newDisplayName", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/AddIntuneReusableSetting": { "post": { "summary": "AddIntuneReusableSetting", "operationId": "AddIntuneReusableSetting", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "TemplateId": { "type": "string" }, "TemplateList": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "TemplateId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/AddIntuneReusableSettingTemplate": { "post": { "summary": "AddIntuneReusableSettingTemplate", "operationId": "AddIntuneReusableSettingTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string" }, "displayName": { "type": "string" }, "GUID": { "type": "string" }, "json": { "type": "string" }, "rawJSON": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddIntuneTemplate": { "post": { "summary": "AddIntuneTemplate", "operationId": "AddIntuneTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string" }, "displayName": { "type": "string" }, "ID": { "type": "string" }, "ODataType": { "type": "string" }, "RawJSON": { "type": "string" }, "TemplateType": { "type": "string" }, "tenantFilter": { "type": "string" }, "URLName": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ODataType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "URLName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddJITAdminTemplate": { "post": { "summary": "AddJITAdminTemplate", "operationId": "AddJITAdminTemplate", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "defaultDomain": { "type": "string", "description": "defaultDomain is only saved for specific tenant templates (not AllTenants)" }, "defaultDuration": { "type": "string" }, "defaultExistingUser": { "type": "string", "description": "Add existing user selection when \"select\" action is specified" }, "defaultExpireAction": { "type": "string" }, "defaultFirstName": { "type": "string", "description": "These fields can be saved for both AllTenants and specific tenant templates" }, "defaultForTenant": { "type": "boolean" }, "defaultGroups": { "type": "string" }, "defaultLastName": { "type": "string" }, "defaultNotificationActions": { "type": "string" }, "defaultRoles": { "type": "string" }, "defaultUsageLocation": { "$ref": "#/components/schemas/LabelValue" }, "defaultUseGroups": { "type": "boolean" }, "defaultUserAction": { "type": "string", "description": "Validate user action fields" }, "defaultUserName": { "type": "string" }, "defaultUseRoles": { "type": "boolean" }, "defaultVacationCAPolicy": { "type": "string" }, "defaultVacationExcludeAuditAlerts": { "type": "boolean" }, "defaultVacationMode": { "type": "boolean" }, "generateTAPByDefault": { "type": "boolean" }, "reasonTemplate": { "type": "string" }, "templateName": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Extract data from request body" } }, "required": [ "templateName", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/AddJITRoleTemplate": { "post": { "summary": "AddJITRoleTemplate", "operationId": "AddJITRoleTemplate", "tags": [ "Identity > Administration > Users" ], "description": "Creates a JIT Role Template - a named allow-list of directory roles that can be assigned to a\nCIPP custom role to restrict which roles that role's members may grant via JIT Admin.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "roles": { "type": "string" }, "templateName": { "type": "string" } }, "required": [ "templateName" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/AddMSPApp": { "post": { "summary": "AddMSPApp", "operationId": "AddMSPApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignTo": { "type": "string" }, "CustomGroup": { "type": "string" }, "DisplayName": { "type": "string" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped." }, "PackageName": { "type": "string", "description": "Build the install/uninstall command lines for this tenant. Get-CIPPMSPAppInstallCommand resolves each param whether it is a per-tenant keyed value (interactive deploy) or a flat value / %CIPP variable% (Application Template deploy)." }, "params": { "type": "string", "description": "Build the install/uninstall command lines for this tenant. Get-CIPPMSPAppInstallCommand resolves each param whether it is a per-tenant keyed value (interactive deploy) or a flat value / %CIPP variable% (Application Template deploy)." }, "RMMName": { "$ref": "#/components/schemas/LabelValue" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" } } } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "207": { "description": "MultiStatus" }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddNamedLocation": { "post": { "summary": "AddNamedLocation", "operationId": "AddNamedLocation", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Countries": { "$ref": "#/components/schemas/LabelValue" }, "includeUnknownCountriesAndRegions": { "type": "string" }, "Ips": { "type": "string" }, "policyName": { "type": "string" }, "selectedTenants": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Input bindings are passed in via param block." }, "Trusted": { "type": "string" }, "Type": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "modifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddOfficeApp": { "post": { "summary": "AddOfficeApp", "operationId": "AddOfficeApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AcceptLicense": { "type": "boolean" }, "arch": { "type": "string" }, "AssignTo": { "type": "string" }, "CustomGroup": { "type": "string" }, "customXml": { "type": "string" }, "excludedApps": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Standard configuration built from the individual form fields. Multi-select fields arrive as {label, value} objects from the frontend, but templates and API callers may send plain strings, so accept both." }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped." }, "IntuneBody": { "type": "string", "description": "A template saved from an existing app carries the full body: reuse it, minus the read-only properties Graph rejects on create." }, "languages": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "RemoveVersions": { "type": "boolean" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" } } } }, "SharedComputerActivation": { "type": "boolean" }, "updateChannel": { "$ref": "#/components/schemas/LabelValue" }, "useCustomXml": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true, "x-cipp-reads-via": [ "Get-CIPPOfficeAppBody" ] } }, "/api/AddPIMRoleSettingsTemplate": { "post": { "summary": "Create or update a PIM role settings template.", "operationId": "AddPIMRoleSettingsTemplate", "tags": [ "Identity > Administration > Roles" ], "description": "Saves a Privileged Identity Management role settings template. The settings are validated against CIPP's secure floor (activation must expire within 24 hours and require MFA or an authentication context plus a justification; eligibilities and active assignments must expire within a year; active assignments must require a justification). A template below the floor is rejected with the list of problems rather than silently adjusted. Pass GUID to update an existing template. Pass captureRoleId with a tenantFilter to build the settings from that role's current PIM policy in the tenant instead of supplying them: values below the secure floor are raised to the closest value the floor allows and every raise is reported in the results.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "captureRoleId": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Capture mode: build the settings from a role's current PIM policy in a tenant." }, "captureRoleName": { "type": "string" }, "description": { "type": "string" }, "GUID": { "type": "string", "description": "Existing template GUID when editing." }, "roles": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Roles (label/value pairs of role template ids) when roleScope is Custom." }, "roleScope": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "PrivilegedRoles | AllRoles | Custom" }, "settings": { "type": "string" }, "templateName": { "type": "string" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddPolicy": { "post": { "summary": "AddPolicy", "operationId": "AddPolicy", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "assignmentFilter": { "type": "string" }, "AssignmentFilterName": { "type": "string" }, "AssignmentFilterType": { "type": "string" }, "AssignTo": { "type": "string" }, "customGroup": { "type": "string" }, "Description": { "type": "string" }, "displayName": { "type": "string" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Sent by the deploy drawer when a single tenant is selected and groups were picked by id. customGroup/excludeGroup still carry the display names for logging and as a fallback." }, "RAWJson": { "type": "string" }, "replacemap": { "type": "string" }, "ReusableSettings": { "type": "array", "items": { "type": "string" } }, "TemplateGuid": { "type": "string", "description": "The deploy drawer and wizard send the chosen row's GUID as TemplateList.value, not as TemplateID. Template display names are not unique - re-imports create same-named twins - so resolving by display name below can land on a different row than the one the user picked. The selected RowKey must win whenever the request carries one. String rather than Guid: built-in templates are stored with their filename as RowKey." }, "TemplateID": { "type": "string", "description": "The deploy drawer and wizard send the chosen row's GUID as TemplateList.value, not as TemplateID. Template display names are not unique - re-imports create same-named twins - so resolving by display name below can land on a different row than the one the user picked. The selected RowKey must win whenever the request carries one. String rather than Guid: built-in templates are stored with their filename as RowKey." }, "TemplateList": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "The deploy drawer and wizard send the chosen row's GUID as TemplateList.value, not as TemplateID. Template display names are not unique - re-imports create same-named twins - so resolving by display name below can land on a different row than the one the user picked. The selected RowKey must win whenever the request carries one. String rather than Guid: built-in templates are stored with their filename as RowKey." }, "TemplateType": { "type": "string" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/AddQuarantinePolicy": { "post": { "summary": "AddQuarantinePolicy", "operationId": "AddQuarantinePolicy", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AllowSender": { "type": "string" }, "BlockSender": { "type": "string" }, "Delete": { "type": "string" }, "IncludeMessagesFromBlockedSenderAddress": { "type": "string" }, "Name": { "type": "string" }, "Preview": { "type": "string" }, "QuarantineNotification": { "type": "string" }, "ReleaseActionPreference": { "$ref": "#/components/schemas/LabelValue" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Spamfilter.ReadWrite" } }, "/api/AddRetentionCompliancePolicy": { "post": { "summary": "AddRetentionCompliancePolicy", "operationId": "AddRetentionCompliancePolicy", "tags": [ "Security > Compliance-Retention" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.ReadWrite" } }, "/api/AddRetentionCompliancePolicyTemplate": { "post": { "summary": "AddRetentionCompliancePolicyTemplate", "operationId": "AddRetentionCompliancePolicyTemplate", "tags": [ "Security > Compliance-Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "PowerShellCommand": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.ReadWrite" } }, "/api/AddRoomList": { "post": { "summary": "AddRoomList", "operationId": "AddRoomList", "tags": [ "Email-Exchange > Resources" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "primDomain": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Construct email address from username and domain" }, "tenantFilter": { "type": "string" }, "tenantid": { "type": "string" }, "username": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Room.ReadWrite" } }, "/api/AddRoomMailbox": { "post": { "summary": "AddRoomMailbox", "operationId": "AddRoomMailbox", "tags": [ "Email-Exchange > Resources" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "ResourceCapacity": { "type": "string" }, "tenantid": { "type": "string" }, "username": { "type": "string" }, "userPrincipalName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Room.ReadWrite" } }, "/api/AddSafeLinksPolicyFromTemplate": { "post": { "summary": "AddSafeLinksPolicyFromTemplate", "operationId": "AddSafeLinksPolicyFromTemplate", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function deploys SafeLinks policies and rules from templates to selected tenants.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "selectedTenants": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Extract tenant IDs from selectedTenants" }, "TemplateList": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Extract templates from TemplateList" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.ReadWrite" } }, "/api/AddSafeLinksPolicyTemplate": { "post": { "summary": "AddSafeLinksPolicyTemplate", "operationId": "AddSafeLinksPolicyTemplate", "tags": [ "Security > Safe-Links-Policy" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AdminDisplayName": { "type": "string", "description": "For templates, if no specific policy description is provided, use template description as default" }, "Description": { "type": "string", "description": "For templates, if no specific policy description is provided, use template description as default" }, "Name": { "type": "string", "description": "Validate required fields. The \"create template from policy\" row action posts the policy row, which carries Name/PolicyName but no TemplateName." }, "PolicyName": { "type": "string", "description": "Set name and comments - prioritize template-specific fields, falling back to the policy name so a template made from a policy is not listed with a blank name." }, "TemplateDescription": { "type": "string" }, "TemplateName": { "type": "string", "description": "Validate required fields. The \"create template from policy\" row action posts the policy row, which carries Name/PolicyName but no TemplateName." } }, "required": [ "PolicyName" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddScheduledItem": { "post": { "summary": "AddScheduledItem", "operationId": "AddScheduledItem", "tags": [ "CIPP > Scheduler" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "DesiredStartTime": { "type": "string" }, "DisallowDuplicateName": { "type": "string" }, "RowKey": { "type": "string" }, "RunNow": { "type": "boolean" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "parameters": [ { "name": "DisallowDuplicateName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "hidden", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Scheduler.ReadWrite" } }, "/api/AddScriptedAlert": { "post": { "summary": "AddScriptedAlert", "operationId": "AddScriptedAlert", "tags": [ "Tenant > Administration > Alerts" ], "description": "Creates or updates a scripted CIPP alert, stored as a hidden scheduled task.\n\nA selection of two or more tenants or groups is stored verbatim and expanded on every run,\nso tenant group membership is always current.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "excludedTenants": { "type": "string", "description": "Tenants or tenant groups to skip even when they fall within the selection above. Optional." }, "tenantFilter": { "type": "array", "items": { "type": "string" }, "description": "The tenants, tenant groups or *All Tenants the alert applies to. At least one is required." } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite" } }, "/api/AddSensitiveInfoType": { "post": { "summary": "AddSensitiveInfoType", "operationId": "AddSensitiveInfoType", "tags": [ "Security > Compliance-SIT" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.ReadWrite" } }, "/api/AddSensitiveInfoTypeTemplate": { "post": { "summary": "AddSensitiveInfoTypeTemplate", "operationId": "AddSensitiveInfoTypeTemplate", "tags": [ "Security > Compliance-SIT" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Id": { "type": "string" }, "Identity": { "type": "string" }, "Name": { "type": "string" }, "PowerShellCommand": { "type": "string", "description": "--- Path B: JSON-authored template (simple Pattern or advanced FileDataBase64) ---" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.ReadWrite" } }, "/api/AddSensitivityLabel": { "post": { "summary": "AddSensitivityLabel", "operationId": "AddSensitivityLabel", "tags": [ "Security > Compliance-SensitivityLabel" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.ReadWrite" } }, "/api/AddSensitivityLabelTemplate": { "post": { "summary": "AddSensitivityLabelTemplate", "operationId": "AddSensitivityLabelTemplate", "tags": [ "Security > Compliance-SensitivityLabel" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Encryption rights granted to the source tenant's own domain would follow the template into every other tenant. Swap them for %defaultdomain% so each deploy resolves to the target tenant instead." } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.ReadWrite" } }, "/api/AddSharedMailbox": { "post": { "summary": "AddSharedMailbox", "operationId": "AddSharedMailbox", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "addedAliases": { "type": "string" }, "displayName": { "type": "string" }, "domain": { "type": "string" }, "tenantID": { "type": "string" }, "username": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/AddSite": { "post": { "summary": "AddSite", "operationId": "AddSite", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "isPublic": { "type": "boolean" }, "sensitivityLabel": { "type": "string" }, "siteDescription": { "type": "string" }, "siteDesign": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Optional. Only applies to the Team and Communication templates; omitted for TeamGroup." }, "siteName": { "type": "string" }, "siteOwner": { "$ref": "#/components/schemas/LabelValue" }, "templateName": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/AddSiteBulk": { "post": { "summary": "AddSiteBulk", "operationId": "AddSiteBulk", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "bulkSites": { "type": "array", "items": { "type": "object", "properties": { "isPublic": { "type": "string" }, "sensitivityLabel": { "type": "string" }, "siteDescription": { "type": "string" }, "siteDesign": { "type": "string", "description": "Optional. Only applies to the Team and Communication templates; leave blank for TeamGroup." }, "siteName": { "type": "string" }, "siteOwner": { "type": "string" }, "templateName": { "type": "string" } } } }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/AddSpamFilter": { "post": { "summary": "AddSpamFilter", "operationId": "AddSpamFilter", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "Priority": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddSpamFilterTemplate": { "post": { "summary": "AddSpamFilterTemplate", "operationId": "AddSpamFilterTemplate", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "PowerShellCommand": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Spamfilter.ReadWrite" } }, "/api/AddStandardsDeploy": { "post": { "summary": "AddStandardsDeploy", "operationId": "AddStandardsDeploy", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/AddStandardsTemplate": { "post": { "summary": "AddStandardsTemplate", "operationId": "AddStandardsTemplate", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "createdAt": { "type": "string" }, "GitHub": { "type": "object", "properties": { "FullName": { "type": "string" }, "Message": { "type": "string" } }, "description": "Optional. Pushes the saved template to a GitHub template repository after the save: FullName is the repository (owner/repo), Message is the commit message. Not stored on the template." }, "GUID": { "type": "string" }, "standards": { "type": "string", "description": "Drop standards toggled on but left with no instances (empty array) - e.g. a template standard whose last selection was removed in the editor, which leaves 'standards. = []' in the form. Persisting these produces phantom 'NOT FOUND' drift entries with no template to compare against." }, "templateName": { "type": "string" }, "tenantFilter": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddStoreApp": { "post": { "summary": "AddStoreApp", "operationId": "AddStoreApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ApplicationName": { "type": "string" }, "AssignTo": { "type": "string" }, "CustomGroup": { "type": "string" }, "description": { "type": "string" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped." }, "InstallAsSystem": { "type": "boolean", "description": "winGetAppInstallExperience only supports runAsAccount (no restart behavior). Default to system when the toggle is absent so older callers keep the previous behavior." }, "InstallationIntent": { "type": "string" }, "PackageName": { "type": "string" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" } } } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddTeam": { "post": { "summary": "AddTeam", "operationId": "AddTeam", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string" }, "displayName": { "type": "string" }, "owner": { "type": "string" }, "tenantid": { "type": "string" }, "visibility": { "type": "string" } }, "required": [ "owner" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Group.ReadWrite" } }, "/api/AddTenant": { "post": { "summary": "AddTenant", "operationId": "AddTenant", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "AddTenant", "GetOrganizationProfile", "ValidateAddress", "ValidateDomain" ], "description": "Interact with query parameters or the body of the request." }, "AddressLine1": { "type": "string" }, "AddressLine2": { "type": "string" }, "City": { "type": "string" }, "CompanyName": { "type": "string" }, "Country": { "type": "string" }, "Email": { "type": "string" }, "FirstName": { "type": "string" }, "LastName": { "type": "string" }, "PhoneNumber": { "type": "string" }, "PostalCode": { "type": "string" }, "State": { "type": "string" }, "TenantName": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } }, { "name": "TenantName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "certificateConnectorSetting": { "type": "object", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "countryLetterCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultUsageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "directorySizeQuota": { "type": "object", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isMultipleDataLocationsForServicesEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "marketingNotificationEmails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mobileDeviceManagementAuthority": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesLastPasswordSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "partnerTenantType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "privacyProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityComplianceNotificationMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityComplianceNotificationPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "street": { "type": "string", "x-cipp-field-source": "graph-entity" }, "technicalNotificationMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "tenantType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedDomains": { "type": "array", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Config.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddTenantAllowBlockList": { "post": { "summary": "AddTenantAllowBlockList", "operationId": "AddTenantAllowBlockList", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "entries": { "type": "string" }, "listMethod": { "type": "string" }, "listType": { "type": "string" }, "NoExpiration": { "type": "boolean" }, "notes": { "type": "string" }, "RemoveAfter": { "type": "boolean" }, "tenantID": { "$ref": "#/components/schemas/LabelValue" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/AddTenantAllowBlockListTemplate": { "post": { "summary": "AddTenantAllowBlockListTemplate", "operationId": "AddTenantAllowBlockListTemplate", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "entries": { "type": "string" }, "listMethod": { "type": "string" }, "listType": { "type": "string" }, "NoExpiration": { "type": "boolean" }, "notes": { "type": "string" }, "RemoveAfter": { "type": "boolean" }, "templateName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddTestReport": { "post": { "summary": "AddTestReport", "operationId": "AddTestReport", "tags": [ "Tenant > Tests" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CustomTests": { "type": "string" }, "description": { "type": "string" }, "DevicesTests": { "type": "string" }, "IdentityTests": { "type": "string" }, "name": { "type": "array", "items": { "type": "string" }, "description": "Validate required fields" }, "ReportId": { "type": "string", "description": "Use existing ReportId for updates, otherwise generate a new ID" } }, "required": [ "name" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CreatedAt": { "x-cipp-field-source": "storage" }, "CustomTests": { "type": "string", "x-cipp-field-source": "storage" }, "description": { "type": "string", "x-cipp-field-source": "storage" }, "DevicesTests": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "IdentityTests": { "type": "string", "x-cipp-field-source": "storage" }, "name": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "ReportId": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedAt": { "type": "string", "x-cipp-field-source": "storage" }, "version": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Dashboard.Read" } }, "/api/AddTransportRule": { "post": { "summary": "AddTransportRule", "operationId": "AddTransportRule", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PowerShellCommand": { "type": "string" }, "selectedTenants": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddTransportTemplate": { "post": { "summary": "AddTransportTemplate", "operationId": "AddTransportTemplate", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Name": { "type": "string", "description": "Posted from the row action; without a name the template lists blank and deploys with no parameters." }, "PowerShellCommand": { "type": "string", "description": "Posted from the row action; without a name the template lists blank and deploys with no parameters." } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.ReadWrite", "x-cipp-any-tenant": true } }, "/api/AddUser": { "post": { "summary": "AddUser", "operationId": "AddUser", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AddedAliases": { "type": "string" }, "AddToGroups": { "type": "string", "description": "Add to groups" }, "businessPhones": { "type": "string" }, "city": { "type": "string" }, "companyName": { "type": "string" }, "copyFrom": { "$ref": "#/components/schemas/LabelValue" }, "country": { "type": "string" }, "customData": { "type": "string" }, "defaultAttributes": { "type": "string" }, "department": { "type": "string" }, "DisplayName": { "type": "string" }, "Domain": { "type": "string" }, "givenName": { "type": "string" }, "jobTitle": { "type": "string" }, "licenses": { "$ref": "#/components/schemas/LabelValue" }, "mailNickname": { "type": "string" }, "mobilePhone": { "type": "string" }, "MustChangePass": { "type": "boolean" }, "otherMails": { "type": "string" }, "password": { "type": "string" }, "perUserMfa": { "type": "boolean" }, "postalCode": { "type": "string" }, "PostExecution": { "type": "object", "properties": { "Email": { "type": "boolean" }, "PSA": { "type": "boolean" }, "Push": { "type": "boolean" }, "Webhook": { "type": "boolean" } } }, "PrimDomain": { "$ref": "#/components/schemas/LabelValue" }, "PsaTicketId": { "type": "string" }, "reference": { "type": "string" }, "Scheduled": { "type": "object", "properties": { "date": { "type": "string" }, "Enabled": { "type": "string" } } }, "setManager": { "$ref": "#/components/schemas/LabelValue" }, "setSponsor": { "$ref": "#/components/schemas/LabelValue" }, "sharedCalendarPermission": { "$ref": "#/components/schemas/LabelValue" }, "sharedCalendars": { "type": "string", "description": "Give the user access to the tenant's shared calendars and shared mailboxes. Both are always scheduled instead of run inline: a freshly created user is not a usable Exchange recipient for several minutes, so Add-MailboxFolderPermission / Add-MailboxPermission would fail right now." }, "sharedMailboxes": { "type": "string", "description": "Give the user access to the tenant's shared calendars and shared mailboxes. Both are always scheduled instead of run inline: a freshly created user is not a usable Exchange recipient for several minutes, so Add-MailboxFolderPermission / Add-MailboxPermission would fail right now." }, "sharedMailboxPermission": { "type": "string", "description": "Set-CIPPMailboxPermission takes a single level, so Full Access plus Send As means one task per level. They are separate Exchange operations anyway." }, "sharePointSiteRole": { "$ref": "#/components/schemas/LabelValue" }, "sharePointSites": { "type": "string", "description": "SharePoint site membership is scheduled instead of run inline: a freshly created account cannot be resolved on a site (ensureuser) until it has replicated to SharePoint." }, "sherwebLicense": { "$ref": "#/components/schemas/LabelValue" }, "state": { "type": "string" }, "streetAddress": { "type": "string" }, "surname": { "type": "string" }, "tenantFilter": { "type": "string", "description": "User creation is single-tenant only. Without this guard an 'AllTenants' (or otherwise unresolvable) tenantFilter fails Get-AuthorisedRequest, the Graph write helpers return $null non-terminating, and the endpoint reports success while creating nothing." }, "usageLocation": { "$ref": "#/components/schemas/LabelValue" }, "username": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "CopyFrom": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" }, "User": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite", "x-cipp-reads-via": [ "New-CIPPUser", "New-CIPPUserTask" ] } }, "/api/AddUserBulk": { "post": { "summary": "AddUserBulk", "operationId": "AddUserBulk", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "BulkUser": { "type": "array", "items": { "type": "object", "properties": { "businessPhones": { "type": "string", "description": "Convert businessPhones to array if not null or empty" }, "displayName": { "type": "string" }, "domain": { "type": "string" }, "givenName": { "type": "string" }, "mailNickName": { "type": "string" }, "password": { "type": "string", "description": "Create user body with required properties" }, "surname": { "type": "string" } } } }, "licenses": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string", "description": "Interact with body parameters or the body of the request." }, "usageLocation": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/AddUserDefaults": { "post": { "summary": "AddUserDefaults", "operationId": "AddUserDefaults", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "addedAliases": { "type": "string" }, "addToGroups": { "type": "string", "description": "Groups" }, "Autopassword": { "type": "string", "description": "Settings" }, "businessPhones": { "type": "string" }, "businessPhones[0]": { "type": "string" }, "city": { "type": "string" }, "companyName": { "type": "string" }, "copyFrom": { "type": "string" }, "country": { "type": "string" }, "defaultAttributes": { "type": "string" }, "defaultForTenant": { "type": "string" }, "department": { "type": "string" }, "displayName": { "type": "string" }, "givenName": { "type": "string", "description": "User fields" }, "groupMemberships": { "type": "string", "description": "Groups" }, "GUID": { "type": "string", "description": "Use existing GUID if editing, otherwise generate new one" }, "jobTitle": { "type": "string", "description": "Job and Location fields" }, "licenses": { "type": "string" }, "mobilePhone": { "type": "string", "description": "Contact fields" }, "MustChangePass": { "type": "string" }, "otherMails": { "type": "string" }, "password": { "type": "string" }, "perUserMfa": { "type": "string" }, "postalCode": { "type": "string" }, "primDomain": { "$ref": "#/components/schemas/LabelValue" }, "removeLicenses": { "type": "string" }, "setManager": { "type": "string", "description": "User relations" }, "setSponsor": { "type": "string" }, "sharedCalendarPermission": { "$ref": "#/components/schemas/LabelValue" }, "sharedCalendars": { "type": "string", "description": "Shared calendars new users get an invitation to" }, "sharedMailboxes": { "type": "string", "description": "Shared mailboxes new users get access to. The permission is a multi-select (Full Access and Send As are commonly granted together), so it is stored as posted." }, "sharedMailboxPermission": { "type": "string" }, "sharePointSiteRole": { "$ref": "#/components/schemas/LabelValue" }, "sharePointSites": { "type": "string", "description": "SharePoint sites new users are added to, with one role for all of them" }, "state": { "type": "string" }, "streetAddress": { "type": "string" }, "surname": { "type": "string" }, "templateName": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Extract data from request body - matching CippAddEditUser.jsx field names" }, "usageLocation": { "$ref": "#/components/schemas/LabelValue" }, "usernameFormat": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Handle autocomplete fields - extract value if it's an object" }, "usernameSpaceHandling": { "$ref": "#/components/schemas/LabelValue" }, "usernameSpaceReplacement": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/AddWin32ScriptApp": { "post": { "summary": "AddWin32ScriptApp", "operationId": "AddWin32ScriptApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ApplicationName": { "type": "string", "description": "Validate required fields" }, "AssignTo": { "type": "string" }, "CustomGroup": { "type": "string" }, "description": { "type": "string" }, "detectionFile": { "type": "string" }, "detectionPath": { "type": "string" }, "detectionScript": { "type": "string" }, "DisableRestart": { "type": "string" }, "enforceSignatureCheck": { "type": "boolean" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "GroupIds": { "type": "string", "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped." }, "InstallAsSystem": { "type": "string" }, "InstallationIntent": { "type": "string" }, "installScript": { "type": "string" }, "publisher": { "type": "string" }, "runAs32Bit": { "type": "boolean" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" } } } }, "uninstallScript": { "type": "string" } }, "required": [ "installScript" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/CreateSafeLinksPolicyTemplate": { "post": { "summary": "CreateSafeLinksPolicyTemplate", "operationId": "CreateSafeLinksPolicyTemplate", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function creates a new Safe Links policy template from scratch.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "TemplateDescription": { "type": "string" }, "TemplateName": { "type": "string", "description": "Set name and comments first" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.ReadWrite", "x-cipp-any-tenant": true } }, "/api/DeleteSharepointSite": { "post": { "summary": "DeleteSharepointSite", "operationId": "DeleteSharepointSite", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "SiteId": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "SiteId", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/DeleteTestReport": { "post": { "summary": "DeleteTestReport", "operationId": "DeleteTestReport", "tags": [ "Tenant > Tests" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ReportId": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CreatedAt": { "x-cipp-field-source": "storage" }, "CustomTests": { "type": "string", "x-cipp-field-source": "storage" }, "description": { "type": "string", "x-cipp-field-source": "storage" }, "DevicesTests": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "IdentityTests": { "type": "string", "x-cipp-field-source": "storage" }, "name": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedAt": { "type": "string", "x-cipp-field-source": "storage" }, "version": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Dashboard.Read" } }, "/api/DeployContactTemplates": { "post": { "summary": "DeployContactTemplates", "operationId": "DeployContactTemplates", "tags": [ "Email-Exchange > Administration > Contacts" ], "description": "This function deploys contact(s) from template(s) to selected tenants.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "selectedTenants": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "TemplateList": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Templates are provided in TemplateList format" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite" } }, "/api/DomainAnalyser_List": { "get": { "summary": "DomainAnalyser_List", "operationId": "DomainAnalyser_List", "tags": [ "Tenant > Standards" ], "description": "Returns the cached Domain Analyser results: the DNS health of each tenant's domains, covering MX, SPF, DKIM, DMARC and DNSSEC. Populated by a scheduled job, so this reads the last run rather than resolving DNS live. tenantFilter=AllTenants returns every tenant's domains.", "parameters": [ { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "DkimSelectors": { "x-cipp-field-source": "storage" }, "DomainAnalyser": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "MailProviders": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "TenantDetails": { "x-cipp-field-source": "storage" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.DomainAnalyser.Read", "x-cipp-any-tenant": true } }, "/api/EditAntiPhishingFilter": { "post": { "summary": "EditAntiPhishingFilter", "operationId": "EditAntiPhishingFilter", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "RuleName": { "type": "string" }, "State": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "RuleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Disable", "Enable" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/EditAssignmentFilter": { "post": { "summary": "EditAssignmentFilter", "operationId": "EditAssignmentFilter", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string" }, "displayName": { "type": "string" }, "filterId": { "type": "string" }, "rule": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/EditCAPolicy": { "post": { "summary": "EditCAPolicy", "operationId": "EditCAPolicy", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "newDisplayName": { "type": "string" }, "State": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the request" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "newDisplayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/EditContact": { "post": { "summary": "EditContact", "operationId": "EditContact", "tags": [ "Email-Exchange > Administration > Contacts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "City": { "type": "string" }, "Company": { "type": "string" }, "ContactID": { "type": "string" }, "CountryOrRegion": { "type": "string" }, "displayName": { "type": "string" }, "email": { "type": "string", "description": "ExternalEmailAddress is the actual routing target for a mail contact. This runs after Set-Contact so the routing update is the last write to land." }, "firstName": { "type": "string" }, "hidefromGAL": { "type": "boolean", "description": "Handle boolean conversion safely" }, "LastName": { "type": "string" }, "mailTip": { "type": "string", "description": "Add MailTip if provided" }, "mobilePhone": { "type": "string" }, "phone": { "type": "string" }, "PostalCode": { "type": "string" }, "State": { "type": "string" }, "StreetAddress": { "type": "string" }, "tenantID": { "type": "string" }, "Title": { "type": "string" }, "website": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite" } }, "/api/EditContactTemplates": { "post": { "summary": "EditContactTemplates", "operationId": "EditContactTemplates", "tags": [ "Email-Exchange > Administration > Contacts" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ContactTemplateID": { "type": "string", "description": "Get the ContactTemplateID from the request body" }, "displayName": { "type": "string", "description": "Set name and comments" } }, "required": [ "ContactTemplateID" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite", "x-cipp-any-tenant": true } }, "/api/EditDlpCompliancePolicy": { "post": { "summary": "EditDlpCompliancePolicy", "operationId": "EditDlpCompliancePolicy", "tags": [ "Security > Compliance-DLP" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "parameters": { "type": "string", "description": "Allow passing arbitrary additional params via Body.parameters" }, "State": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" } }, "/api/EditEquipmentMailbox": { "post": { "summary": "EditEquipmentMailbox", "operationId": "EditEquipmentMailbox", "tags": [ "Email-Exchange > Resources" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "equipmentId": { "type": "string" }, "hiddenFromAddressListsEnabled": { "type": "string" }, "tenantID": { "type": "string" }, "userPrincipalName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Equipment.ReadWrite" } }, "/api/EditExConnector": { "post": { "summary": "EditExConnector", "operationId": "EditExConnector", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "State": { "type": "string" }, "tenantFilter": { "type": "string" }, "Type": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.ReadWrite" } }, "/api/EditGroup": { "post": { "summary": "EditGroup", "operationId": "EditGroup", "tags": [ "Identity > Administration > Groups" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AddContact": { "type": "array", "items": { "type": "object", "properties": { "Exception": { "type": "object", "properties": { "Message": { "type": "string" } } } } } }, "AddDevice": { "type": "array", "items": { "type": "object", "properties": { "Exception": { "type": "object", "properties": { "Message": { "type": "string" } } } } } }, "AddLicenses": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "AddMember": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "userPrincipalName": { "type": "string", "description": "Add to group user action and edit group page sends in different formats, so we need to handle both" } }, "description": "Add to group user action and edit group page sends in different formats, so we need to handle both" }, "Exception": { "type": "object", "properties": { "Message": { "type": "string" } } }, "value": { "type": "string", "description": "Add to group user action and edit group page sends in different formats, so we need to handle both" } } } }, "AddOwner": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "userPrincipalName": { "type": "string" } } }, "value": { "type": "string" } } } }, "allowExternal": { "type": "boolean", "description": "Only process allowExternal if it was explicitly sent" }, "description": { "type": "string" }, "displayName": { "type": "string", "description": "groupName is used in the Add to Group user action, displayName is used in the Edit Group page" }, "groupId": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "groupName": { "type": "string", "description": "groupName is used in the Add to Group user action, displayName is used in the Edit Group page" }, "groupType": { "type": "string" } }, "description": "groupName is used in the Add to Group user action, displayName is used in the Edit Group page" }, "value": { "type": "string" } }, "description": "groupName is used in the Add to Group user action, displayName is used in the Edit Group page" }, "groupName": { "type": "string", "description": "groupName is used in the Add to Group user action, displayName is used in the Edit Group page" }, "groupType": { "type": "string" }, "hideFromOutlookClients": { "type": "boolean", "description": "Only process hideFromOutlookClients if it was explicitly sent and is a Microsoft 365 group" }, "mail": { "type": "string" }, "mailNickname": { "type": "string" }, "membershipRules": { "type": "string" }, "RemoveContact": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "userPrincipalName": { "type": "string" } } }, "value": { "type": "string" } } } }, "RemoveLicenses": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "RemoveMember": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "userPrincipalName": { "type": "string" } } }, "value": { "type": "string" } } } }, "RemoveOwner": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "userPrincipalName": { "type": "string" } } }, "value": { "type": "array", "items": { "type": "string" }, "description": "Keep unresolved ManagedBy entries so a failed lookup cannot strip an owner." } } } }, "securityEnabled": { "type": "string", "description": "Use new securityEnabled value if provided, otherwise keep original" }, "sendCopies": { "type": "boolean", "description": "Only process sendCopies if it was explicitly sent" }, "tenantFilter": { "type": "string" }, "tenantId": { "type": "string" }, "visibility": { "type": "string", "description": "Only process visibility if it was explicitly sent for Microsoft 365 groups" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.ReadWrite" } }, "/api/EditIntunePolicy": { "post": { "summary": "EditIntunePolicy", "operationId": "EditIntunePolicy", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string" }, "ID": { "type": "string" }, "newDisplayName": { "type": "string" }, "platformType": { "type": "string" }, "policyType": { "type": "string", "enum": [ "androidManagedAppProtection", "iosManagedAppProtection", "mdmWindowsInformationProtectionPolicy", "targetedManagedAppConfiguration", "windowsInformationProtectionPolicy", "windowsManagedAppProtection" ] }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/EditIntuneScript": { "post": { "summary": "EditIntuneScript", "operationId": "EditIntuneScript", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "IntuneScript": { "type": "string", "description": "Parse the script data to determine type" }, "ScriptId": { "type": "string" }, "ScriptType": { "type": "string", "enum": [ "Linux", "MacOS", "Remediation", "Windows" ] }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "parameters": [ { "name": "ScriptId", "in": "query", "description": "First get the script type by querying the script ID", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/EditJITAdminTemplate": { "post": { "summary": "EditJITAdminTemplate", "operationId": "EditJITAdminTemplate", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "defaultDomain": { "type": "string", "description": "defaultDomain is only saved for specific tenant templates (not AllTenants)" }, "defaultDuration": { "type": "string" }, "defaultExistingUser": { "type": "string", "description": "Add existing user selection when \"select\" action is specified" }, "defaultExpireAction": { "type": "string" }, "defaultFirstName": { "type": "string", "description": "These fields can be saved for both AllTenants and specific tenant templates" }, "defaultForTenant": { "type": "boolean" }, "defaultGroups": { "type": "string" }, "defaultLastName": { "type": "string" }, "defaultNotificationActions": { "type": "string" }, "defaultRoles": { "type": "string" }, "defaultUsageLocation": { "$ref": "#/components/schemas/LabelValue" }, "defaultUseGroups": { "type": "boolean" }, "defaultUserAction": { "type": "string", "description": "Validate user action fields" }, "defaultUserName": { "type": "string" }, "defaultUseRoles": { "type": "boolean" }, "defaultVacationCAPolicy": { "type": "string" }, "defaultVacationExcludeAuditAlerts": { "type": "boolean" }, "defaultVacationMode": { "type": "boolean" }, "generateTAPByDefault": { "type": "boolean" }, "GUID": { "type": "string", "description": "Extract data from request body" }, "reasonTemplate": { "type": "string" }, "templateName": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "GUID", "templateName", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/EditJITRoleTemplate": { "post": { "summary": "EditJITRoleTemplate", "operationId": "EditJITRoleTemplate", "tags": [ "Identity > Administration > Users" ], "description": "Updates an existing JIT Role Template.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "roles": { "type": "string" }, "templateName": { "type": "string" } }, "required": [ "GUID", "templateName" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/EditMalwareFilter": { "post": { "summary": "EditMalwareFilter", "operationId": "EditMalwareFilter", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "RuleName": { "type": "string" }, "State": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "RuleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Disable", "Enable" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/EditPolicy": { "post": { "summary": "EditPolicy", "operationId": "EditPolicy", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Assignto": { "type": "string" }, "Description": { "type": "string" }, "Displayname": { "type": "string" }, "groupid": { "type": "string" }, "tenantid": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "policyConfigurationIngestionType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/EditQuarantinePolicy": { "post": { "summary": "EditQuarantinePolicy", "operationId": "EditQuarantinePolicy", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "AllowSender": { "type": "string" }, "BlockSender": { "type": "string" }, "Delete": { "type": "string" }, "EndUserSpamNotificationCustomFromAddress": { "type": "string" }, "EndUserSpamNotificationFrequency": { "$ref": "#/components/schemas/LabelValue" }, "Identity": { "type": "string" }, "IncludeMessagesFromBlockedSenderAddress": { "type": "string" }, "Name": { "type": "string" }, "OrganizationBrandingEnabled": { "type": "string" }, "Preview": { "type": "string" }, "QuarantineNotification": { "type": "string" }, "ReleaseActionPreference": { "$ref": "#/components/schemas/LabelValue" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Spamfilter.ReadWrite" } }, "/api/EditRetentionCompliancePolicy": { "post": { "summary": "EditRetentionCompliancePolicy", "operationId": "EditRetentionCompliancePolicy", "tags": [ "Security > Compliance-Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "parameters": { "type": "string" }, "State": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.ReadWrite" } }, "/api/EditRoomList": { "post": { "summary": "EditRoomList", "operationId": "EditRoomList", "tags": [ "Email-Exchange > Resources" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AddMember": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Add room members" }, "AddOwner": { "type": "array", "items": { "type": "string" }, "description": "Handle owners (ManagedBy property)" }, "allowExternal": { "type": "string", "description": "Handle external email settings" }, "description": { "type": "string", "description": "Edit basic room list properties" }, "displayName": { "type": "string", "description": "Edit basic room list properties" }, "groupId": { "type": "string" }, "mailNickname": { "type": "string", "description": "Edit basic room list properties" }, "RemoveMember": { "type": "array", "items": { "type": "string" }, "description": "Remove room members" }, "RemoveOwner": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "id": { "type": "string" } } }, "label": { "type": "string" }, "value": { "type": "string" } } }, "description": "Handle owners (ManagedBy property)" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Room.ReadWrite" } }, "/api/EditRoomMailbox": { "post": { "summary": "EditRoomMailbox", "operationId": "EditRoomMailbox", "tags": [ "Email-Exchange > Resources" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "capacity": { "type": "string" }, "DefaultCalendarPermission": { "$ref": "#/components/schemas/LabelValue" }, "displayName": { "type": "string" }, "hiddenFromAddressListsEnabled": { "type": "string" }, "roomId": { "type": "string", "description": "Set-MailboxCalendarConfiguration requires anchor to the room mailbox" }, "tenantID": { "type": "string" }, "userPrincipalName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Room.ReadWrite" } }, "/api/EditSafeAttachmentsFilter": { "post": { "summary": "EditSafeAttachmentsFilter", "operationId": "EditSafeAttachmentsFilter", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "RuleName": { "type": "string" }, "State": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "RuleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "State", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Disable", "Enable" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/EditSafeLinksPolicy": { "post": { "summary": "EditSafeLinksPolicy", "operationId": "EditSafeLinksPolicy", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function modifies an existing Safe Links policy and its associated rule.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AdminDisplayName": { "type": "string" }, "AllowClickThrough": { "type": "string" }, "Comments": { "type": "string" }, "CustomNotificationText": { "type": "string" }, "DeliverMessageAfterScan": { "type": "string" }, "DisableUrlRewrite": { "type": "string" }, "DoNotRewriteUrls": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "EnableForInternalSenders": { "type": "string" }, "EnableOrganizationBranding": { "type": "string" }, "EnableSafeLinksForEmail": { "type": "string", "description": "Extract policy parameters from body" }, "EnableSafeLinksForOffice": { "type": "string" }, "EnableSafeLinksForTeams": { "type": "string" }, "ExceptIfRecipientDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSentTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSentToMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "PolicyName": { "type": "string" }, "Priority": { "type": "string", "description": "Extract rule parameters from body" }, "RecipientDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "RuleName": { "type": "string" }, "ScanUrls": { "type": "string" }, "SentTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } }, "description": "Process recipient-related parameters" }, "SentToMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "State": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "TrackClicks": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "PolicyName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RuleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite", "x-cipp-reads-via": [ "ConvertTo-FieldArray" ] } }, "/api/EditSafeLinksPolicyTemplate": { "post": { "summary": "EditSafeLinksPolicyTemplate", "operationId": "EditSafeLinksPolicyTemplate", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function updates an existing Safe Links policy template.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "TemplateDescription": { "type": "string" }, "TemplateName": { "type": "string", "description": "Set name and comments" } }, "required": [ "ID" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.ReadWrite", "x-cipp-any-tenant": true } }, "/api/EditSensitiveInfoType": { "post": { "summary": "EditSensitiveInfoType", "operationId": "EditSensitiveInfoType", "tags": [ "Security > Compliance-SIT" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "parameters": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.ReadWrite" } }, "/api/EditSensitivityLabel": { "post": { "summary": "EditSensitivityLabel", "operationId": "EditSensitivityLabel", "tags": [ "Security > Compliance-SensitivityLabel" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "parameters": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.ReadWrite" } }, "/api/EditSpamFilter": { "post": { "summary": "EditSpamFilter", "operationId": "EditSpamFilter", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "state": { "type": "string" } } } } } }, "parameters": [ { "name": "name", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/EditTenant": { "post": { "summary": "EditTenant", "operationId": "EditTenant", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "customerId": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "tenantAlias": { "type": "string" }, "tenantGroups": { "type": "array", "items": { "type": "object", "properties": { "groupId": { "type": "array", "items": { "type": "string" }, "description": "Only allow adding to static groups; dynamic group membership is managed by the orchestrator" }, "groupName": { "type": "string" } } } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Config.ReadWrite", "x-cipp-any-tenant": true } }, "/api/EditTenantAllowBlockListTemplate": { "post": { "summary": "EditTenantAllowBlockListTemplate", "operationId": "EditTenantAllowBlockListTemplate", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "entries": { "type": "string" }, "GUID": { "type": "string" }, "listMethod": { "type": "string" }, "listType": { "type": "string" }, "NoExpiration": { "type": "boolean" }, "notes": { "type": "string" }, "RemoveAfter": { "type": "boolean" }, "templateName": { "type": "string" } }, "required": [ "GUID" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite", "x-cipp-any-tenant": true } }, "/api/EditTenantOffboardingDefaults": { "post": { "summary": "EditTenantOffboardingDefaults", "operationId": "EditTenantOffboardingDefaults", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "customerId": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "defaultDomainName": { "type": "string" }, "offboardingDefaults": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Config.ReadWrite", "x-cipp-any-tenant": true } }, "/api/EditTransportRule": { "post": { "summary": "EditTransportRule", "operationId": "EditTransportRule", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "guid": { "type": "string" }, "state": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "guid", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "state", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.ReadWrite" } }, "/api/EditUser": { "post": { "summary": "EditUser", "operationId": "EditUser", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AddedAliases": { "type": "string" }, "AddToGroups": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "groupType": { "type": "string" } } }, "CategoryInfo": { "type": "string" }, "ErrorDetails": { "type": "object", "properties": { "Message": { "type": "string" } } }, "Exception": { "type": "object", "properties": { "Data": { "type": "array", "items": { "type": "string" } }, "Message": { "type": "string" }, "Response": { "type": "object", "properties": { "Content": { "type": "string" } } } } }, "InvocationInfo": { "type": "object", "properties": { "PositionMessage": { "type": "string" }, "ScriptLineNumber": { "type": "string" }, "ScriptName": { "type": "string" } } }, "label": { "type": "string" }, "ScriptStackTrace": { "type": "string" }, "value": { "type": "string" } } } }, "businessPhones": { "type": "string" }, "city": { "type": "string" }, "clearProperties": { "type": "string" }, "companyName": { "type": "string" }, "CopyFrom": { "$ref": "#/components/schemas/LabelValue" }, "country": { "type": "string" }, "customData": { "type": "string" }, "defaultAttributes": { "type": "string" }, "department": { "type": "string" }, "DisplayName": { "type": "string" }, "Domain": { "type": "string" }, "givenName": { "type": "string" }, "id": { "type": "string" }, "jobTitle": { "type": "string" }, "licenses": { "type": "string" }, "mailNickname": { "type": "string" }, "mobilePhone": { "type": "string" }, "MustChangePass": { "type": "boolean" }, "otherMails": { "type": "string" }, "password": { "type": "string" }, "postalCode": { "type": "string" }, "PostExecution": { "type": "object", "properties": { "Email": { "type": "boolean" }, "PSA": { "type": "boolean" }, "Push": { "type": "boolean" }, "Webhook": { "type": "boolean" } } }, "primDomain": { "$ref": "#/components/schemas/LabelValue" }, "reference": { "type": "string" }, "RemoveFromGroups": { "type": "array", "items": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "groupType": { "type": "string" } } }, "CategoryInfo": { "type": "string" }, "ErrorDetails": { "type": "object", "properties": { "Message": { "type": "string" } } }, "Exception": { "type": "object", "properties": { "Data": { "type": "array", "items": { "type": "string" } }, "Message": { "type": "string" }, "Response": { "type": "object", "properties": { "Content": { "type": "string" } } } } }, "InvocationInfo": { "type": "object", "properties": { "PositionMessage": { "type": "string" }, "ScriptLineNumber": { "type": "string" }, "ScriptName": { "type": "string" } } }, "label": { "type": "string" }, "ScriptStackTrace": { "type": "string" }, "value": { "type": "string" } } } }, "removeLicenses": { "type": "boolean", "description": "if the list of skuIds in $CurrentLicenses.assignedLicenses is EXACTLY the same as $licenses, we don't need to do anything, but the order in both can be different." }, "Scheduled": { "type": "object", "properties": { "date": { "type": "string" }, "Enabled": { "type": "string" } } }, "setManager": { "$ref": "#/components/schemas/LabelValue" }, "setSponsor": { "$ref": "#/components/schemas/LabelValue" }, "sherwebLicense": { "$ref": "#/components/schemas/LabelValue" }, "state": { "type": "string" }, "streetAddress": { "type": "string" }, "surname": { "type": "string" }, "tenantFilter": { "type": "string" }, "usageLocation": { "$ref": "#/components/schemas/LabelValue" }, "username": { "type": "string" }, "userPrincipalName": { "type": "string" } }, "required": [ "id", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite", "x-cipp-reads-via": [ "Get-CippException", "Set-CIPPUser" ] } }, "/api/EditUserAliases": { "post": { "summary": "EditUserAliases", "operationId": "EditUserAliases", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AddedAliases": { "type": "string" }, "id": { "type": "string", "description": "Get current mailbox" }, "MakePrimary": { "type": "string", "description": "Handle setting primary address" }, "RemovedAliases": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "id", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecAccessChecks": { "post": { "summary": "ExecAccessChecks", "operationId": "ExecAccessChecks", "tags": [ "CIPP > Settings" ], "description": "Runs the CIPP deployment's self-diagnostics and returns the result. Type selects the check: 'Permissions' verifies the SAM application's Graph permissions, 'Tenants' tests access to each tenant, and 'GDAP' inspects the GDAP relationships and role mappings. Results are cached for an hour and served from cache by default. Pass SkipCache to trigger a fresh run of the check; the run repopulates the cache and the response only acknowledges it started, so call again without SkipCache to read the updated results. For the 'Tenants' check, supplying TenantId returns just that tenant's cached result; add SkipCache to trigger a re-check of that single tenant.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "SkipCache": { "type": "string", "description": "Trigger a fresh run of the check instead of serving the cached result. The run repopulates the cache and the response only acknowledges it, so a follow-up call without SkipCache is what returns the updated result." }, "TenantId": { "type": "string", "description": "The tenant to read for the 'Tenants' type: returns just that tenant's cached result. Pair it with SkipCache to trigger a re-check of that one tenant, then read again without SkipCache to get the refreshed result. Query or body, as with Type." }, "Type": { "type": "string", "description": "Which self-diagnostic to run: Permissions, Tenants or GDAP. Read from either the query string or the body: the UI calls this as a GET with ?Type=, while a POST dispatcher (the MCP gateway documents it as POST because it also reads a body field) delivers it in the body - reading only the query left both empty and returned an empty result for every Type." } } } } } }, "parameters": [ { "name": "SkipCache", "in": "query", "description": "Trigger a fresh run of the check instead of serving the cached result. The run repopulates the cache and the response only acknowledges it, so a follow-up call without SkipCache is what returns the updated result.", "required": false, "schema": { "type": "string" } }, { "name": "TenantId", "in": "query", "description": "The tenant to read for the 'Tenants' type: returns just that tenant's cached result. Pair it with SkipCache to trigger a re-check of that one tenant, then read again without SkipCache to get the refreshed result. Query or body, as with Type.", "required": false, "schema": { "type": "string" } }, { "name": "Type", "in": "query", "description": "Which self-diagnostic to run: Permissions, Tenants or GDAP. Read from either the query string or the body: the UI calls this as a GET with ?Type=, while a POST dispatcher (the MCP gateway documents it as POST because it also reads a body field) delivers it in the body - reading only the query left both empty and returned an empty result for every Type.", "required": false, "schema": { "type": "string", "enum": [ "GDAP", "Permissions", "Tenants" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Data": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read", "x-cipp-any-tenant": true } }, "/api/ExecAddAlert": { "post": { "summary": "ExecAddAlert", "operationId": "ExecAddAlert", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "sendEmailNow": { "type": "boolean" }, "sendPsaNow": { "type": "boolean" }, "sendWebhookNow": { "type": "boolean" }, "tenantFilter": { "type": "string" }, "text": { "type": "string" }, "writeLog": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecAddCippCveException": { "post": { "summary": "ExecAddCippCveException", "operationId": "ExecAddCippCveException", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "applyTo": { "type": "string" }, "cveId": { "type": "string" }, "exceptionType": { "type": "string" }, "expiryDate": { "type": "string" }, "justification": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Alert.ReadWrite" } }, "/api/ExecAddGDAPRole": { "post": { "summary": "ExecAddGDAPRole", "operationId": "ExecAddGDAPRole", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "customSuffix": { "type": "string" }, "gdapRoles": { "type": "array", "items": { "type": "object", "properties": { "label": { "type": "string" }, "Name": { "type": "string" }, "ObjectId": { "type": "string" }, "value": { "type": "string" } } } }, "mappings": { "type": "array", "items": { "type": "object", "properties": { "GroupId": { "type": "string" }, "Results": { "type": "string" }, "roleDefinitionId": { "type": "string" }, "RoleMappings": { "type": "array", "items": { "type": "object", "properties": { "roleDefinitionId": { "type": "string" } } } }, "RoleName": { "type": "string" } } } }, "templateId": { "type": "string", "description": "Add-CIPPGDAPRoleTemplate already writes customer-visible logs for the template path" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "allowExternalSenders": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "assignedLabels": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "autoSubscribeNewMembers": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "classification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "expirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "groupTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "hasMembersWithLicenseErrors": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromAddressLists": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromOutlookClients": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isArchived": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isAssignableToRole": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFavorite": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSubscribedByMail": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "licenseProcessingState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRule": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesNetBiosName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "organizationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "renewedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceBehaviorOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "resourceProvisioningOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "theme": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "unseenConversationsCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenMessagesCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "visibility": { "type": "string", "x-cipp-field-source": "graph-entity" }, "welcomeMessageEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "writebackConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true, "x-cipp-reads-via": [ "Add-CIPPGDAPRoleTemplate", "New-CIPPGDAPRoleMapping" ] } }, "/api/ExecAddMultiTenantApp": { "post": { "summary": "ExecAddMultiTenantApp", "operationId": "ExecAddMultiTenantApp", "tags": [ "Tenant > Administration > Application Approval" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AppId": { "type": "string" }, "configMode": { "type": "string", "x-cipp-observed-values": [ "manual", "template" ] }, "CopyPermissions": { "type": "boolean" }, "permissions": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" } } } }, "selectedTemplate": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "AppId": { "type": "string" } } }, "label": { "type": "string" }, "value": { "type": "string" } } }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.ReadWrite" } }, "/api/ExecAddSPN": { "post": { "summary": "ExecAddSPN", "operationId": "ExecAddSPN", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ExecAddTenant": { "post": { "summary": "ExecAddTenant", "operationId": "ExecAddTenant", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "accessToken": { "type": "string", "description": "Get tenant information from Microsoft Graph using bulk request" }, "defaultDomainName": { "type": "string" }, "tenantId": { "type": "string", "description": "Get the tenant ID from the request body" }, "username": { "type": "string", "description": "The account that consented is recorded so the connection can be traced and refreshed later. The auth date is stamped server side rather than trusting the client." } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "customerId": { "x-cipp-field-source": "storage" }, "defaultDomainName": { "x-cipp-field-source": "storage" }, "delegatedPrivilegeStatus": { "x-cipp-field-source": "storage" }, "directTenantAuthDate": { "x-cipp-field-source": "storage" }, "directTenantUserPrincipalName": { "x-cipp-field-source": "storage" }, "displayName": { "x-cipp-field-source": "storage" }, "domains": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Excluded": { "x-cipp-field-source": "storage" }, "ExcludeDate": { "x-cipp-field-source": "storage" }, "ExcludeUser": { "x-cipp-field-source": "storage" }, "hasAutoExtend": { "x-cipp-field-source": "storage" }, "initialDomainName": { "x-cipp-field-source": "storage" }, "LastGraphError": { "x-cipp-field-source": "storage" }, "LastGraphTokenError": { "x-cipp-field-source": "storage" }, "LastRefresh": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "relationshipCount": { "x-cipp-field-source": "storage" }, "relationshipEnd": { "x-cipp-field-source": "storage" }, "RequiresRefresh": { "type": "boolean", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecAddTrustedIP": { "post": { "summary": "Adds IP addresses or ranges to CIPP's IP allow/block list.", "operationId": "ExecAddTrustedIP", "tags": [ "CIPP > Settings" ], "description": "Sets each IP address or CIDR range (IPv4 or IPv6) to Trusted, Blocked or NotTrusted (neutral) for one tenant, or for every tenant with tenantfilter=AllTenants. A tenant entry overrides an AllTenants entry for the same range, and the most specific range decides an address. The audit-log alerts treat Trusted addresses as known; the BEC investigation uses Trusted and Blocked entries as confirmed-safe and confirmed-compromised IPs.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "IP": { "type": "array", "items": { "type": "string" }, "description": "IP addresses or CIDR ranges (IPv4 or IPv6); one entry may also hold several separated by commas or spaces" }, "Note": { "type": "string", "description": "Optional note shown with the entry" }, "State": { "type": "string", "description": "Trusted, Blocked, or NotTrusted to make the entry neutral again" } } } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecAlertsList": { "get": { "summary": "ExecAlertsList", "operationId": "ExecAlertsList", "tags": [ "Security > Incidents" ], "description": "Lists Microsoft 365 Defender security alerts for a tenant. tenantFilter=AllTenants reads the cached alert table instead of querying each tenant live, so those results are as fresh as the last cache run.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "actorDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "additionalData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Alert": { "type": "string", "x-cipp-field-source": "storage" }, "alertPolicyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "alertWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedTo": { "type": "string", "x-cipp-field-source": "graph-entity" }, "categories": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Category": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "classification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "comments": { "type": "array", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "detectionSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, "detectorId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "determination": { "type": "object", "x-cipp-field-source": "graph-entity" }, "DurableName": { "x-cipp-field-source": "backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "EventDateTime": { "x-cipp-field-source": "frontend" }, "evidence": { "type": "array", "x-cipp-field-source": "graph-entity" }, "firstActivityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "FunctionName": { "x-cipp-field-source": "backend" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Incident": { "type": "string", "x-cipp-field-source": "storage" }, "incidentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "incidentWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "InProgressAlertsCount": { "x-cipp-field-source": "backend" }, "investigationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "lastActivityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastUpdateDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "MdoAlert": { "type": "string", "x-cipp-field-source": "storage" }, "mitreTechniques": { "type": "array", "x-cipp-field-source": "graph-entity" }, "MSResults": { "x-cipp-field-source": "backend" }, "NewAlertsCount": { "x-cipp-field-source": "backend" }, "OrchestratorName": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "productName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "providerAlertId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "QueueFunction": { "x-cipp-field-source": "backend" }, "QueueId": { "x-cipp-field-source": "backend" }, "QueueMessage": { "x-cipp-field-source": "backend" }, "recommendedActions": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resolvedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "serviceSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Severity": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "SeverityHighAlertsCount": { "x-cipp-field-source": "backend" }, "SeverityInformationalCount": { "x-cipp-field-source": "backend" }, "SeverityLowAlertsCount": { "x-cipp-field-source": "backend" }, "SeverityMediumAlertsCount": { "x-cipp-field-source": "backend" }, "SkipLog": { "x-cipp-field-source": "backend" }, "Status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "systemTags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "TenantParams": { "x-cipp-field-source": "backend" }, "threatDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "threatFamilyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Title": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Alert.Read" } }, "/api/ExecApiClient": { "post": { "summary": "ExecApiClient", "operationId": "ExecApiClient", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "AppName": { "type": "string" }, "CIPPAPI": { "type": "object", "properties": { "ResetSecret": { "type": "boolean" } } }, "ClientId": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "displayName": { "type": "string" } } }, "value": { "type": "string" } } }, "Enabled": { "type": "string" }, "IpRange": { "$ref": "#/components/schemas/LabelValue" }, "MCPAllowed": { "type": "string", "description": "When this client is MCP-enabled it becomes one of the OAuth client apps that AI connectors sign in as. Several MCPAllowed clients may coexist (each with its own role/IP/redirects/CA); the dedicated CIPP-MCP app is the shared protected resource. Configure this client (callbacks, public client flows, resource permissions + consent) and ensure the resource app exists (Set-CIPPMCPClientApp -> New-CIPPMcpResourceApp)." }, "PublicRedirectUris": { "type": "string" }, "RedirectUris": { "type": "string" }, "RemoveAppReg": { "type": "boolean" }, "Role": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Authorize the role assignment BEFORE any side effects (app registration / secret creation). A caller may only assign a role whose effective permissions are a subset of their own, and may only modify an existing client whose current role is likewise within their grant. This blocks privilege escalation via the ApiClients table (e.g. editor -> superadmin)." }, "WebRedirectUris": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AddUpdate", "Delete", "GetAzureConfiguration", "GetMcpAuth", "List", "ListAvailable", "RepairUri", "ResetSecret", "SaveToAzure", "SetMcpRedirectUris" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "addIns": { "type": "array", "x-cipp-field-source": "graph-entity" }, "api": { "type": "object", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "applicationTemplateId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appRoles": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationBehaviors": { "type": "object", "x-cipp-field-source": "graph-entity" }, "certification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultRedirectUri": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "disabledByMicrosoftStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "groupMembershipClaims": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identifierUris": { "type": "array", "x-cipp-field-source": "graph-entity" }, "info": { "type": "object", "x-cipp-field-source": "graph-entity" }, "isDeviceOnlyAuthSupported": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isDisabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFallbackPublicClient": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "keyCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "logo": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managerApplications": { "type": "array", "x-cipp-field-source": "graph-entity" }, "nativeAuthenticationApisEnabled": { "type": "object", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "oauth2RequirePostResponse": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "optionalClaims": { "type": "object", "x-cipp-field-source": "graph-entity" }, "parentalControlSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "passwordCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "publicClient": { "type": "object", "x-cipp-field-source": "graph-entity" }, "publisherDomain": { "type": "string", "x-cipp-field-source": "graph-entity" }, "requestSignatureVerification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "requiredResourceAccess": { "type": "array", "x-cipp-field-source": "graph-entity" }, "samlMetadataUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceManagementReference": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalLockConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInAudience": { "type": "string", "x-cipp-field-source": "graph-entity" }, "spa": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "tokenEncryptionKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedPublisher": { "type": "object", "x-cipp-field-source": "graph-entity" }, "web": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite" } }, "/api/ExecAPIPermissionList": { "get": { "summary": "ExecAPIPermissionList", "operationId": "ExecAPIPermissionList", "tags": [ "CIPP > Settings" ], "description": "Lists every CIPP API endpoint grouped by the role that gates it. Backs the permission picker in the custom role editor.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read" } }, "/api/ExecAppApproval": { "get": { "summary": "ExecAppApproval", "operationId": "ExecAppApproval", "tags": [ "Tenant > Administration > Application Approval" ], "description": "Builds an admin consent URL for every tenant, for the given ApplicationId or the CIPP-SAM application by default. Returns the links only; nothing is granted until someone opens one and consents.", "parameters": [ { "name": "ApplicationId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "defaultDomainName": { "x-cipp-field-source": "backend" }, "link": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.Read" } }, "/api/ExecAppApprovalTemplate": { "post": { "summary": "ExecAppApprovalTemplate", "operationId": "ExecAppApprovalTemplate", "tags": [ "Tenant > Administration > Application Approval" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "ApplicationManifest": { "type": "string" }, "AppType": { "type": "string" }, "TemplateId": { "type": "string", "description": "If updating an existing template, add UpdatedBy and UpdatedOn" }, "TemplateName": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Delete", "Get", "Save" ] } }, { "name": "TemplateId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecAppInsightsQuery": { "post": { "summary": "ExecAppInsightsQuery", "operationId": "ExecAppInsightsQuery", "tags": [ "CIPP > Core" ], "description": "Runs a Kusto (KQL) query against the CIPP instance's own Application Insights telemetry and returns the result rows. The query is echoed back in Metadata.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "query": { "type": "string" } }, "required": [ "query" ] } } } }, "parameters": [ { "name": "query", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read" } }, "/api/ExecApplication": { "post": { "summary": "ExecApplication", "operationId": "ExecApplication", "tags": [ "Tenant > Administration > Application Approval" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "AppId": { "type": "string" }, "DisplayName": { "type": "string", "description": "Entra generates the key pair server-side and adds it alongside the current one. Nothing signs with it until SetPreferredSigningKey. The display name becomes the immutable certificate subject and relying parties may show it, so default to Entra's own subject rather than branding it." }, "EndDateTime": { "type": "string" }, "Id": { "type": "string" }, "KeyIds": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Handle credential removal" }, "Payload": { "type": "string", "description": "Depth 10 so nested payloads (e.g. web/spa/publicClient redirectUris and implicitGrantSettings) aren't truncated." }, "tenantFilter": { "type": "string" }, "Thumbprint": { "$ref": "#/components/schemas/LabelValue" }, "Type": { "type": "string" } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "AppId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "Id", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.ReadWrite" } }, "/api/ExecAppPermissionTemplate": { "post": { "summary": "ExecAppPermissionTemplate", "operationId": "ExecAppPermissionTemplate", "tags": [ "Tenant > Administration > Application Approval" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Permissions": { "type": "string" }, "TemplateId": { "type": "string" }, "TemplateName": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Delete", "Save" ] } }, { "name": "TemplateId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "SHA": { "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateId": { "x-cipp-field-source": "backend" }, "TemplateName": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "UpdatedBy": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ApplicationTemplates.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecAppServiceDomains": { "post": { "summary": "Manage custom domains (hostname bindings) and managed certificates on the CIPP App Service.", "operationId": "ExecAppServiceDomains", "tags": [ "CIPP > Settings" ], "description": "Drives the super-admin \"Custom Domains\" page. All actions operate on the App Service that\nhosts this CIPP instance (Microsoft.Web/sites/$env:WEBSITE_SITE_NAME) using the managed\nidentity via New-CIPPAzRestRequest — the same resource and auth path the Container\nManagement page uses.\n\nActions (passed as Query.Action or Body.Action):\n List - Site metadata (default hostname, inbound IP) plus every hostname\n binding, any App Service Managed Certificate that matches, and the\n state of a certificate job still running in the background.\n CheckDns - Live DoH lookup of the alias record a custom domain needs. CIPP no\n longer uses domain-verification TXT records, so a leftover\n asuid. record is detected and flagged for removal rather than\n requested. Powers wizard step 1 + resume.\n AddBinding - Create the hostname binding (wizard step 2). Azure validates ownership\n through the alias record.\n AddCertificate - Issue an App Service Managed Certificate and enable the SNI SSL binding\n (wizard step 3) via Invoke-CIPPCustomDomainCertificate. Issuance that\n outlives the request carries on as a hidden scheduled task that retries\n every 15 minutes, a few times, then stops.\n Remove - Delete a custom hostname binding (and its managed cert, best effort).\n\nEvery action is independently re-runnable so the wizard can resume a half-finished domain or\nretry a failed step without redoing the ones that already succeeded.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "DnsRecordType": { "type": "string", "description": "Which alias record Azure should validate against: the one CheckDns saw resolve (A or CNAME), else the recommended type for this hostname shape." }, "Hostname": { "type": "string" } }, "required": [ "Hostname" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AddBinding", "AddCertificate", "CheckDns", "List", "Remove" ] } }, { "name": "Hostname", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecAppUpload": { "post": { "summary": "ExecAppUpload", "operationId": "ExecAppUpload", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite" } }, "/api/ExecAssignAPDevice": { "post": { "summary": "ExecAssignAPDevice", "operationId": "ExecAssignAPDevice", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "device": { "type": "string" }, "serialNumber": { "type": "string" }, "tenantFilter": { "type": "string" }, "user": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "addressableUserName": { "type": "string" }, "userPrincipalName": { "type": "string" } } } } } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "addressableUserName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureActiveDirectoryDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureAdDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deploymentProfileAssignedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deploymentProfileAssignmentDetailedStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deploymentProfileAssignmentStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceAccountPassword": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceAccountUpn": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceFriendlyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrollmentState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "groupTag": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastContactedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managedDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manufacturer": { "type": "string", "x-cipp-field-source": "graph-entity" }, "model": { "type": "string", "x-cipp-field-source": "graph-entity" }, "productKey": { "type": "string", "x-cipp-field-source": "graph-entity" }, "purchaseOrderIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "remediationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "remediationStateLastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "serialNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skuNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "systemFamily": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userlessEnrollmentStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/ExecAssignApp": { "post": { "summary": "ExecAssignApp", "operationId": "ExecAssignApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AppType": { "type": "string" }, "assignmentDirection": { "type": "string" }, "AssignmentFilterName": { "type": "string" }, "AssignmentFilterType": { "type": "string" }, "assignmentMode": { "type": "string" }, "AssignTo": { "type": "string" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "ExcludeGroupNames": { "type": "string" }, "GroupIds": { "type": "string" }, "GroupNames": { "type": "string" }, "ID": { "type": "string" }, "Intent": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "AppType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "AssignTo", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "GroupIds", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "GroupNames", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Intent", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite" } }, "/api/ExecAssignAutopilotProfile": { "post": { "summary": "ExecAssignAutopilotProfile", "operationId": "ExecAssignAutopilotProfile", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignTo": { "type": "string" }, "GroupIds": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "ProfileId": { "type": "string" }, "ProfileName": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "AssignTo", "ProfileId", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/ExecAssignmentFilter": { "post": { "summary": "ExecAssignmentFilter", "operationId": "ExecAssignmentFilter", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "Delete" ] }, "ID": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/ExecAssignPolicy": { "post": { "summary": "ExecAssignPolicy", "operationId": "ExecAssignPolicy", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "assignmentDirection": { "type": "string" }, "AssignmentFilterName": { "type": "string" }, "AssignmentFilterType": { "type": "string" }, "assignmentMode": { "type": "string" }, "AssignTo": { "type": "string" }, "excludeGroup": { "type": "string" }, "ExcludeGroupIds": { "type": "string" }, "ExcludeGroupNames": { "type": "string" }, "GroupIds": { "type": "string" }, "GroupNames": { "type": "string" }, "ID": { "type": "string" }, "platformType": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the body of the request" }, "Type": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/ExecAuditLogSearch": { "post": { "summary": "ExecAuditLogSearch", "operationId": "ExecAuditLogSearch", "tags": [ "Tenant > Administration > Alerts" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "EndTime": { "type": "integer" }, "SearchId": { "type": "string" }, "StartTime": { "type": "integer", "description": "Convert StartTime and EndTime to DateTime from unixtime" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "ProcessLogs" ] } }, { "name": "SearchId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "administrativeUnitIdFilters": { "type": "array", "x-cipp-field-source": "graph-entity" }, "CippStatus": { "type": "string", "x-cipp-field-source": "storage" }, "DisplayName": { "type": "string", "x-cipp-field-source": "graph-entity,storage" }, "EndTime": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "filterEndDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "filterStartDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ipAddressFilters": { "type": "array", "x-cipp-field-source": "graph-entity" }, "keywordFilter": { "type": "string", "x-cipp-field-source": "graph-entity" }, "objectIdFilters": { "type": "array", "x-cipp-field-source": "graph-entity" }, "operationFilters": { "type": "array", "x-cipp-field-source": "graph-entity" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "Query": { "type": "string", "x-cipp-field-source": "storage" }, "recordTypeFilters": { "type": "array", "x-cipp-field-source": "graph-entity" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "serviceFilters": { "type": "array", "x-cipp-field-source": "graph-entity" }, "StartTime": { "type": "string", "x-cipp-field-source": "storage" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "userPrincipalNameFilters": { "type": "array", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Alert.ReadWrite" } }, "/api/ExecAutoExtendGDAP": { "post": { "summary": "ExecAutoExtendGDAP", "operationId": "ExecAutoExtendGDAP", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecAzBobbyTables": { "post": { "summary": "Execute a AzBobbyTables function", "operationId": "ExecAzBobbyTables", "tags": [ "CIPP > Core" ], "description": "This function is used to interact with Azure Tables. This is advanced functionality used for external integrations or SuperAdmin functionality.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "FunctionName": { "type": "string" }, "Parameters": { "type": "string" }, "TableName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecBackendURLs": { "get": { "summary": "ExecBackendURLs", "operationId": "ExecBackendURLs", "tags": [ "CIPP > Settings" ], "description": "Returns Azure portal deep links for the CIPP deployment's own infrastructure (resource group, key vault, the function app or web app, its App Service plan, static web app) plus its subscription, SKU and timezone. Whether the instance is CyberDrain-hosted or CIPP-NG comes from /api/me.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read" } }, "/api/ExecBackupReplicationConfig": { "post": { "summary": "ExecBackupReplicationConfig", "operationId": "ExecBackupReplicationConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "BackupType": { "type": "string" }, "Enabled": { "type": "boolean" }, "SASUrl": { "type": "string" } } } } } }, "parameters": [ { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecBackupRetentionConfig": { "post": { "summary": "ExecBackupRetentionConfig", "operationId": "ExecBackupRetentionConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "RetentionDays": { "type": "integer" } } } } } }, "parameters": [ { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ApplicationId": { "x-cipp-field-source": "storage" }, "colour": { "x-cipp-field-source": "storage" }, "coverFooterText": { "x-cipp-field-source": "storage" }, "coverImage": { "x-cipp-field-source": "storage" }, "coverImageId": { "x-cipp-field-source": "storage" }, "coverImageIds": { "x-cipp-field-source": "storage" }, "coverStock": { "x-cipp-field-source": "storage" }, "coverUploads": { "x-cipp-field-source": "storage" }, "Enabled": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "footerText": { "x-cipp-field-source": "storage" }, "logo": { "x-cipp-field-source": "storage" }, "logoImageId": { "x-cipp-field-source": "storage" }, "logoImageIds": { "x-cipp-field-source": "storage" }, "logoUploads": { "x-cipp-field-source": "storage" }, "MaxDuration": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "reportDefaults": { "x-cipp-field-source": "storage" }, "Resolver": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RetentionDays": { "x-cipp-field-source": "storage" }, "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "secondaryColour": { "x-cipp-field-source": "storage" }, "showFooter": { "x-cipp-field-source": "storage" }, "showPageNumbers": { "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Timezone": { "x-cipp-field-source": "storage" }, "TimezoneSource": { "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" }, "watermarkEnabled": { "x-cipp-field-source": "storage" }, "watermarkText": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecBaselineAddStandard": { "post": { "summary": "ExecBaselineAddStandard", "operationId": "ExecBaselineAddStandard", "tags": [ "Tenant > Standards" ], "description": "Adds one standard, with its configured settings, to a stage of an existing baseline. The baseline\nis read with Get-CIPPBaseline, the standard is appended to the stage (replacing an existing\nsingle-instance copy) and the whole baseline is saved again through New-CIPPBaseline, the same\nwrite path the baseline editor uses. Body: baselineId, stage (1-based, default 1), standard,\nvariables, remediateEnabled (default false), alertEnabled (default true).", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "alertEnabled": { "type": "string" }, "baselineId": { "type": "string" }, "remediateEnabled": { "type": "boolean" }, "stage": { "type": "string" }, "standard": { "type": "string" }, "variables": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.ReadWrite" } }, "/api/ExecBaselineMigrate": { "post": { "summary": "ExecBaselineMigrate", "operationId": "ExecBaselineMigrate", "tags": [ "Tenant > Standards" ], "description": "Migrates classic StandardsTemplateV2 templates (standards + drift) into baselines.\naction 'preview' returns the full mapping report without writing; 'commit' migrates\nthe selected templates (all when none selected). reportOnly (default true) imports\nevery standard with remediation off - the report carries each standard's faithful\nV2 posture so the operator re-enables deliberately. addDetectStandards optionally\nadds the admin-drift detection standards to migrated drift templates. The V2\ntemplates themselves are never modified.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string" }, "addDetectStandards": { "type": "boolean" }, "reportOnly": { "type": "string" }, "templateIds": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.ReadWrite" } }, "/api/ExecBaselineOverride": { "post": { "summary": "ExecBaselineOverride", "operationId": "ExecBaselineOverride", "tags": [ "Tenant > Standards" ], "description": "Creates or removes a tenant-scoped delta (design doc §4.1) overriding one standard for\none tenant. Presence is the override: the delta's expectedValue (the configured variable\nvalues) fully replaces what the baselines apply. The resolved row's §4.2 columns are\nupdated immediately so the UI reflects the new effective configuration; the engine\nenforces it on the next run.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string", "enum": [ "createOverride", "deleteOverride" ] }, "standard": { "type": "string" }, "tenantFilter": { "type": "string" }, "variables": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.ReadWrite" } }, "/api/ExecBaselineRun": { "post": { "summary": "ExecBaselineRun", "operationId": "ExecBaselineRun", "tags": [ "Tenant > Standards" ], "description": "Starts an on-demand baseline run directly as a durable orchestration: a full baseline\nrun (templateId), a tenant- or standard-scoped run, a compare (no remediation), or a\noneoff (single standard, remediation forced on - the declarative deploy).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "mode": { "type": "string" }, "standard": { "type": "string" }, "templateId": { "type": "string" }, "tenantFilter": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "The tenant selector posts its option object; a group ID or 'AllTenants' are valid scopes too - the orchestrator expands them." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.BaselinesRun.ReadWrite" } }, "/api/ExecBaselineStage": { "post": { "summary": "ExecBaselineStage", "operationId": "ExecBaselineStage", "tags": [ "Tenant > Standards" ], "description": "Advances a tenant to the next stage of a baseline (manual stage approval), or with\naction 'evaluate' re-checks the next stage's conditions now instead of waiting for the\nscheduled run. The tenant receives all standards from the new stage on the next engine run.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string", "description": "evaluate: re-check the next stage's conditions now; anything else is a manual advance" }, "templateId": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.ReadWrite" } }, "/api/ExecBECBulkCheck": { "get": { "summary": "Queues Business Email Compromise investigations for many users at once.", "operationId": "ExecBECBulkCheck", "tags": [ "Identity > Administration > Users" ], "description": "Queues one BEC investigation per user, each its own sequential orchestration, with a queue entry for progress. Accepts either an array of { UserIds, tenantFilter } items (the Users table bulk action) or one object with UserIds[]. Each run gets its own case id; results appear on the BEC Reports page and each user's Compromise Remediation tab.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ExecBECCheck": { "post": { "summary": "Reads, polls or starts a Business Email Compromise investigation.", "operationId": "ExecBECCheck", "tags": [ "Identity > Administration > Users" ], "description": "GET with GUID (or caseId) returns that run: while it is queued or running { Waiting = true, Progress } where Progress is the job status (queued until a worker picks it up, then running) and the per-step state the page renders; { Error, Progress } when it failed; otherwise the results payload with the server-side Score, per-collector Completeness and a Run block. A queued or running run whose progress has not moved for 20 minutes is marked failed by this poll (the worker restarted or the run was abandoned) and returned as { Error }. GET without a GUID returns the user's latest run as { GUID, Status } and starts nothing (GUID is null when the user has no runs). POST with tenantFilter, userid and userName queues a new run and returns its { GUID }. Every run is the full investigation and is kept in the BecReports table; metadata only, never message content.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" }, "userid": { "type": "string", "description": "Object id of the user to investigate" }, "userName": { "type": "string", "description": "The user's UPN (stored on the run and used by the collectors)" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "caseId", "in": "query", "description": "The run to read; GUID keeps the original poll contract", "required": false, "schema": { "type": "string" } }, { "name": "GUID", "in": "query", "description": "The run to read; GUID keeps the original poll contract", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userid", "in": "query", "description": "Object id of the user to investigate", "required": false, "schema": { "type": "string" } }, { "name": "userName", "in": "query", "description": "The user's UPN (stored on the run and used by the collectors)", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "CaseId": { "x-cipp-field-source": "backend" }, "Containment": { "x-cipp-field-source": "backend" }, "ExtractedAt": { "x-cipp-field-source": "backend" }, "RequestedAt": { "x-cipp-field-source": "backend" }, "RequestedBy": { "x-cipp-field-source": "backend" }, "Status": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ExecBECEvidenceExport": { "post": { "summary": "Builds the evidence package for a Business Email Compromise run and returns it.", "operationId": "ExecBECEvidenceExport", "tags": [ "Identity > Administration > Users" ], "description": "Collates the run's stored results, one CSV per finding set, the score, the containment history, every logbook entry stamped with the case id and the full and C-suite-summary report PDFs (rendered server-side) into a ZIP. Nothing is stored: the ZIP is returned base64-encoded (ZipBase64) for the browser to save. Metadata only - nothing in the package is message content.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "caseId": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Bytes": { "x-cipp-field-source": "backend" }, "CaseId": { "x-cipp-field-source": "backend" }, "FileCount": { "x-cipp-field-source": "backend" }, "ZipBase64": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ExecBECIPReview": { "post": { "summary": "Re-judges the IP addresses of a BEC case with the investigator's overrides and chosen accounts.", "operationId": "ExecBECIPReview", "tags": [ "Identity > Administration > Users" ], "description": "Validates the request and queues a background re-run of the case's address-dependent sections: the investigator's overrides (an address or CIDR range marked Safe, Suspicious or Compromised, with an optional note) become the case's complete override set, the sign-ins of the chosen accounts are correlated with the case's addresses, the address lists are re-read, and mailbox activity, IP verdicts, attacker activity, delegated mailboxes and the score are recomputed for the original window. Returns a DeploymentId whose per-step progress ListOffboardingProgress returns. To make a verdict permanent for the tenant, add the address to CIPP's IP allow/block list (ExecAddTrustedIP).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CaseId": { "type": "string", "description": "The BEC case (run) to review" }, "CorrelateUsers": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Object ids of other accounts whose sign-ins to correlate with the case's addresses" }, "Overrides": { "type": "array", "items": { "type": "object", "properties": { "IP": { "type": "string" }, "Note": { "type": "string" }, "Verdict": { "$ref": "#/components/schemas/LabelValue" } } }, "description": "The complete set of overrides for the case: an address or CIDR range, Safe, Suspicious or Compromised, and a note. Auto drops the override." }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "resultText": { "x-cipp-field-source": "backend" }, "state": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecBECRemediate": { "post": { "summary": "Runs selectable Business Email Compromise containment for a user.", "operationId": "ExecBECRemediate", "tags": [ "Identity > Administration > Users" ], "description": "Runs the selected containment actions (see ListBECRemediationActions) for a user. With no Actions the default set runs (the DefaultSelected actions, configurable instance-wide from CIPP settings). Actions marked Critical require Confirmation to equal the user's UPN. With Async the request is validated, queued as a scheduled task that runs straight away, and answered with a DeploymentId whose per-action progress ListOffboardingProgress returns; without it the actions run inline and their results are returned. Pass CaseId to resolve default targets (flagged consents, delegations, rules, devices) from that BEC run and to record the outcome on it; Parameters carries explicit per-action targets (MfaMethodIds, GrantIds, AppRoleAssignmentIds, ServicePrincipalIds, RuleIds, Delegations, TransportRuleIds, AddInIds, Protocols, MobileDeviceIds, RegisteredDeviceIds, CAPolicy).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Actions": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Action ids from ListBECRemediationActions; empty runs the default set" }, "Async": { "type": "boolean", "description": "run as a background scheduled task and report progress under the returned DeploymentId" }, "CaseId": { "type": "string", "description": "the BEC run whose findings supply default targets and which records the outcome" }, "Confirmation": { "type": "string", "description": "must equal the user's UPN when a Critical action is selected" }, "Parameters": { "type": "string" }, "tenantFilter": { "type": "string" }, "userid": { "type": "string" }, "username": { "type": "string" } }, "required": [ "tenantFilter", "userid", "username" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "resultText": { "x-cipp-field-source": "backend" }, "state": { "type": "string", "x-cipp-field-source": "graph,backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecBECRemediationDefaults": { "post": { "summary": "Gets or sets which BEC containment actions are selected by default.", "operationId": "ExecBECRemediationDefaults", "tags": [ "CIPP > Settings" ], "description": "GET with List=true returns the containment catalog (Id, Label, Description, Impact, DefaultSelected) with the instance-wide defaults applied. POST with DefaultActions saves the action ids that start selected in the BEC containment drawer and run when ExecBECRemediate is called without Actions.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "DefaultActions": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Containment action ids (ListBECRemediationActions) that start selected" } } } } } }, "parameters": [ { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecBECReport": { "post": { "summary": "Manages a stored Business Email Compromise run.", "operationId": "ExecBECReport", "tags": [ "Identity > Administration > Users" ], "description": "Action=Delete removes a BEC run permanently: its results payload, its evidence package and the run row. Runs are otherwise kept indefinitely.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "description": "Currently only Delete" }, "caseId": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecBitlockerSearch": { "post": { "summary": "ExecBitlockerSearch", "operationId": "ExecBitlockerSearch", "tags": [ "Endpoint > MEM" ], "description": "Finds a BitLocker recovery key across every tenant the caller can access, by keyId or deviceId. Intended for the case where a user has a recovery key ID from the BitLocker prompt but the tenant is unknown.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "deviceId": { "type": "string" }, "keyId": { "type": "string", "description": "Get search parameters from query string or POST body" }, "limit": { "type": "string" }, "tenantFilter": { "type": "string" } } } } } }, "parameters": [ { "name": "deviceId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "keyId", "in": "query", "description": "Get search parameters from query string or POST body", "required": false, "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Device.Read", "x-cipp-any-tenant": true } }, "/api/ExecBrandingSettings": { "post": { "summary": "ExecBrandingSettings", "operationId": "ExecBrandingSettings", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "colour": { "type": "string" }, "coverFooterText": { "type": "string" }, "coverImageId": { "type": "string" }, "coverImageIds": { "type": "string" }, "coverStock": { "type": "string" }, "data": { "type": "string" }, "footerText": { "type": "string" }, "id": { "type": "string" }, "kind": { "type": "string", "description": "A name for a gallery image, so it can be picked by name where the image is offered elsewhere: the report builder lists uploaded covers as Infographic page backgrounds." }, "logoImageId": { "type": "string" }, "logoImageIds": { "type": "string" }, "name": { "type": "string", "description": "A preset is a complete branding set, not a patch over the global settings: what the editor shows is what the report gets. The UI seeds a new one from the current global settings so that completeness costs nothing to fill in." }, "reportDefaults": { "type": "string" }, "roleColours": { "type": "string" }, "secondaryColour": { "type": "string" }, "showFooter": { "type": "boolean" }, "showPageNumbers": { "type": "boolean" }, "tenantLabel": { "type": "string", "description": "Which of the tenant's names the preset's reports print; see the Set action." }, "watermarkEnabled": { "type": "boolean" }, "watermarkText": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ApplicationId": { "x-cipp-field-source": "storage" }, "colour": { "x-cipp-field-source": "storage" }, "coverFooterText": { "x-cipp-field-source": "storage" }, "coverImage": { "x-cipp-field-source": "storage" }, "coverImageId": { "x-cipp-field-source": "storage" }, "coverImageIds": { "x-cipp-field-source": "storage" }, "coverStock": { "x-cipp-field-source": "storage" }, "coverUploads": { "x-cipp-field-source": "storage" }, "Enabled": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "footerText": { "x-cipp-field-source": "storage" }, "logo": { "x-cipp-field-source": "storage" }, "logoImageId": { "x-cipp-field-source": "storage" }, "logoImageIds": { "x-cipp-field-source": "storage" }, "logoUploads": { "x-cipp-field-source": "storage" }, "MaxDuration": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "reportDefaults": { "x-cipp-field-source": "storage" }, "Resolver": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RetentionDays": { "x-cipp-field-source": "storage" }, "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "secondaryColour": { "x-cipp-field-source": "storage" }, "showFooter": { "x-cipp-field-source": "storage" }, "showPageNumbers": { "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Timezone": { "x-cipp-field-source": "storage" }, "TimezoneSource": { "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" }, "watermarkEnabled": { "x-cipp-field-source": "storage" }, "watermarkText": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecBreachSearch": { "post": { "summary": "ExecBreachSearch", "operationId": "ExecBreachSearch", "tags": [ "Tools > Breach-Lookup" ], "description": "Queues a breach search for a tenant against Have I Been Pwned. The search runs as a background job and can take up to 24 hours; this returns as soon as it is queued, not with the results. Read the results with ListBreachesTenant.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.BreachLookup.Read" } }, "/api/ExecBulkLicense": { "post": { "summary": "ExecBulkLicense", "operationId": "ExecBulkLicense", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "properties": {}, "description": "One entry per user. Entries are grouped by tenantFilter before execution.", "items": { "type": "object", "required": [ "tenantFilter", "userIds" ], "properties": { "tenantFilter": { "type": "string", "description": "Target tenant: the tenant's default domain, its tenant ID, or 'AllTenants'." }, "userIds": { "type": "array", "items": { "type": "string" }, "description": "User object IDs. Only the first entry is acted on per request object." }, "LicenseOperation": { "type": "string", "description": "Which license change to perform for this entry." }, "RemoveAllLicenses": { "type": "boolean", "description": "Strip every license from the user." }, "ReplaceAllLicenses": { "type": "boolean", "description": "Replace the user's licenses with LicensesToReplace." }, "Licenses": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Licenses to add. The backend reads .value off each entry, so these must be objects, not bare SKU ID strings." }, "LicensesToRemove": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Licenses to remove. The backend reads .value off each entry." }, "LicensesToReplace": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Licenses to replace the current set with. The backend reads .value off each entry." } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite", "description": "Applies license changes to many users across many tenants in one call. The body is a JSON array; entries are grouped by tenantFilter internally, so a single call may span tenants.", "x-cipp-override-reason": "The body is piped through Group-Object -Property tenantFilter, so the element shape is only reachable through a GroupInfo and cannot be resolved from the AST." } }, "/api/ExecBulkRemoveSharingLinks": { "post": { "summary": "ExecBulkRemoveSharingLinks", "operationId": "ExecBulkRemoveSharingLinks", "tags": [ "Teams-Sharepoint" ], "description": "Revokes all sharing links / external direct grants on one site in bulk, sourced from\nthe SharePointSharingLinks reporting cache. Scope selects which classifications are\nrevoked: Anonymous (anyone links only), External (anonymous + external), or All\n(every cached link on the site, including internal). Because the source is the\nreporting cache, links created after the last sharing sync are not covered.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Scope": { "$ref": "#/components/schemas/LabelValue" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecCaCheck": { "post": { "summary": "ExecCaCheck", "operationId": "ExecCaCheck", "tags": [ "Tenant > Conditional" ], "description": "Runs a Conditional Access \"what if\" evaluation, reporting which policies would apply to a sign-in with the given user, application, device platform, device compliance, location, client app type, authentication flow and risk levels. Evaluation only - no sign-in occurs and no policy is changed.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "authenticationFlow": { "$ref": "#/components/schemas/LabelValue" }, "ClientAppType": { "$ref": "#/components/schemas/LabelValue" }, "Country": { "$ref": "#/components/schemas/LabelValue" }, "DeviceCompliant": { "$ref": "#/components/schemas/LabelValue" }, "DevicePlatform": { "$ref": "#/components/schemas/LabelValue" }, "IncludeApplications": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "InsiderRiskLevel": { "$ref": "#/components/schemas/LabelValue" }, "IpAddress": { "type": "string" }, "SignInRiskLevel": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "userID": { "$ref": "#/components/schemas/LabelValue" }, "UserRiskLevel": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.Read", "x-cipp-reads-via": [ "New-CIPPCAWhatIfRequest" ] } }, "/api/ExecCAExclusion": { "post": { "summary": "ExecCAExclusion", "operationId": "ExecCAExclusion", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CreateTravelPolicy": { "type": "boolean" }, "EndDate": { "type": "string" }, "excludeLocationAuditAlerts": { "type": "string" }, "ExclusionType": { "type": "string" }, "PolicyId": { "type": "string" }, "postExecution": { "type": "string" }, "reference": { "type": "string" }, "StartDate": { "type": "string" }, "tenantFilter": { "type": "string", "description": "If UserId is a guid, get the user's UPN" }, "TravelCountries": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Optional: temporary travel policy that only allows sign-ins from the travel destination" }, "UserID": { "type": "string" }, "Username": { "type": "string" }, "Users": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "userPrincipalName": { "type": "array", "items": { "type": "string" } } } }, "value": { "type": "string" } } }, "vacation": { "type": "boolean" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/ExecCAServiceExclusion": { "post": { "summary": "ExecCAServiceExclusion", "operationId": "ExecCAServiceExclusion", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the request" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/ExecCIPPDBCache": { "post": { "summary": "ExecCIPPDBCache", "operationId": "ExecCIPPDBCache", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "Name", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Types", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite" } }, "/api/ExecCIPPDBCacheAdmin": { "post": { "summary": "SuperAdmin browse / remove / empty for CIPPDB (CippReportingDB) cache collections.", "operationId": "ExecCIPPDBCacheAdmin", "tags": [ "CIPP > Core" ], "description": "Typed alternative to Table Maintenance for the reporting cache. List returns decoded\ncache objects stamped with CIPPPartitionKey / CIPPRowKey / CIPPETag so the UI can\ndelete by storage key. Empty clears an entire type for a tenant (or AllTenants).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Rows": { "type": "string" }, "TenantFilter": { "type": "string" }, "Type": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecCippFunction": { "post": { "summary": "Execute a CIPPCore function", "operationId": "ExecCippFunction", "tags": [ "CIPP > Core" ], "description": "This function is used to execute a CIPPCore function from an HTTP request. This is advanced functionality used for external integrations or SuperAdmin functionality.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "FunctionName": { "type": "string" }, "Parameters": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Command": { "x-cipp-field-source": "frontend" }, "Cron": { "x-cipp-field-source": "frontend" }, "ErrorMsg": { "x-cipp-field-source": "frontend" }, "LastOccurrence": { "x-cipp-field-source": "frontend" }, "NextOccurrence": { "x-cipp-field-source": "frontend" }, "Parameters": { "x-cipp-field-source": "frontend" }, "PreferredProcessor": { "x-cipp-field-source": "frontend" }, "Priority": { "x-cipp-field-source": "frontend" }, "Status": { "x-cipp-field-source": "frontend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecCippLogsSas": { "post": { "summary": "Generate a read-only SAS token for the CippLogs table", "operationId": "ExecCippLogsSas", "tags": [ "CIPP > Core" ], "description": "Creates a long-lived, read-only SAS URL for the CippLogs Azure Storage table.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Days": { "type": "string" } } } } } }, "parameters": [ { "name": "Days", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecCippReplacemap": { "post": { "summary": "ExecCippReplacemap", "operationId": "ExecCippReplacemap", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Description": { "type": "string" }, "includeGlobal": { "type": "boolean", "description": "Also return the AllTenants-scoped variables alongside this tenant's own." }, "RowKey": { "type": "string" }, "tenantId": { "type": "string" }, "Value": { "type": "string" }, "VariableType": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "The autocomplete that sets this posts {label, value}; a direct API call posts a plain string. Accept either." } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AddEdit", "Delete", "List" ] } }, { "name": "includeGlobal", "in": "query", "description": "Also return the AllTenants-scoped variables alongside this tenant's own.", "required": false, "schema": { "type": "boolean" } }, { "name": "tenantId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Config.ReadWrite" } }, "/api/ExecCIPPUsers": { "post": { "summary": "ExecCIPPUsers", "operationId": "ExecCIPPUsers", "tags": [ "CIPP > Settings" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Roles": { "type": "string" }, "UPN": { "type": "string" } }, "required": [ "UPN" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AddUpdate", "Delete" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCloneTemplate": { "post": { "summary": "ExecCloneTemplate", "operationId": "ExecCloneTemplate", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "Type": { "type": "string" } } } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecClrImmId": { "post": { "summary": "ExecClrImmId", "operationId": "ExecClrImmId", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with body parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecClrOnPremAttributes": { "post": { "summary": "ExecClrOnPremAttributes", "operationId": "ExecClrOnPremAttributes", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Attributes": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "On-premises attributes to clear (onPremisesImmutableId, onPremisesDistinguishedName, ...), as plain names or {label,value} objects. Omit to clear every clearable attribute." }, "ID": { "type": "string", "description": "Object ID of the cloud-only user whose on-premises attributes should be cleared" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecCombinedSetup": { "post": { "summary": "ExecCombinedSetup", "operationId": "ExecCombinedSetup", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "applicationId": { "type": "string" }, "ApplicationSecret": { "type": "string" }, "baselineOption": { "type": "string" }, "certificateAuth": { "type": "boolean", "description": "Certificate-auth toggle for an existing install: enabling keeps the client secret as a rollback and switches SAM tokens to the certificate. Idempotent with a certificate-only First Setup." }, "email": { "type": "string" }, "RefreshToken": { "type": "string" }, "selectedBaselines": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "do a single download of the selected baselines." }, "selectedOption": { "type": "string" }, "tenantId": { "type": "string" }, "webhook": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "APIKey": { "x-cipp-field-source": "storage" }, "ApplicationId": { "x-cipp-field-source": "storage" }, "ApplicationSecret": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RefreshToken": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "SASUrl": { "x-cipp-field-source": "storage" }, "SecretValue": { "type": "string", "x-cipp-field-source": "storage" }, "severity": { "x-cipp-field-source": "backend" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCommunityRepo": { "post": { "summary": "Make changes to a community repository", "operationId": "ExecCommunityRepo", "tags": [ "Tools > GitHub" ], "description": "This function makes changes to a community repository in table storage", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "Add", "Delete", "ImportScript", "ImportTemplate", "SetBranch", "SetTemplateTypes", "Update", "UploadBaseline", "UploadScript", "UploadTemplate" ] }, "Branch": { "type": "string" }, "Force": { "type": "boolean" }, "FullName": { "type": "string" }, "GUID": { "type": "string" }, "Id": { "type": "string" }, "Message": { "type": "string" }, "Path": { "type": "string" }, "TemplateTypes": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.TemplateLibrary.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCompareIntunePolicy": { "post": { "summary": "ExecCompareIntunePolicy", "operationId": "ExecCompareIntunePolicy", "tags": [ "Endpoint > MEM" ], "description": "Compares an Intune policy against another policy or a stored template and returns the differences setting by setting. Handles device configurations, settings catalog policies, ADMX templates, compliance policies, driver/feature/quality update profiles, intents and app protection policies.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "sourceA": { "type": "object", "properties": { "branch": { "type": "string" }, "fullName": { "type": "string" }, "path": { "type": "string" }, "policyId": { "type": "string" }, "standardsTemplateId": { "type": "string", "description": "tenantFilter is optional here - supplying it resolves the template the way the standard would for that tenant instead of comparing the stored template verbatim." }, "templateGuid": { "type": "string", "description": "tenantFilter is optional here - supplying it resolves the template the way the standard would for that tenant instead of comparing the stored template verbatim." }, "tenantFilter": { "type": "string", "description": "tenantFilter is optional here - supplying it resolves the template the way the standard would for that tenant instead of comparing the stored template verbatim." }, "type": { "type": "string", "x-cipp-observed-values": [ "communityRepo", "template", "tenantPolicy", "tenantPolicyByTemplate" ] }, "urlName": { "type": "string" } } }, "sourceB": { "type": "object", "properties": { "branch": { "type": "string" }, "fullName": { "type": "string" }, "path": { "type": "string" }, "policyId": { "type": "string" }, "standardsTemplateId": { "type": "string", "description": "tenantFilter is optional here - supplying it resolves the template the way the standard would for that tenant instead of comparing the stored template verbatim." }, "templateGuid": { "type": "string", "description": "tenantFilter is optional here - supplying it resolves the template the way the standard would for that tenant instead of comparing the stored template verbatim." }, "tenantFilter": { "type": "string", "description": "tenantFilter is optional here - supplying it resolves the template the way the standard would for that tenant instead of comparing the stored template verbatim." }, "type": { "type": "string", "x-cipp-observed-values": [ "communityRepo", "template", "tenantPolicy", "tenantPolicyByTemplate" ] }, "urlName": { "type": "string" } } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read", "x-cipp-any-tenant": true, "x-cipp-reads-via": [ "Resolve-PolicySource" ] } }, "/api/ExecContainerManagement": { "post": { "summary": "ExecContainerManagement", "operationId": "ExecContainerManagement", "tags": [ "CIPP > Settings" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "AutoUpdate": { "type": "boolean" }, "Channel": { "type": "string" }, "CheckInterval": { "type": "string" }, "CheckTime": { "type": "string" } }, "required": [ "Channel" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "CheckUpdate", "ListChannels", "Restart", "SaveUpdateSettings", "Status", "UpdateChannel" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AutoUpdate": { "type": "string", "x-cipp-field-source": "storage" }, "CheckedTag": { "type": "string", "x-cipp-field-source": "storage" }, "CheckInterval": { "type": "string", "x-cipp-field-source": "storage" }, "CheckTime": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "LastCheck": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RemoteBuildDate": { "type": "string", "x-cipp-field-source": "storage" }, "RemoteDigest": { "type": "string", "x-cipp-field-source": "storage" }, "RemoteVersion": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "RunningVersion": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdateAvailable": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecConvertMailbox": { "post": { "summary": "ExecConvertMailbox", "operationId": "ExecConvertMailbox", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "MailboxType": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecCopilotSettings": { "post": { "summary": "ExecCopilotSettings", "operationId": "ExecCopilotSettings", "tags": [ "Tenant > AI" ], "description": "Sets a single Microsoft 365 Copilot policy setting to Enabled (1), Disabled (0) or Not configured (cleared).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "settingId": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "value": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "policyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "value": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.ReadWrite" } }, "/api/ExecCopyForSent": { "post": { "summary": "ExecCopyForSent", "operationId": "ExecCopyForSent", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "messageCopyState": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "messageCopyState", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecCPVPermissions": { "post": { "summary": "ExecCPVPermissions", "operationId": "ExecCPVPermissions", "tags": [ "CIPP > Settings" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ResetSP", "in": "query", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecCPVRefresh": { "post": { "summary": "This endpoint is used to trigger a refresh of CPV for all tenants", "operationId": "ExecCPVRefresh", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite" } }, "/api/ExecCreateAppTemplate": { "post": { "summary": "ExecCreateAppTemplate", "operationId": "ExecCreateAppTemplate", "tags": [ "Tenant > Administration > Application Approval" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AppId": { "type": "string" }, "DisplayName": { "type": "string" }, "Overwrite": { "type": "boolean" }, "TenantFilter": { "type": "string" }, "Type": { "type": "string", "description": "'servicePrincipal' or 'application'" } }, "required": [ "AppId", "DisplayName", "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.ReadWrite" } }, "/api/ExecCreateCATemplate": { "post": { "summary": "ExecCreateCATemplate", "operationId": "ExecCreateCATemplate", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "name": { "type": "string" } }, "required": [ "displayName" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCreateDefaultGroups": { "post": { "summary": "Create default tenant groups", "operationId": "ExecCreateDefaultGroups", "tags": [ "CIPP > Settings" ], "description": "This function creates a set of default tenant groups that are commonly used", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Description": { "x-cipp-field-source": "storage" }, "DynamicRules": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExcludePartnerTenant": { "type": "boolean", "x-cipp-field-source": "storage" }, "GroupType": { "x-cipp-field-source": "storage" }, "Name": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "RuleLogic": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Groups.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCreateSAMApp": { "post": { "summary": "ExecCreateSAMApp", "operationId": "ExecCreateSAMApp", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "access_token": { "type": "string", "description": "Find Existing app registration" }, "certificateOnly": { "type": "boolean", "description": "A certificate-only setup provisions no client secret. Determined up front so every app management policy call in this flow leaves the password-addition block in force." } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" }, "severity": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCreateTAP": { "post": { "summary": "ExecCreateTAP", "operationId": "ExecCreateTAP", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "generatePwPushLink": { "type": "boolean", "description": "Opt-in: most TAPs are used directly by the admin, so the pass is returned in plain text unless the caller asks for a PwPush link. Same string-to-bool normalisation as above." }, "ID": { "type": "string" }, "isUsableOnce": { "type": "boolean", "description": "Restrict the pass to a single use. New-CIPPTAP takes a [bool], and casting the string 'false' yields $true, so this must be normalised before it is forwarded." }, "lifetimeInMinutes": { "type": "string" }, "startDateTime": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "generatePwPushLink", "in": "query", "description": "Opt-in: most TAPs are used directly by the admin, so the pass is returned in plain text unless the caller asks for a PwPush link. Same string-to-bool normalisation as above.", "required": false, "schema": { "type": "boolean" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "isUsableOnce", "in": "query", "description": "Restrict the pass to a single use. New-CIPPTAP takes a [bool], and casting the string 'false' yields $true, so this must be normalised before it is forwarded.", "required": false, "schema": { "type": "boolean" } }, { "name": "lifetimeInMinutes", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "startDateTime", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecCSPLicense": { "post": { "summary": "ExecCSPLicense", "operationId": "ExecCSPLicense", "tags": [ "Tenant > Reports" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Add": { "type": "string" }, "DaysBeforeRenewal": { "type": "string" }, "Quantity": { "type": "string" }, "Remove": { "type": "string" }, "SKU": { "$ref": "#/components/schemas/LabelValue" }, "SubscriptionIds": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.ReadWrite" } }, "/api/ExecCustomData": { "post": { "summary": "ExecCustomData", "operationId": "ExecCustomData", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "dataType": { "type": "string" }, "id": { "type": "string" }, "isMultiValued": { "type": "boolean" }, "Mapping": { "type": "object", "properties": { "customDataAttribute": { "type": "object", "properties": { "label": { "type": "string" } } }, "directoryObjectType": { "type": "object", "properties": { "label": { "type": "string" } } }, "extensionSyncDataset": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "select": { "type": "string" } } }, "label": { "type": "string" } } }, "extensionSyncProperty": { "type": "object", "properties": { "label": { "type": "string" } } }, "sourceType": { "type": "object", "properties": { "label": { "type": "string" } } }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } } }, "name": { "type": "string" }, "schemaExtension": { "type": "object", "properties": { "id": { "type": "string" } } }, "status": { "type": "string" }, "targetObjects": { "type": "string" }, "type": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AddDirectoryExtension", "AddEditMapping", "AddSchemaExtension", "AddSchemaProperty", "ChangeSchemaState", "DeleteDirectoryExtension", "DeleteMapping", "DeleteSchema", "GetMapping", "ListAvailableAttributes", "ListDirectoryExtensions", "ListMappings", "ListSchemaExtensions" ] } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "targetObject", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "customDataAttribute": { "x-cipp-field-source": "backend" }, "dataset": { "x-cipp-field-source": "backend" }, "directoryObject": { "x-cipp-field-source": "backend" }, "id": { "x-cipp-field-source": "backend" }, "sourceType": { "x-cipp-field-source": "backend" }, "syncProperty": { "x-cipp-field-source": "backend" }, "tenant": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecCustomRole": { "post": { "summary": "ExecCustomRole", "operationId": "ExecCustomRole", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "AllowedRolesTemplate": { "type": "string" }, "AllowedTenants": { "type": "string" }, "BlockedEndpoints": { "type": "string" }, "BlockedTenants": { "type": "string" }, "EntraGroup": { "$ref": "#/components/schemas/LabelValue" }, "IpRange": { "type": "string", "description": "Process IP Range if provided (but not for superadmin to prevent lockout)" }, "NewRoleName": { "type": "string" }, "PermissionRules": { "type": "object", "properties": { "Exclude": { "type": "string" }, "Include": { "type": "string" } } }, "Permissions": { "type": "string" }, "RoleName": { "type": "string", "description": "Process IP Range if provided (but not for superadmin to prevent lockout)" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AddUpdate", "Clone", "Delete", "ListEntraGroups" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "allowExternalSenders": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "assignedLabels": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "autoSubscribeNewMembers": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "classification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "expirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "groupTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "hasMembersWithLicenseErrors": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromAddressLists": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromOutlookClients": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isArchived": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isAssignableToRole": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFavorite": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSubscribedByMail": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "licenseProcessingState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRule": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesNetBiosName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "organizationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "renewedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceBehaviorOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "resourceProvisioningOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "theme": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "unseenConversationsCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenMessagesCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "visibility": { "type": "string", "x-cipp-field-source": "graph-entity" }, "welcomeMessageEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "writebackConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecCustomScript": { "post": { "summary": "ExecCustomScript", "operationId": "ExecCustomScript", "tags": [ "Tools > Custom-Scripts" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Parameters": { "type": "string" }, "ScriptGuid": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "ScriptGuid", "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Tests.ReadWrite" } }, "/api/ExecCustomTestRun": { "post": { "summary": "Triggers a Custom test-suite run for one or all tenants.", "operationId": "ExecCustomTestRun", "tags": [ "Tenant > Tests" ], "description": "Re-runs the enabled Custom tests against the most recent cached data for the requested\ntenant(s) by starting the standard tests orchestration with a Custom-only suite filter.\nUsed by the cross-tenant Custom Test Report to refresh results on demand.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } } } } } }, "parameters": [ { "name": "tenantFilter", "in": "query", "required": false, "schema": { "$ref": "#/components/schemas/LabelValue" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Tests.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDeleteGDAPRelationship": { "post": { "summary": "ExecDeleteGDAPRelationship", "operationId": "ExecDeleteGDAPRelationship", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "GDAPId": { "type": "string", "description": "Interact with query parameters or the body of the request." } } } } } }, "parameters": [ { "name": "GDAPId", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDeleteGDAPRoleMapping": { "post": { "summary": "ExecDeleteGDAPRoleMapping", "operationId": "ExecDeleteGDAPRoleMapping", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "GroupId": { "type": "string" } } } } } }, "parameters": [ { "name": "GroupId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GroupId": { "x-cipp-field-source": "storage" }, "GroupName": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "resultText": { "x-cipp-field-source": "storage" }, "roleDefinitionId": { "x-cipp-field-source": "storage" }, "RoleName": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "state": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDeleteSafeLinksPolicy": { "post": { "summary": "ExecDeleteSafeLinksPolicy", "operationId": "ExecDeleteSafeLinksPolicy", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function deletes a Safe Links rule and its associated policy.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "PolicyName": { "type": "string" }, "RuleName": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "PolicyName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RuleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/ExecDeployAppTemplate": { "post": { "summary": "ExecDeployAppTemplate", "operationId": "ExecDeployAppTemplate", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignTo": { "type": "string" }, "customGroup": { "type": "string" }, "selectedTenants": { "type": "array", "items": { "type": "object", "properties": { "customerId": { "type": "string" }, "defaultDomainName": { "type": "string" } } } }, "templateId": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDeviceAction": { "post": { "summary": "ExecDeviceAction", "operationId": "ExecDeviceAction", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "createDeviceLogCollectionRequest", "setDeviceName", "users", "wipe" ], "description": "Interact with Body parameters or the body of the request." }, "GUID": { "type": "string" }, "input": { "type": "array", "items": { "type": "string" }, "description": "limit to 15 characters" }, "macOsUnlockCode": { "type": "string" }, "tenantFilter": { "type": "string" }, "user": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/ExecDeviceCodeLogon": { "post": { "summary": "ExecDeviceCodeLogon", "operationId": "ExecDeviceCodeLogon", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "clientId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "deviceCode", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "operation", "in": "query", "required": false, "schema": { "type": "string", "x-cipp-observed-values": [ "checkToken", "getDeviceCode" ] } }, { "name": "scope", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tenantId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDeviceDelete": { "post": { "summary": "ExecDeviceDelete", "operationId": "ExecDeviceDelete", "tags": [ "Identity > Administration > Devices" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with body parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "action", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Device.ReadWrite" } }, "/api/ExecDevicePasscodeAction": { "post": { "summary": "ExecDevicePasscodeAction", "operationId": "ExecDevicePasscodeAction", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "removeDevicePasscode", "resetPasscode" ] }, "GUID": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/ExecDiagnosticsPresets": { "post": { "summary": "ExecDiagnosticsPresets", "operationId": "ExecDiagnosticsPresets", "tags": [ "CIPP > Core" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string" }, "GUID": { "type": "string" }, "name": { "type": "string", "description": "Save or update preset" }, "query": { "type": "string" } }, "required": [ "GUID" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecDisableUser": { "post": { "summary": "ExecDisableUser", "operationId": "ExecDisableUser", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Enable": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Enable", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecDismissRiskyUser": { "post": { "summary": "ExecDismissRiskyUser", "operationId": "ExecDismissRiskyUser", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string", "description": "Interact with the query or body of the request" }, "userDisplayName": { "type": "string" }, "userId": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userDisplayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "userId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecDnsConfig": { "post": { "summary": "ExecDnsConfig", "operationId": "ExecDnsConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Domain": { "type": "string" }, "Resolver": { "type": "string" }, "Selector": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "GetConfig", "RemoveDomain", "SetConfig", "SetDkimConfig" ] } }, { "name": "Domain", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Resolver", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Selector", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Domains.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDomainAction": { "post": { "summary": "ExecDomainAction", "operationId": "ExecDomainAction", "tags": [ "Tenant > Administration > Domains" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "delete", "setDefault", "verify" ] }, "domain": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "Action", "domain", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ExecDomainAnalyser": { "post": { "summary": "ExecDomainAnalyser", "operationId": "ExecDomainAnalyser", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.DomainAnalyser.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecDriftClone": { "post": { "summary": "ExecDriftClone", "operationId": "ExecDriftClone", "tags": [ "Tenant > Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" } }, "required": [ "id" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" }, "Success": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/ExecDurableFunctions": { "post": { "summary": "ExecDurableFunctions", "operationId": "ExecDurableFunctions", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "ListOrchestratorHistory", "ListOrchestrators", "ListStats", "PurgeOrchestrators", "ResetDurables" ] } }, { "name": "PartitionKey", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Count": { "x-cipp-field-source": "backend" }, "Exception": { "x-cipp-field-source": "backend" }, "Message": { "x-cipp-field-source": "backend" }, "Name": { "x-cipp-field-source": "backend" }, "Orchestrators": { "x-cipp-field-source": "backend" }, "Pending30MinCount": { "x-cipp-field-source": "backend" }, "Queues": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecEditCalendarPermissions": { "post": { "summary": "ExecEditCalendarPermissions", "operationId": "ExecEditCalendarPermissions", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CanViewPrivateItems": { "type": "string" }, "FolderName": { "type": "string" }, "Permissions": { "$ref": "#/components/schemas/LabelValue" }, "RemoveAccess": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string", "description": "Extract parameters from query or body" }, "userid": { "type": "string" }, "UserToGetPermissions": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "CanViewPrivateItems", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "FolderName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Permissions", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RemoveAccess", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userid", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "UserToGetPermissions", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecEditCAPolicyFull": { "post": { "summary": "ExecEditCAPolicyFull", "operationId": "ExecEditCAPolicyFull", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "PolicyBody": { "type": "object", "properties": { "displayName": { "type": "string" } } }, "PolicyId": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "PolicyBody", "tenantFilter" ] } } } }, "parameters": [ { "name": "PolicyId", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/ExecEditMailboxPermissions": { "post": { "summary": "ExecEditMailboxPermissions", "operationId": "ExecEditMailboxPermissions", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantfilter": { "type": "string" }, "userID": { "type": "string" } }, "required": [ "tenantfilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecEditTemplate": { "post": { "summary": "ExecEditTemplate", "operationId": "ExecEditTemplate", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "description": { "type": "string" }, "displayName": { "type": "string" }, "GUID": { "type": "string" }, "id": { "type": "string" }, "name": { "type": "string" }, "parsedRAWJson": { "type": "object", "properties": { "@odata.type": { "type": "string" }, "settings": { "type": "string" } }, "description": "Intune identifies a policy and every setting in it by @odata.type, and rejects a policy that is missing them. An editor that rebuilds the body from form state can drop them silently, which stores a template that only fails at deployment time - so refuse the write here rather than let a working template be replaced by one that cannot deploy." }, "Type": { "type": "string" } } } } } }, "parameters": [ { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecEmailForward": { "post": { "summary": "ExecEmailForward", "operationId": "ExecEmailForward", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ForwardExternal": { "type": "string" }, "ForwardInternal": { "$ref": "#/components/schemas/LabelValue" }, "forwardOption": { "type": "string", "enum": [ "disabled", "ExternalAddress", "internalAddress" ] }, "KeepCopy": { "type": "boolean" }, "tenantFilter": { "type": "string" }, "userID": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecEmptySiteRecycleBin": { "post": { "summary": "ExecEmptySiteRecycleBin", "operationId": "ExecEmptySiteRecycleBin", "tags": [ "Teams-Sharepoint" ], "description": "Permanently empty a site recycle bin (first stage, second stage, or both).\nItem ids are used only server-side; the response never includes file names.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "SiteUrl": { "type": "string" }, "Stage": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.SiteRecycleBin.ReadWrite" } }, "/api/ExecEnableArchive": { "post": { "summary": "ExecEnableArchive", "operationId": "ExecEnableArchive", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "username": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "username", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecEnableAutoExpandingArchive": { "post": { "summary": "ExecEnableAutoExpandingArchive", "operationId": "ExecEnableAutoExpandingArchive", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "tenantFilter": { "type": "string" }, "username": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecExchangeRoleRepair": { "post": { "summary": "ExecExchangeRoleRepair", "operationId": "ExecExchangeRoleRepair", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantId": { "type": "string" } } } } } }, "parameters": [ { "name": "tenantId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "allowedPrincipalTypes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isBuiltIn": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isPrivileged": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "resourceScopes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "rolePermissions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "templateId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "version": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecExcludeLicenses": { "post": { "summary": "ExecExcludeLicenses", "operationId": "ExecExcludeLicenses", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "AddExclusion", "AlertOnly", "RemoveExclusion", "RestoreDefaults", "SetShowInDropdown" ] }, "FullReset": { "type": "boolean" }, "GUID": { "type": "string" }, "ShowInDropdown": { "type": "boolean" }, "SKUName": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExcludedEverywhere": { "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Product_Display_Name": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecExcludeTenant": { "post": { "summary": "ExecExcludeTenant", "operationId": "ExecExcludeTenant", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "value": { "type": "array", "items": { "type": "string" } } } } } } }, "parameters": [ { "name": "AddExclusion", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ListAll", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RemoveExclusion", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "customerId": { "x-cipp-field-source": "storage" }, "defaultDomainName": { "x-cipp-field-source": "storage,frontend" }, "delegatedPrivilegeStatus": { "x-cipp-field-source": "storage,frontend" }, "directTenantAuthDate": { "x-cipp-field-source": "storage" }, "directTenantUserPrincipalName": { "x-cipp-field-source": "storage" }, "displayName": { "x-cipp-field-source": "storage,frontend" }, "domains": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Excluded": { "x-cipp-field-source": "storage,frontend" }, "ExcludeDate": { "x-cipp-field-source": "storage,frontend" }, "ExcludeUser": { "x-cipp-field-source": "storage,frontend" }, "hasAutoExtend": { "x-cipp-field-source": "storage" }, "initialDomainName": { "x-cipp-field-source": "storage" }, "LastGraphError": { "x-cipp-field-source": "storage" }, "LastGraphTokenError": { "x-cipp-field-source": "storage" }, "LastRefresh": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "relationshipCount": { "x-cipp-field-source": "storage" }, "relationshipEnd": { "x-cipp-field-source": "storage" }, "RequiresRefresh": { "type": "boolean", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecExtensionClearHIBPKey": { "post": { "summary": "ExecExtensionClearHIBPKey", "operationId": "ExecExtensionClearHIBPKey", "tags": [ "CIPP > Extensions" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite" } }, "/api/ExecExtensionMapping": { "post": { "summary": "ExecExtensionMapping", "operationId": "ExecExtensionMapping", "tags": [ "CIPP > Extensions" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "AddMapping", "in": "query", "description": "AnyTenant: mapping writes wipe and rewrite whole partitions and re-register per-tenant sync tasks, so they require an unrestricted tenant scope", "required": false, "schema": { "type": "string", "enum": [ "HaloPSA", "Hudu", "HuduFields", "NinjaOne", "NinjaOneFields", "Sherweb" ] } }, { "name": "AutoMapping", "in": "query", "description": "AnyTenant: mapping writes wipe and rewrite whole partitions and re-register per-tenant sync tasks, so they require an unrestricted tenant scope", "required": false, "schema": { "type": "string", "enum": [ "HaloPSA", "NinjaOne" ] } }, { "name": "List", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "HaloPSA", "HaloPSAFields", "HaloPSARequestSources", "Hudu", "HuduFields", "NinjaOne", "NinjaOneFields", "PWPushFields", "Sherweb" ] } }, { "name": "TicketType", "in": "query", "description": "Outcomes and priorities are scoped to a ticket type. The settings page sends the ticket type currently selected in the form so the lists follow the dropdown; without it both fall back to whatever ticket type was last saved. @() on each: PowerShell unrolls single-element output, so a ticket type with one outcome (or a lookup that answers with a single explanatory row) would otherwise serialise as a bare object and break callers that expect a list.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecExtensionNinjaOneQueue": { "post": { "summary": "ExecExtensionNinjaOneQueue", "operationId": "ExecExtensionNinjaOneQueue", "tags": [ "CIPP > Extensions" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Body": { "x-cipp-field-source": "backend" }, "StatusCode": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite" } }, "/api/ExecExtensionsConfig": { "post": { "summary": "ExecExtensionsConfig", "operationId": "ExecExtensionsConfig", "tags": [ "CIPP > Extensions" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite" } }, "/api/ExecExtensionSync": { "post": { "summary": "ExecExtensionSync", "operationId": "ExecExtensionSync", "tags": [ "CIPP > Extensions" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "Extension", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Gradient", "Hudu", "NinjaOne" ] } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "TenantID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite" } }, "/api/ExecExtensionTest": { "get": { "summary": "ExecExtensionTest", "operationId": "ExecExtensionTest", "tags": [ "CIPP > Extensions" ], "description": "Tests the stored credentials for a configured third-party integration and reports whether CIPP can connect. extensionName selects which one: HaloPSA, Gradient, NinjaOne, PWPush, Hudu, Sherweb, HIBP or GitHub.", "parameters": [ { "name": "extensionName", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "CIPP-API", "GitHub", "Gradient", "HaloPSA", "HIBP", "Hudu", "NinjaOne", "PWPush", "Sherweb" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "config": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.Read", "x-cipp-any-tenant": true } }, "/api/ExecFeatureFlag": { "post": { "summary": "ExecFeatureFlag", "operationId": "ExecFeatureFlag", "tags": [ "CIPP > Core" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "Get", "Set" ] }, "Enabled": { "type": "string" }, "Id": { "type": "string" } }, "required": [ "Enabled", "Id" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecGDAPAccessAssignment": { "post": { "summary": "ExecGDAPAccessAssignment", "operationId": "ExecGDAPAccessAssignment", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "ResetMappings" ] }, "Id": { "type": "string" }, "RoleTemplateId": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Id", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "allowExternalSenders": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "assignedLabels": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "autoSubscribeNewMembers": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "classification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "expirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "groupTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "hasMembersWithLicenseErrors": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromAddressLists": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "hideFromOutlookClients": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isArchived": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isAssignableToRole": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFavorite": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSubscribedByMail": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "licenseProcessingState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRule": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "membershipRuleProcessingStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesNetBiosName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "organizationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "renewedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceBehaviorOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "resourceProvisioningOptions": { "type": "array", "x-cipp-field-source": "graph-entity" }, "RoleMappings": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "securityEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "theme": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "unseenConversationsCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "unseenMessagesCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "visibility": { "type": "string", "x-cipp-field-source": "graph-entity" }, "welcomeMessageEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "writebackConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecGDAPInvite": { "post": { "summary": "ExecGDAPInvite", "operationId": "ExecGDAPInvite", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "InviteId": { "type": "string" }, "Reference": { "type": "string" }, "roleMappings": { "type": "object", "properties": { "roleDefinitionId": { "type": "array", "items": { "type": "string" } } } } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "activatedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "autoExtendDuration": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customer": { "type": "object", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "duration": { "type": "string", "x-cipp-field-source": "graph-entity" }, "endDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecGDAPInviteApproved": { "post": { "summary": "ExecGDAPInviteApproved", "operationId": "ExecGDAPInviteApproved", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecGDAPRemoveGArole": { "post": { "summary": "ExecGDAPRemoveGArole", "operationId": "ExecGDAPRemoveGArole", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "GDAPId": { "type": "string" } } } } } }, "parameters": [ { "name": "GDAPId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "activatedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "autoExtendDuration": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customer": { "type": "object", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "duration": { "type": "string", "x-cipp-field-source": "graph-entity" }, "endDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecGDAPRepairRoleMappings": { "post": { "summary": "ExecGDAPRepairRoleMappings", "operationId": "ExecGDAPRepairRoleMappings", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecGDAPRoleTemplate": { "post": { "summary": "ExecGDAPRoleTemplate", "operationId": "ExecGDAPRoleTemplate", "tags": [ "Tenant > GDAP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "CustomSuffix": { "type": "string" }, "GroupId": { "type": "string" }, "NewRoles": { "type": "string" }, "OriginalTemplateId": { "type": "string", "description": "Use OriginalTemplateId if provided (for rename), otherwise use TemplateId" }, "RoleMappings": { "type": "array", "items": { "type": "object", "properties": { "GroupId": { "type": "array", "items": { "type": "string" } }, "roleDefinitionId": { "type": "string" } } } }, "TemplateId": { "type": "string", "description": "Template-first save: creates any group mappings the editor asked for, then writes the full mapping set to the template in one shot." } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Add", "Delete", "Edit", "Save" ] } }, { "name": "TemplateId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GroupMappings": { "x-cipp-field-source": "frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RoleMappings": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Roles": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "TemplateId": { "x-cipp-field-source": "backend,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.ReadWrite", "x-cipp-any-tenant": true, "x-cipp-reads-via": [ "Add-CIPPGDAPRoleTemplate" ] } }, "/api/ExecGDAPTrace": { "get": { "summary": "Tests the complete GDAP (Granular Delegated Admin Privileges) access path for a user.\n\nThis function traces the access path from customer tenant → GDAP relationships → mapped security groups → user,\nchecking all 15 standard GDAP roles. It verifies whether a SAM user in the partner tenant has access to each\nrole through direct or nested group memberships across all active GDAP relationships for a customer tenant.\n\nThe function returns a role-centric view showing:\n- For each of the 15 GDAP roles: whether it's assigned, whether the user has access, and the complete path\n- Complete traceability: Role → Relationship → Group → User (including nested group paths)\n- Broken path detection: identifies roles assigned but user not a member of the required groups\n\nThe output is structured as JSON suitable for diagram visualization, showing the complete access chain\nregardless of which relationship provides each role.\n\nVery boilerplate AI code. Needs some simplification and cleanup.\nRidiculous amount of comments to explain the logic so I don't have to explain it to Claude on the frontend. - rvd", "operationId": "ExecGDAPTrace", "tags": [ "CIPP > Settings" ], "description": "GDAP Access Path Testing:\n1. Validates input parameters (TenantFilter and UPN)\n2. Retrieves customer tenant information\n3. Gets all active GDAP relationships for the customer tenant\n4. Locates the UPN in the partner tenant\n5. Gets user's transitive group memberships (handles nested groups automatically)\n6. For each GDAP relationship:\n - Retrieves all access assignments (mapped security groups)\n - For each group: checks user membership (direct or nested) and traces the path\n - Maps roles to relationships and groups\n7. For each of the 15 GDAP roles:\n - Finds all relationships/groups that have this role assigned\n - Checks if user is a member of any group with this role\n - Builds complete access path showing how user gets the role (if they do)\n8. Returns comprehensive JSON with role-centric view and complete path traces", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UPN", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "relationships": { "x-cipp-field-source": "backend" }, "roles": { "x-cipp-field-source": "backend" }, "rolesAssignedButNoAccess": { "x-cipp-field-source": "backend" }, "rolesInRelationshipButNotAssigned": { "x-cipp-field-source": "backend" }, "rolesNotInAnyRelationship": { "x-cipp-field-source": "backend" }, "rolesWithAccess": { "x-cipp-field-source": "backend" }, "summary": { "x-cipp-field-source": "backend" }, "tenantId": { "x-cipp-field-source": "backend" }, "tenantName": { "x-cipp-field-source": "backend" }, "totalRelationships": { "x-cipp-field-source": "backend" }, "totalRoles": { "x-cipp-field-source": "backend" }, "userDisplayName": { "x-cipp-field-source": "backend" }, "userId": { "x-cipp-field-source": "backend" }, "userUPN": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read" } }, "/api/ExecGenerateReportBuilderReport": { "post": { "summary": "ExecGenerateReportBuilderReport", "operationId": "ExecGenerateReportBuilderReport", "tags": [ "Tools > Report-Builder" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "Blocks": { "type": "string" }, "ReportGUID": { "type": "string" }, "TemplateGUID": { "type": "string" }, "TemplateName": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "ReportGUID", "TenantFilter" ] } } } }, "parameters": [ { "name": "TemplateName", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" } }, "/api/ExecGeoIPLookup": { "post": { "summary": "ExecGeoIPLookup", "operationId": "ExecGeoIPLookup", "tags": [ "CIPP > Core" ], "description": "Resolves a single IP address to its geographic location using CIPP's bundled GeoIP database.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "IP": { "type": "string" } } } } } }, "parameters": [ { "name": "IP", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ExecGetBaselineWhatIfReportPdf": { "post": { "summary": "ExecGetBaselineWhatIfReportPdf", "operationId": "ExecGetBaselineWhatIfReportPdf", "tags": [ "Tenant > Standards" ], "description": "Server-renders the Security Baseline report for a tenant as application/pdf bytes: where the\nassigned baselines stand today, what is already in place, the Conditional Access and Intune\npolicies and the settings the baseline will change (what each does, its value today, the value\nit will be set to and why), the rollout waves still to come and the agreed exceptions - plus,\noptionally, everything one or more simulated (not yet assigned) baselines would add. Reads the\nsame alignment, baseline and catalog data the Baselines page shows, composes it through the\nshared CIPPSharp component kit (Build-CippBaselineWhatIfReportTree) and returns the finished\nPDF. Nothing is changed by producing it.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "brandingPresetId": { "type": "string", "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding." }, "sectionConfig": { "type": "object", "properties": { "alreadyAligned": { "type": "string", "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true." }, "rolloutStages": { "type": "string", "description": "Optional. Show the \"How The Rollout Works\" section (the remaining waves and when they arrive). A boolean; defaults to true." } }, "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true." }, "simulatedTemplateIds": { "type": "array", "items": { "type": "string" } }, "tenantFilter": { "type": "string", "description": "Required. The tenant (default domain) to report on." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "brandingPresetId", "in": "query", "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.Read" } }, "/api/ExecGetBecReportPdf": { "post": { "summary": "ExecGetBecReportPdf", "operationId": "ExecGetBecReportPdf", "tags": [ "Identity > Administration > Users" ], "description": "Server-renders a stored Business Email Compromise (BEC) run as application/pdf bytes. Reads the\nrun through Get-CIPPBecReport (the BecReports metadata row plus its BecResults payload) and\ncomposes it through the shared CIPPSharp component kit (Build-CippBecReportTree) - the server-side\nreplacement for the client react-pdf BECRemediationReportButton. A run is named by its caseId;\npass userId instead to render the user's newest completed run. The run must have completed - the\nreport reads its stored result, it does not trigger a new investigation.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "caseId": { "type": "string", "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run." }, "tenantFilter": { "type": "string" }, "userDisplayName": { "type": "string", "description": "The investigated user labels the cover and footer; the run stored who it was for." }, "userId": { "type": "string" }, "userName": { "type": "string" }, "variant": { "type": "string", "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "caseId", "in": "query", "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userDisplayName", "in": "query", "description": "The investigated user labels the cover and footer; the run stored who it was for.", "required": false, "schema": { "type": "string" } }, { "name": "userId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "userName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "variant", "in": "query", "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ExecGetExecutiveReportPdf": { "post": { "summary": "ExecGetExecutiveReportPdf", "operationId": "ExecGetExecutiveReportPdf", "tags": [ "Tenant > Standards" ], "description": "Server-renders the Executive Summary report as application/pdf bytes. Every figure is read from the\nnightly Reporting DB cache via New-CIPPDbRequest (Users/Guests/Roles for the environment overview,\nLicenseOverview, ManagedDevices, ConditionalAccessPolicies and SecureScore) plus the standards\ncomparison from the CippStandardsReports table resolved against the standards catalog - the same\ncached data the rest of CIPP reports from, with no live Graph or cross-endpoint HTTP calls. The\nshaped data is composed through the shared CIPPSharp component kit (Build-CippExecutiveReportTree),\nthe server-side replacement for the client react-pdf ExecutiveReportButton. Each source is gathered\ndefensively: a source with no cached data simply drops its section.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "brandingPresetId": { "type": "string", "description": "The branding preset a caller picked for this render, else the global branding settings." }, "sectionConfig": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "brandingPresetId", "in": "query", "description": "The branding preset a caller picked for this render, else the global branding settings.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read" } }, "/api/ExecGetLicenseReportPdf": { "post": { "summary": "ExecGetLicenseReportPdf", "operationId": "ExecGetLicenseReportPdf", "tags": [ "Tenant > Reports" ], "description": "Server-renders the License Optimisation report as application/pdf bytes. Runs the same license\nrecommendation analysis the License Optimization page reads through ListLicenseRecommendations\n(Get-CIPPLicenseRecommendation, with the page's currency, thresholds and recommendation switches)\nand composes it through the shared CIPPSharp kit (Build-CippLicenseReportTree) - the server-side\nreplacement for the client react-pdf LicenseReportButton.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "brandingPresetId": { "type": "string", "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding." }, "currency": { "type": "string", "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD." }, "inactiveDays": { "type": "string", "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90." }, "protectSecurityFeatures": { "type": "string" }, "recommendDowngrades": { "type": "string" }, "recommendTerms": { "type": "string" }, "recommendUpgrades": { "type": "string" }, "sections": { "type": "object", "properties": { "downgrades": { "type": "boolean" }, "method": { "type": "boolean" }, "reclaim": { "type": "boolean" }, "spend": { "type": "boolean" }, "terms": { "type": "boolean" }, "upgrades": { "type": "boolean" } } }, "tenantFilter": { "type": "string", "description": "The tenant to report on. A single tenant; AllTenants is not supported." }, "tenureMonths": { "type": "string", "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "brandingPresetId", "in": "query", "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding.", "required": false, "schema": { "type": "string" } }, { "name": "currency", "in": "query", "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD.", "required": false, "schema": { "type": "string" } }, { "name": "inactiveDays", "in": "query", "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90.", "required": false, "schema": { "type": "string" } }, { "name": "protectSecurityFeatures", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "recommendDowngrades", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "recommendTerms", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "recommendUpgrades", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "tenureMonths", "in": "query", "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ExecGetLocalAdminPassword": { "post": { "summary": "ExecGetLocalAdminPassword", "operationId": "ExecGetLocalAdminPassword", "tags": [ "Endpoint > MEM" ], "description": "Retrieves the Windows LAPS local administrator password for a device, identified by its Entra device GUID. Returns a live credential in plain text; the retrieval is written to the CIPP audit log.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "guid": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Device.Read" } }, "/api/ExecGetMailFlowReportPdf": { "post": { "summary": "ExecGetMailFlowReportPdf", "operationId": "ExecGetMailFlowReportPdf", "tags": [ "Email-Exchange > Reports" ], "description": "Server-renders the Exchange mail flow report as application/pdf bytes. Reads the same three Exchange\nreports the Mail Flow page uses (Get-MailFlowStatusReport plus the TopMailSender and\nTopSpamRecipient traffic summaries), aggregates the daily disposition rows the way the page does,\nand composes them through the shared CIPPSharp kit (Build-CippMailFlowReportTree) - the server-side\nreplacement for the client react-pdf MailFlowReportButton.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "days", "in": "query", "description": "Reporting window in days (1-90).", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ExecGetPermissionsReportPdf": { "post": { "summary": "ExecGetPermissionsReportPdf", "operationId": "ExecGetPermissionsReportPdf", "tags": [ "Teams-Sharepoint" ], "description": "Server-renders the SharePoint Permissions report as application/pdf bytes. Gathers the same shaped\ndata the Permissions page uses (ListSharePointPermissions, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippPermissionsReportTree) and returns the\nfinished PDF - the server-side replacement for the client react-pdf PermissionsReportButton.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ExecGetRecoveryKey": { "post": { "summary": "ExecGetRecoveryKey", "operationId": "ExecGetRecoveryKey", "tags": [ "Endpoint > MEM" ], "description": "Retrieves a device's disk encryption recovery key by device GUID. RecoveryKeyType selects BitLocker (the default) or FileVault. Returns a live recovery key in plain text; the retrieval is written to the CIPP audit log.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "RecoveryKeyType": { "type": "string", "enum": [ "BiosPassword", "BitLocker", "FileVault" ] }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Device.Read" } }, "/api/ExecGetReportBuilderPdf": { "get": { "summary": "ExecGetReportBuilderPdf", "operationId": "ExecGetReportBuilderPdf", "tags": [ "Tools > Report-Builder" ], "description": "Returns the server-rendered PDF for a generated Report Builder report as application/pdf bytes.\nBacks both the in-app preview (shown in an iframe) and the download button on the view page.\nA report generated before server-side rendering (or whose render failed) is rendered from its\nstored blocks on first request and cached. 404 when the report does not exist, and also when\nthe report belongs to a tenant the caller cannot access.", "parameters": [ { "name": "id", "in": "query", "description": "The generated report's GUID.", "required": true, "schema": { "type": "string" } }, { "name": "ReportGUID", "in": "query", "description": "The generated report's GUID.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "PartitionKey": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.ReportBuilder.Read", "x-cipp-any-tenant": true } }, "/api/ExecGetShadowAIReportPdf": { "post": { "summary": "ExecGetShadowAIReportPdf", "operationId": "ExecGetShadowAIReportPdf", "tags": [ "Tenant > AI" ], "description": "Server-renders the Shadow AI report as application/pdf bytes. Gathers the same shaped data the\nShadow AI page uses (ListShadowAI) and composes it through the shared CIPPSharp component kit\n(Build-CippShadowAIReportTree) - the server-side replacement for the client react-pdf\nShadowAIReportButton.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "sectionConfig": { "type": "array", "items": { "type": "string" } }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.Read" } }, "/api/ExecGetSharingReportPdf": { "post": { "summary": "ExecGetSharingReportPdf", "operationId": "ExecGetSharingReportPdf", "tags": [ "Teams-Sharepoint" ], "description": "Server-renders the SharePoint & OneDrive Sharing report as application/pdf bytes. Gathers the same\nshaped data the Sharing page uses (ListSharePointSharing, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippSharingReportTree) and returns the finished\nPDF - the server-side replacement for the client react-pdf SharingReportButton.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ExecGitHubAction": { "post": { "summary": "Invoke GitHub Action", "operationId": "ExecGitHubAction", "tags": [ "Tools > GitHub" ], "description": "Call GitHub API", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "CreateRepo", "GetBranches", "GetFileContents", "GetFileTree", "GetOrgs", "ImportTemplate", "Search" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecGraphExplorerPreset": { "post": { "summary": "ExecGraphExplorerPreset", "operationId": "ExecGraphExplorerPreset", "tags": [ "Tenant > Tools" ], "description": "Manages the caller's saved Graph Explorer presets. The action field selects the operation: Copy duplicates a preset, Save creates or updates one, and Delete removes one. Save and Delete modify stored data despite the Read role on this endpoint, and a caller may only modify presets they own.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string", "enum": [ "Copy", "Delete", "Save" ] }, "preset": { "type": "object", "properties": { "endpoint": { "type": "string" }, "id": { "type": "string" }, "IsShared": { "type": "string" }, "name": { "type": "string" } } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ExecGraphRequestProfile": { "get": { "summary": "ExecGraphRequestProfile", "operationId": "ExecGraphRequestProfile", "tags": [ "CIPP > Core" ], "description": "Profiles a Graph request for troubleshooting, timing the call and reporting what it returned. Passing Mode=Diagnostics instead returns a point-in-time snapshot of the CIPPSharp REST client and token cache counters without calling Graph at all, and Reset=true clears those counters after reading them.", "parameters": [ { "name": "Endpoint", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "manualPagination", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "Mode", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Reset", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Version", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "CoreStateAfter": { "x-cipp-field-source": "backend" }, "CoreStateBefore": { "x-cipp-field-source": "backend" }, "Endpoint": { "x-cipp-field-source": "backend" }, "GraphUrl": { "x-cipp-field-source": "backend" }, "Tenant": { "x-cipp-field-source": "backend" }, "Timings": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ExecGroupMembers": { "post": { "summary": "ExecGroupMembers", "operationId": "ExecGroupMembers", "tags": [ "Identity > Administration > Groups" ], "description": "Manages group membership (members and owners) via a switch-style action parameter.\nAccepts one or more directory object IDs, UPNs, or mail addresses (users, groups, etc.).\nAutomatically resolves the group type from Graph to route through the correct API (Graph or Exchange).\n\nSupported actions: addMember, removeMember, addOwner, removeOwner", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string", "enum": [ "addMember", "addOwner", "removeMember", "removeOwner" ] }, "groupId": { "type": "string" }, "tenantFilter": { "type": "string" }, "users": { "type": "string", "description": "Accept a single string or an array of strings (IDs, UPNs, or mail)" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.ReadWrite" } }, "/api/ExecGroupsDelete": { "post": { "summary": "ExecGroupsDelete", "operationId": "ExecGroupsDelete", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "GroupType": { "type": "string" }, "id": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "displayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "GroupType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecGroupsDeliveryManagement": { "post": { "summary": "ExecGroupsDeliveryManagement", "operationId": "ExecGroupsDeliveryManagement", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GroupType": { "type": "string" }, "ID": { "type": "string" }, "OnlyAllowInternal": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GroupType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "OnlyAllowInternal", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Group.ReadWrite" } }, "/api/ExecGroupsHideFromGAL": { "post": { "summary": "ExecGroupsHideFromGAL", "operationId": "ExecGroupsHideFromGAL", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GroupType": { "type": "string" }, "HideFromGAL": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GroupType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "HideFromGAL", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Group.ReadWrite" } }, "/api/ExecHaloPSATestTicket": { "post": { "summary": "Create a HaloPSA test ticket so admins can check the integration works without waiting\nfor a real alert to fire. Covers auth, tenant mapping, ticket type and default priority.\n\nCalls New-HaloPSATicket directly rather than going through Send-CIPPAlert, so the parts\nthat live in the alert pipeline - the [CIPP] title prefix and per-user ticket linking -\nare not exercised here.", "operationId": "ExecHaloPSATestTicket", "tags": [ "CIPP > Extensions" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecHideFromGAL": { "post": { "summary": "ExecHideFromGAL", "operationId": "ExecHideFromGAL", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "HideFromGAL": { "type": "string" }, "ID": { "type": "string", "description": "Support if the request is a POST or a GET. So to support legacy(GET) and new(POST) requests" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "HideFromGAL", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "description": "Support if the request is a POST or a GET. So to support legacy(GET) and new(POST) requests", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecHistoricalSearch": { "post": { "summary": "ExecHistoricalSearch", "operationId": "ExecHistoricalSearch", "tags": [ "Email-Exchange > Tools" ], "description": "Starts or cancels an Exchange Online historical search. Historical searches cover up to 90 days,\ndeliver results as CSV (max 100,000 rows) and are limited to 250 submissions per day per tenant.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "deliveryStatus": { "$ref": "#/components/schemas/LabelValue" }, "direction": { "$ref": "#/components/schemas/LabelValue" }, "jobId": { "type": "string" }, "messageId": { "type": "string" }, "notifyAddress": { "type": "string" }, "originalClientIP": { "type": "string" }, "recipientAddress": { "type": "string" }, "reportTitle": { "type": "string" }, "reportType": { "$ref": "#/components/schemas/LabelValue" }, "senderAddress": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "jobId", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecHVEUser": { "post": { "summary": "ExecHVEUser", "operationId": "ExecHVEUser", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "AssignBillingPolicy", "Edit", "Remove", "RemoveBillingPolicy" ] }, "BillingPolicyId": { "$ref": "#/components/schemas/LabelValue" }, "DisplayName": { "type": "string" }, "domain": { "$ref": "#/components/schemas/LabelValue" }, "Identity": { "type": "string" }, "password": { "type": "string" }, "PrimarySmtpAddress": { "type": "string", "description": "Build PrimarySmtpAddress from username + domain fields, or use direct value" }, "ReplyTo": { "type": "string", "description": "Set-HVEAccountSettings supports ReplyTo only" }, "TenantFilter": { "type": "string" }, "username": { "type": "string" } }, "required": [ "Identity", "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecIncidentsList": { "get": { "summary": "ExecIncidentsList", "operationId": "ExecIncidentsList", "tags": [ "Security > Incidents" ], "description": "Lists Microsoft 365 Defender security incidents for a tenant, optionally bounded by StartDate and EndDate (both YYYYMMDD). tenantFilter=AllTenants reads the cached incident table rather than querying each tenant live.", "parameters": [ { "name": "EndDate", "in": "query", "description": "YYYYMMDD or null", "required": false, "schema": { "type": "string" } }, { "name": "StartDate", "in": "query", "description": "YYYYMMDD or null", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "Alert": { "type": "string", "x-cipp-field-source": "storage" }, "AssignedTo": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "classification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "comments": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Created": { "x-cipp-field-source": "frontend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customTags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "determination": { "type": "object", "x-cipp-field-source": "graph-entity" }, "DisplayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "Incident": { "type": "string", "x-cipp-field-source": "storage" }, "IncidentUrl": { "x-cipp-field-source": "frontend" }, "incidentWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedBy": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastUpdateDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "MdoAlert": { "type": "string", "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "priorityScore": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "recommendedActions": { "type": "string", "x-cipp-field-source": "graph-entity" }, "recommendedHuntingQueries": { "type": "array", "x-cipp-field-source": "graph-entity" }, "redirectIncidentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resolvingComment": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Severity": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "Status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "summary": { "type": "string", "x-cipp-field-source": "graph-entity" }, "systemTags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Tags": { "x-cipp-field-source": "frontend" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Incident.Read" } }, "/api/ExecIRMConfiguration": { "post": { "summary": "ExecIRMConfiguration", "operationId": "ExecIRMConfiguration", "tags": [ "Email-Exchange > Tools" ], "description": "Updates the Microsoft Purview Message Encryption configuration for a tenant (AzureRMSLicensingEnabled, SimplifiedClientAccessEnabled, EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled, TransportDecryptionSetting; only the settings present in the body are changed), or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "Set", "Test" ] }, "Recipient": { "type": "string" }, "Sender": { "type": "string" }, "tenantFilter": { "type": "string" }, "TransportDecryptionSetting": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecJITAdmin": { "post": { "summary": "ExecJITAdmin", "operationId": "ExecJITAdmin", "tags": [ "Identity > Administration > Users" ], "description": "Just-in-time admin management API endpoint. This function can create users, add roles, remove roles, delete, or disable a user.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AdminRoles": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Enforce the caller's allowed JIT roles (from the JIT Role Template on their custom role). Get-CIPPJITAdminAllowedRoles is authoritative and fails closed for restricted callers, so we trust its result rather than swallowing errors here." }, "Domain": { "$ref": "#/components/schemas/LabelValue" }, "EndDate": { "type": "string" }, "existingUser": { "$ref": "#/components/schemas/LabelValue" }, "ExpireAction": { "$ref": "#/components/schemas/LabelValue" }, "FirstName": { "type": "string" }, "GroupMemberships": { "$ref": "#/components/schemas/LabelValue" }, "LastName": { "type": "string" }, "PostExecution": { "type": "boolean" }, "reason": { "type": "string" }, "StartDate": { "type": "string" }, "tapLifetimeInMinutes": { "type": "integer" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" }, "usageLocation": { "$ref": "#/components/schemas/LabelValue" }, "userAction": { "type": "string" }, "Username": { "type": "string" }, "UseTAP": { "type": "string", "description": "Region TAP creation" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/ExecJITAdminSettings": { "post": { "summary": "ExecJITAdminSettings", "operationId": "ExecJITAdminSettings", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "MaxDuration": { "$ref": "#/components/schemas/LabelValue" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ApplicationId": { "x-cipp-field-source": "storage" }, "colour": { "x-cipp-field-source": "storage" }, "coverFooterText": { "x-cipp-field-source": "storage" }, "coverImage": { "x-cipp-field-source": "storage" }, "coverImageId": { "x-cipp-field-source": "storage" }, "coverImageIds": { "x-cipp-field-source": "storage" }, "coverStock": { "x-cipp-field-source": "storage" }, "coverUploads": { "x-cipp-field-source": "storage" }, "Enabled": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "footerText": { "x-cipp-field-source": "storage" }, "logo": { "x-cipp-field-source": "storage" }, "logoImageId": { "x-cipp-field-source": "storage" }, "logoImageIds": { "x-cipp-field-source": "storage" }, "logoUploads": { "x-cipp-field-source": "storage" }, "MaxDuration": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "reportDefaults": { "x-cipp-field-source": "storage" }, "Resolver": { "x-cipp-field-source": "storage" }, "RetentionDays": { "x-cipp-field-source": "storage" }, "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "secondaryColour": { "x-cipp-field-source": "storage" }, "showFooter": { "x-cipp-field-source": "storage" }, "showPageNumbers": { "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Timezone": { "x-cipp-field-source": "storage" }, "TimezoneSource": { "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" }, "watermarkEnabled": { "x-cipp-field-source": "storage" }, "watermarkText": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecLicensePricing": { "post": { "summary": "ExecLicensePricing", "operationId": "ExecLicensePricing", "tags": [ "Tenant > Reports" ], "description": "Manage MSP-global license price overrides used by the license optimization report.\nSetPrice upserts a per-SKU monthly price; RemovePrice deletes an override so the SKU falls\nback to the shipped MSRP estimate.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "RemovePrice", "SetPrice" ], "description": "SetPrice or RemovePrice" }, "Currency": { "type": "string", "description": "Overrides are currency-scoped: one row per (skuId, currency), so an AUD override and a USD override for the same SKU coexist. RowKey = \"{skuId}-{currency}\"." }, "MonthlyPrice": { "type": "number", "description": "Monthly price per seat, in the given currency" }, "Product_Display_Name": { "type": "string" }, "skuId": { "type": "string", "description": "The SKU GUID (skuId) the price applies to" }, "skuPartNumber": { "type": "string" } }, "required": [ "Action" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Currency": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "MonthlyPrice": { "type": "number", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Product_Display_Name": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "skuId": { "x-cipp-field-source": "storage" }, "skuPartNumber": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecLicenseSearch": { "post": { "summary": "ExecLicenseSearch", "operationId": "ExecLicenseSearch", "tags": [ "CIPP > Core" ], "description": "Resolves licence SKU ids to display names from the licence name table, falling back to the given tenant's cached licence overview. Takes an array of skuIds in the body.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "skuIds": { "type": "array", "items": { "type": "string" } }, "tenantFilter": { "type": "string", "description": "Tenant whose cached licence overview is checked for SKUs the name table does not hold yet" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ExecListAppId": { "post": { "summary": "ExecListAppId", "operationId": "ExecListAppId", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "addIns": { "type": "array", "x-cipp-field-source": "graph-entity" }, "api": { "type": "object", "x-cipp-field-source": "graph-entity" }, "APIKey": { "x-cipp-field-source": "storage" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ApplicationId": { "x-cipp-field-source": "storage" }, "ApplicationSecret": { "x-cipp-field-source": "storage" }, "applicationTemplateId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appRoles": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationBehaviors": { "type": "object", "x-cipp-field-source": "graph-entity" }, "certification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultRedirectUri": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "disabledByMicrosoftStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "groupMembershipClaims": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identifierUris": { "type": "array", "x-cipp-field-source": "graph-entity" }, "info": { "type": "object", "x-cipp-field-source": "graph-entity" }, "isDeviceOnlyAuthSupported": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isDisabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFallbackPublicClient": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "keyCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "logo": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managerApplications": { "type": "array", "x-cipp-field-source": "graph-entity" }, "nativeAuthenticationApisEnabled": { "type": "object", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "oauth2RequirePostResponse": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "optionalClaims": { "type": "object", "x-cipp-field-source": "graph-entity" }, "parentalControlSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "passwordCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "publicClient": { "type": "object", "x-cipp-field-source": "graph-entity" }, "publisherDomain": { "type": "string", "x-cipp-field-source": "graph-entity" }, "RefreshToken": { "x-cipp-field-source": "storage" }, "requestSignatureVerification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "requiredResourceAccess": { "type": "array", "x-cipp-field-source": "graph-entity" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "samlMetadataUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "SASUrl": { "x-cipp-field-source": "storage" }, "SecretValue": { "type": "string", "x-cipp-field-source": "storage" }, "serviceManagementReference": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalLockConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInAudience": { "type": "string", "x-cipp-field-source": "graph-entity" }, "spa": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "tokenEncryptionKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedPublisher": { "type": "object", "x-cipp-field-source": "graph-entity" }, "web": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite" } }, "/api/ExecListBackup": { "get": { "summary": "ExecListBackup", "operationId": "ExecListBackup", "tags": [ "CIPP > Core" ], "description": "Lists stored CIPP backups, optionally narrowed by Type, tenantFilter or BackupName. NameOnly=true returns just the backup names and the items each one contains, without the backup payload.", "parameters": [ { "name": "BackupName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "NameOnly", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Backup.Read" } }, "/api/ExecLogRetentionConfig": { "post": { "summary": "ExecLogRetentionConfig", "operationId": "ExecLogRetentionConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "RetentionDays": { "type": "integer" } } } } } }, "parameters": [ { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ApplicationId": { "x-cipp-field-source": "storage" }, "colour": { "x-cipp-field-source": "storage" }, "coverFooterText": { "x-cipp-field-source": "storage" }, "coverImage": { "x-cipp-field-source": "storage" }, "coverImageId": { "x-cipp-field-source": "storage" }, "coverImageIds": { "x-cipp-field-source": "storage" }, "coverStock": { "x-cipp-field-source": "storage" }, "coverUploads": { "x-cipp-field-source": "storage" }, "Enabled": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "footerText": { "x-cipp-field-source": "storage" }, "logo": { "x-cipp-field-source": "storage" }, "logoImageId": { "x-cipp-field-source": "storage" }, "logoImageIds": { "x-cipp-field-source": "storage" }, "logoUploads": { "x-cipp-field-source": "storage" }, "MaxDuration": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "reportDefaults": { "x-cipp-field-source": "storage" }, "Resolver": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RetentionDays": { "x-cipp-field-source": "storage" }, "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "secondaryColour": { "x-cipp-field-source": "storage" }, "showFooter": { "x-cipp-field-source": "storage" }, "showPageNumbers": { "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Timezone": { "x-cipp-field-source": "storage" }, "TimezoneSource": { "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" }, "watermarkEnabled": { "x-cipp-field-source": "storage" }, "watermarkText": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecMailboxMobileDevices": { "post": { "summary": "ExecMailboxMobileDevices", "operationId": "ExecMailboxMobileDevices", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Delete": { "type": "string" }, "deviceid": { "type": "string" }, "guid": { "type": "string" }, "Quarantine": { "type": "string" }, "tenantFilter": { "type": "string" }, "Userid": { "type": "string", "description": "Interact with query parameters or the body of the request. This is a state-changing action, so the frontend dispatches it as a POST; keep the query fallback for backwards compatibility." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Delete", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "deviceid", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "guid", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Quarantine", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Userid", "in": "query", "description": "Interact with query parameters or the body of the request. This is a state-changing action, so the frontend dispatches it as a POST; keep the query fallback for backwards compatibility.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecMailboxRestore": { "post": { "summary": "ExecMailboxRestore", "operationId": "ExecMailboxRestore", "tags": [ "Email-Exchange > Tools" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "AssociatedMessagesCopyOption": { "$ref": "#/components/schemas/LabelValue" }, "BadItemLimit": { "type": "integer" }, "BatchName": { "type": "string" }, "CompletedRequestAgeLimit": { "type": "string" }, "ConflictResolutionOption": { "$ref": "#/components/schemas/LabelValue" }, "ExcludeDumpster": { "type": "string" }, "ExcludeFolders": { "$ref": "#/components/schemas/LabelValue" }, "Identity": { "type": "string" }, "IncludeFolders": { "$ref": "#/components/schemas/LabelValue" }, "LargeItemLimit": { "type": "integer" }, "RequestName": { "type": "string" }, "SourceIsArchive": { "type": "string" }, "SourceMailbox": { "$ref": "#/components/schemas/LabelValue" }, "SourceRootFolder": { "type": "string" }, "TargetIsArchive": { "type": "string" }, "TargetMailbox": { "$ref": "#/components/schemas/LabelValue" }, "TargetRootFolder": { "type": "string" }, "TargetType": { "$ref": "#/components/schemas/LabelValue" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Remove", "Resume", "Suspend" ] } }, { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecMailQuarantineSubmit": { "post": { "summary": "ExecMailQuarantineSubmit", "operationId": "ExecMailQuarantineSubmit", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Submits a quarantined email message to Microsoft for review (threat submission) via the Graph API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "category": { "$ref": "#/components/schemas/LabelValue" }, "Identity": { "type": "string" }, "RecipientAddress": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "Identity", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "adminReview": { "type": "object", "x-cipp-field-source": "graph-entity" }, "attackSimulationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "category": { "type": "object", "x-cipp-field-source": "graph-entity" }, "clientSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, "contentType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdBy": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "internetMessageId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "originalCategory": { "type": "object", "x-cipp-field-source": "graph-entity" }, "receivedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "recipientEmailAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "result": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "sender": { "type": "string", "x-cipp-field-source": "graph-entity" }, "senderIP": { "type": "string", "x-cipp-field-source": "graph-entity" }, "source": { "type": "object", "x-cipp-field-source": "graph-entity" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity" }, "subject": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tenantAllowOrBlockListAction": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/ExecMailTest": { "get": { "summary": "ExecMailTest", "operationId": "ExecMailTest", "tags": [ "Email-Exchange > Tools" ], "description": "Checks the mailbox configuration behind CIPP's message trace tooling. Action=CheckConfig reports whether the CIPP-SAM app holds the delegated Mail.Read permission and which mailbox the current token resolves to.", "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "CheckConfig" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Count": { "x-cipp-field-source": "backend" }, "HasMailRead": { "x-cipp-field-source": "backend" }, "MailAddresses": { "x-cipp-field-source": "backend" }, "MailUser": { "x-cipp-field-source": "backend" }, "Message": { "x-cipp-field-source": "backend" }, "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ExecMaintenanceScripts": { "get": { "summary": "ExecMaintenanceScripts", "operationId": "ExecMaintenanceScripts", "tags": [ "CIPP > Settings" ], "description": "Returns the maintenance scripts shipped with CIPP. Called without ScriptFile it lists the available scripts; with one it returns that script with the deployment's own tenant, subscription and resource details substituted in. MakeLink stores the result behind a one-time link instead.", "parameters": [ { "name": "MakeLink", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ScriptFile", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read" } }, "/api/ExecManageAppCredentials": { "post": { "summary": "ExecManageAppCredentials", "operationId": "ExecManageAppCredentials", "tags": [ "Tenant > Administration > Application Approval" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "Add", "Remove", "Rotate" ] }, "AppId": { "type": "string" }, "AppType": { "type": "string", "description": "applications | servicePrincipals" }, "CredentialType": { "type": "string", "description": "password | key" }, "DisplayName": { "type": "string" }, "EndDateTime": { "type": "string" }, "ExpiryDate": { "type": "string" }, "ExpiryMonths": { "$ref": "#/components/schemas/LabelValue" }, "Id": { "type": "string" }, "KeyId": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.ReadWrite" } }, "/api/ExecManageRetentionPolicies": { "post": { "summary": "ExecManageRetentionPolicies", "operationId": "ExecManageRetentionPolicies", "tags": [ "Email-Exchange > Administration > Mailbox Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CreatePolicies": { "type": "array", "items": { "type": "object", "properties": { "AddTags": { "type": "array", "items": { "type": "string" }, "description": "Handle tag modifications - need to get current policy first for add/remove operations" }, "Identity": { "type": "string" }, "Name": { "type": "string" }, "RemoveTags": { "type": "array", "items": { "type": "string" }, "description": "Handle tag modifications - need to get current policy first for add/remove operations" }, "RetentionPolicyTagLinks": { "type": "string" } } }, "description": "Create Retention Policies" }, "DeletePolicies": { "type": "string", "description": "Delete Retention Policies" }, "ModifyPolicies": { "type": "string", "description": "Modify Retention Policies" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "name", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.RetentionPolicies.ReadWrite" } }, "/api/ExecManageRetentionTags": { "post": { "summary": "ExecManageRetentionTags", "operationId": "ExecManageRetentionTags", "tags": [ "Email-Exchange > Administration > Mailbox Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CreateTags": { "type": "array", "items": { "type": "object", "properties": { "AgeLimitForRetention": { "type": "number" }, "Comment": { "type": "string" }, "Identity": { "type": "string" }, "LocalizedComment": { "type": "string" }, "LocalizedRetentionPolicyTagName": { "type": "string" }, "Name": { "type": "array", "items": { "type": "string" }, "description": "Common validations for both create and modify" }, "RetentionAction": { "type": "string", "enum": [ "DeleteAndAllowRecovery", "MoveToArchive", "PermanentlyDelete" ], "description": "Validate RetentionAction compatibility with Type (only for creation)" }, "RetentionEnabled": { "type": "boolean", "description": "Validate RetentionEnabled and RetentionAction relationship (only for creation)" }, "Type": { "type": "string" } } }, "description": "Create Retention Tags" }, "DeleteTags": { "type": "string", "description": "Delete Retention Tags" }, "ModifyTags": { "type": "string", "description": "Modify Retention Tags" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "name", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.RetentionPolicies.ReadWrite" } }, "/api/ExecMcp": { "post": { "summary": "Model Context Protocol (MCP) server endpoint for CIPP.", "operationId": "ExecMcp", "tags": [ "CIPP > MCP" ], "description": "A Streamable-HTTP MCP server running in JSON response mode (no SSE). It exposes\nCIPP's read-only API surface as MCP tools, projected at runtime from openapi.json.\n\nEvery 'tools/call' is re-dispatched through New-CippCoreRequest using the caller's\nown principal headers, so the standard RBAC and tenant scoping in Test-CIPPAccess\nis enforced for each tool exactly as it would be for a normal API request. This\nendpoint's own role (CIPP.Core.Read) is only the floor required to use MCP at all.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "method": { "type": "string", "enum": [ "initialize", "ping", "tools/call", "tools/list" ] }, "params": { "type": "object", "properties": { "arguments": { "type": "string", "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." }, "name": { "type": "string", "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." }, "protocolVersion": { "type": "string" } }, "description": "Craft accounts MCP egress per tool (and per Graph resource) off X-Craft-Endpoint." } }, "required": [ "method" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "202": { "description": "Accepted - work was queued and runs asynchronously" }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "405": { "description": "MethodNotAllowed" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ExecMDOAlertsList": { "get": { "summary": "ExecMDOAlertsList", "operationId": "ExecMDOAlertsList", "tags": [ "Security > Incidents" ], "description": "Lists Microsoft Defender for Office 365 and Defender for Endpoint alerts for a tenant, filtered to those service sources. tenantFilter=AllTenants reads the cached alert table rather than querying each tenant live.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "actorDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "additionalData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "affectedResources": { "x-cipp-field-source": "frontend" }, "Alert": { "type": "string", "x-cipp-field-source": "storage" }, "alertPolicyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "alertWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedTo": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "categories": { "type": "array", "x-cipp-field-source": "graph-entity" }, "category": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "classification": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "comments": { "type": "array", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "customDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "detectionSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, "detectorId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "determination": { "type": "object", "x-cipp-field-source": "graph-entity" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "evidence": { "type": "array", "x-cipp-field-source": "graph-entity,frontend" }, "firstActivityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Incident": { "type": "string", "x-cipp-field-source": "storage" }, "incidentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "incidentWebUrl": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "investigationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "lastActivityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastUpdateDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "MdoAlert": { "type": "string", "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "mitreTechniques": { "type": "array", "x-cipp-field-source": "graph-entity" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "productName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "providerAlertId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "recommendedActions": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resolvedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "serviceSource": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "severity": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "systemTags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "threatDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "threatFamilyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "title": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Alert.Read" } }, "/api/ExecMigrateOneDriveShortCuts": { "post": { "summary": "ExecMigrateOneDriveShortCuts", "operationId": "ExecMigrateOneDriveShortCuts", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "username": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecModifyCalPerms": { "post": { "summary": "ExecModifyCalPerms", "operationId": "ExecModifyCalPerms", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "permissions": { "type": "array", "items": { "type": "object", "properties": { "CanViewPrivateItems": { "type": "string" }, "DisplayName": { "type": "string", "description": "TargetUser may be a recipient id, so log the display name the caller saw" }, "FolderName": { "type": "string" }, "Modification": { "type": "string" }, "PermissionLevel": { "$ref": "#/components/schemas/LabelValue" }, "SendNotificationToUser": { "type": "string" }, "UserID": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Handle UserID as array or single value" } } } }, "tenantFilter": { "type": "string" }, "userID": { "type": "string", "description": "UPN of the mailbox to modify calendar permissions for" } }, "required": [ "tenantFilter", "userID" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecModifyContactPerms": { "post": { "summary": "ExecModifyContactPerms", "operationId": "ExecModifyContactPerms", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "permissions": { "type": "array", "items": { "type": "object", "properties": { "CanViewPrivateItems": { "type": "string" }, "DisplayName": { "type": "string", "description": "TargetUser may be a recipient id, so log the display name the caller saw" }, "FolderName": { "type": "string" }, "Modification": { "type": "string" }, "PermissionLevel": { "$ref": "#/components/schemas/LabelValue" }, "SendNotificationToUser": { "type": "string" }, "UserID": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Handle UserID as array or single value" } } } }, "tenantFilter": { "type": "string" }, "userID": { "type": "string", "description": "UPN of the mailbox to modify contact permissions for" } }, "required": [ "tenantFilter", "userID" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecModifyMBPerms": { "post": { "summary": "ExecModifyMBPerms", "operationId": "ExecModifyMBPerms", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "description": "The request body is a JSON array. Each element has the shape below.", "items": { "type": "object", "properties": { "mailboxRequests": { "type": "string", "description": "Bulk format with mailboxRequests property" }, "permissions": { "type": "array", "items": { "type": "object", "properties": { "AutoMap": { "type": "string" }, "Modification": { "type": "string" }, "PermissionLevel": { "type": "string" }, "UserID": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" }, "description": "Extract target users from UserID (handle array of objects or single values)" } } }, "description": "Legacy single mailbox format" }, "tenantFilter": { "type": "string" }, "userID": { "type": "string", "description": "Legacy single mailbox format" } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecNamedLocation": { "post": { "summary": "ExecNamedLocation", "operationId": "ExecNamedLocation", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "change": { "type": "string" }, "input": { "$ref": "#/components/schemas/LabelValue" }, "namedLocationId": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } } } } } }, "parameters": [ { "name": "change", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "input", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "namedLocationId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecNewSafeLinksPolicy": { "post": { "summary": "ExecNewSafeLinksPolicy", "operationId": "ExecNewSafeLinksPolicy", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function creates a new Safe Links policy and an associated rule.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AdminDisplayName": { "type": "string" }, "AllowClickThrough": { "type": "string" }, "Comments": { "type": "string" }, "CustomNotificationText": { "type": "string" }, "DeliverMessageAfterScan": { "type": "string" }, "DisableUrlRewrite": { "type": "string" }, "DoNotRewriteUrls": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "EnableForInternalSenders": { "type": "string" }, "EnableOrganizationBranding": { "type": "string" }, "EnableSafeLinksForEmail": { "type": "string" }, "EnableSafeLinksForOffice": { "type": "string" }, "EnableSafeLinksForTeams": { "type": "string" }, "ExceptIfRecipientDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSentTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "ExceptIfSentToMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "PolicyName": { "type": "string", "description": "Extract policy settings from body" }, "Priority": { "type": "string", "description": "Extract rule settings from body" }, "RecipientDomainIs": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "RuleName": { "type": "string" }, "ScanUrls": { "type": "string" }, "SentTo": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } }, "description": "Extract recipient fields and handle different input formats" }, "SentToMemberOf": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string", "description": "Extract value from object" } } } }, "State": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "TrackClicks": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite", "x-cipp-reads-via": [ "ConvertTo-FieldArray" ] } }, "/api/ExecNotificationConfig": { "post": { "summary": "ExecNotificationConfig", "operationId": "ExecNotificationConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "email": { "type": "string" }, "logsToInclude": { "type": "string" }, "onePerTenant": { "type": "string" }, "sendtoIntegration": { "type": "string" }, "Severity": { "type": "object" }, "UseStandardizedSchema": { "type": "boolean" }, "webhook": { "type": "string" }, "webhookAuthHeaderName": { "type": "string" }, "webhookAuthHeaders": { "type": "string" }, "webhookAuthHeaderValue": { "type": "string" }, "webhookAuthPassword": { "type": "string" }, "webhookAuthToken": { "type": "string" }, "webhookAuthType": { "$ref": "#/components/schemas/LabelValue" }, "webhookAuthUsername": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecOffboardTenant": { "post": { "summary": "ExecOffboardTenant", "operationId": "ExecOffboardTenant", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "RemoveCSPGuestUsers": { "type": "boolean" }, "RemoveCSPnotificationContacts": { "type": "boolean" }, "RemoveDomainAnalyserData": { "type": "boolean" }, "RemoveMultitenantCSPApps": { "type": "boolean", "description": "All customer tenant specific actions ALWAYS have to be completed before this action!" }, "RemoveQuarantineAlert": { "type": "boolean" }, "TenantFilter": { "$ref": "#/components/schemas/LabelValue" }, "TerminateContract": { "type": "boolean" }, "TerminateGDAP": { "type": "boolean" }, "vendorApplications": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Errors": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ExecOffboardUser": { "post": { "summary": "ExecOffboardUser", "operationId": "ExecOffboardUser", "tags": [ "Identity > Administration > Users" ], "description": "Runs the offboarding wizard: one scheduled offboarding job per user, immediately or at the\nscheduled time, reporting live progress under one job id. Action=Rerun queues an existing\noffboarding task again; Action=RerunStep queues one step of it, reported to the same progress row.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "forward": { "$ref": "#/components/schemas/LabelValue" }, "OOO": { "type": "string" }, "PostExecution": { "type": "object", "properties": { "email": { "type": "boolean" }, "psa": { "type": "boolean" }, "push": { "type": "boolean" }, "webhook": { "type": "boolean" } } }, "PsaTicketId": { "type": "string" }, "reference": { "type": "string" }, "Scheduled": { "type": "object", "properties": { "date": { "type": "string" }, "enabled": { "type": "string", "description": "Scheduled: when enabled, date must be a valid Unix timestamp" } }, "description": "Scheduled: when enabled, date must be a valid Unix timestamp" }, "StepIndex": { "type": "integer", "description": "Zero-based index of the step, as listed in the progress row, to run again" }, "StepTitle": { "type": "string", "description": "Title of that step, used to name the re-run task" }, "TaskId": { "type": "string", "description": "RowKey of the offboarding task to run again" }, "tenantFilter": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "tenantFilter: required, must resolve to a non-empty domain string (accepts a string or { value })" }, "user": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } } }, "required": [ "tenantFilter" ], "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite", "x-cipp-reads-via": [ "Test-CIPPOffboardingRequest" ] } }, "/api/ExecOffloadFunctions": { "post": { "summary": "ExecOffloadFunctions", "operationId": "ExecOffloadFunctions", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "OffloadFunctions": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecOnboardTenant": { "post": { "summary": "ExecOnboardTenant", "operationId": "ExecOnboardTenant", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "addMissingGroups": { "type": "string" }, "autoMapRoles": { "type": "string" }, "Cancel": { "type": "boolean" }, "gdapRoles": { "type": "string" }, "id": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "ignoreMissingRoles": { "type": "string" }, "Retry": { "type": "boolean" }, "standardsExcludeAllTenants": { "type": "boolean" }, "tenantGroups": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CustomerId": { "x-cipp-field-source": "storage,backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Exception": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Logs": { "type": "string", "x-cipp-field-source": "storage,backend" }, "OnboardingSteps": { "type": "string", "x-cipp-field-source": "storage,backend" }, "PartitionKey": { "x-cipp-field-source": "storage,backend" }, "Relationship": { "type": "string", "x-cipp-field-source": "storage,backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage,backend" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage,backend" }, "Status": { "x-cipp-field-source": "storage,backend" }, "TenantGroups": { "x-cipp-field-source": "storage,backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecOneDriveProvision": { "post": { "summary": "ExecOneDriveProvision", "operationId": "ExecOneDriveProvision", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" }, "UserPrincipalName": { "type": "array", "items": { "type": "string" } } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UserPrincipalName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecOneDriveShortCut": { "post": { "summary": "Creates a OneDrive shortcut to a SharePoint library for one or more users.", "operationId": "ExecOneDriveShortCut", "tags": [ "Identity > Administration > Users" ], "description": "Accepts one { username, userid, siteUrl, destination, tenantFilter } object or an array of them (the Users table bulk action). Every user is attempted: a failure for one user (for example a shortcut that already exists) is reported in its place and does not stop the remaining users, so a bulk rollout never has to be re-run to find out where it got to. The response is one result per user plus a summary line, and only returns an error status when no user succeeded.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecPartnerMode": { "post": { "summary": "ExecPartnerMode", "operationId": "ExecPartnerMode", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "TenantMode": { "type": "string", "x-cipp-observed-values": [ "default", "PartnerTenantAvailable" ] } } } } } }, "parameters": [ { "name": "action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecPartnerWebhook": { "post": { "summary": "ExecPartnerWebhook", "operationId": "ExecPartnerWebhook", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Subscription create/update is logged by New-CIPPGraphSubscription; log the onboarding config write here." }, "EventType": { "$ref": "#/components/schemas/LabelValue" }, "standardsExcludeAllTenants": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "CreateSubscription", "ListEventTypes", "ListSubscription", "SendTest", "ValidateTest" ] } }, { "name": "CorrelationId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Action": { "x-cipp-field-source": "backend" }, "ApplicationId": { "x-cipp-field-source": "storage" }, "colour": { "x-cipp-field-source": "storage" }, "coverFooterText": { "x-cipp-field-source": "storage" }, "coverImage": { "x-cipp-field-source": "storage" }, "coverImageId": { "x-cipp-field-source": "storage" }, "coverImageIds": { "x-cipp-field-source": "storage" }, "coverStock": { "x-cipp-field-source": "storage" }, "coverUploads": { "x-cipp-field-source": "storage" }, "Enabled": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "footerText": { "x-cipp-field-source": "storage" }, "logo": { "x-cipp-field-source": "storage" }, "logoImageId": { "x-cipp-field-source": "storage" }, "logoImageIds": { "x-cipp-field-source": "storage" }, "logoUploads": { "x-cipp-field-source": "storage" }, "MaxDuration": { "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "reportDefaults": { "x-cipp-field-source": "storage" }, "Resolver": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RetentionDays": { "x-cipp-field-source": "storage" }, "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "secondaryColour": { "x-cipp-field-source": "storage" }, "showFooter": { "x-cipp-field-source": "storage" }, "showPageNumbers": { "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Timezone": { "x-cipp-field-source": "storage" }, "TimezoneSource": { "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" }, "watermarkEnabled": { "x-cipp-field-source": "storage" }, "watermarkText": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecPasswordConfig": { "post": { "summary": "ExecPasswordConfig", "operationId": "ExecPasswordConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "appendNumber": { "type": "boolean" }, "appendSpecialChar": { "type": "boolean" }, "capitalizeWords": { "type": "boolean" }, "charCount": { "type": "string", "description": "Still parse for storage, but don't reject invalid values for the inactive mode" }, "includeDigits": { "type": "boolean" }, "includeLowercase": { "type": "boolean" }, "includeSpecialChars": { "type": "boolean" }, "includeUppercase": { "type": "boolean" }, "passwordType": { "type": "string", "description": "Password type validation" }, "separator": { "type": "string", "description": "Separator validation with enhanced security - allow space or empty" }, "specialCharSet": { "type": "string", "description": "Special character set validation with enhanced security" }, "wordCount": { "type": "string" } } } } } }, "parameters": [ { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "appendNumber": { "x-cipp-field-source": "storage" }, "appendSpecialChar": { "x-cipp-field-source": "storage" }, "capitalizeWords": { "x-cipp-field-source": "storage" }, "charCount": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "includeDigits": { "x-cipp-field-source": "storage" }, "includeLowercase": { "x-cipp-field-source": "storage" }, "includeSpecialChars": { "x-cipp-field-source": "storage" }, "includeUppercase": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "passwordType": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "separator": { "x-cipp-field-source": "storage" }, "specialCharSet": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "wordCount": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecPasswordNeverExpires": { "post": { "summary": "ExecPasswordNeverExpires", "operationId": "ExecPasswordNeverExpires", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "PasswordPolicy": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Only used for logging" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "userId": { "type": "string" }, "userPrincipalName": { "type": "string", "description": "Only used for logging" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecPermissionRepair": { "post": { "summary": "This endpoint will update the CIPP-SAM app permissions.", "operationId": "ExecPermissionRepair", "tags": [ "CIPP > Settings" ], "description": "Merges new permissions from the SAM manifest into the AppPermissions entry for CIPP-SAM.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecPerUserMFA": { "post": { "summary": "ExecPerUserMFA", "operationId": "ExecPerUserMFA", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "State": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "userId": { "type": "string", "description": "Guest user handling" }, "userPrincipalName": { "type": "string", "description": "Guest user handling" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecPIMRoleAssignment": { "post": { "summary": "Change a directory role assignment through PIM in the secure direction only.", "operationId": "ExecPIMRoleAssignment", "tags": [ "Identity > Administration > Roles" ], "description": "Converts a permanent assignment to eligible, grants a time-bound active assignment, extends or renews a time-bound assignment or eligibility, or removes an assignment. Every request must carry an expiration (a duration or an end date); permanent / no-expiration assignments are refused, as are changes to group-inherited rows, the CIPP-SAM application and the last active Global Administrator. Requires Entra ID P2.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "ConvertToEligible | GrantActive | Extend | Renew | Remove" }, "AssignmentType": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "The row's current assignment type: Permanent | Active | ActivatedFromEligible | Eligible" }, "DirectoryScopeId": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "'/' for the whole directory or '/administrativeUnits/{id}'." }, "Duration": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "ISO 8601 lifetime such as PT4H or P1Y. Use either Duration or EndDateTime, not both." }, "EndDateTime": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Absolute end (unix seconds or ISO 8601). Use either Duration or EndDateTime, not both." }, "Justification": { "type": "string", "description": "Reason recorded on the PIM request and in the CIPP logbook." }, "PrincipalId": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Object id of the user, group or service principal." }, "RoleDefinitionId": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Role template id (roleDefinitionId as PIM reports it)." }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" }, "TimeZone": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "IANA time zone of the browser (e.g. Australia/Perth); only used to word the end time in the result." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/ExecPreviewBrandingReportPdf": { "post": { "summary": "ExecPreviewBrandingReportPdf", "operationId": "ExecPreviewBrandingReportPdf", "tags": [ "CIPP > Settings" ], "description": "Renders a sample report against a branding configuration - normally the unsaved state of the\nbranding editor - and returns it as application/pdf bytes, so a colour, logo, cover, footer or\nwatermark can be judged on every page of a real report before it is saved. Each report type has\na fixed sample of the data its builder needs (Config/ReportSamples/.json); nothing is read\nfrom a tenant.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "branding": { "type": "object", "properties": { "tenantLabel": { "type": "string", "description": "The sample tenant, named the way the branding under edit would name a real one." } }, "description": "The branding to render against, in the shape Get-CIPPBrandingSettings returns: colours (flat or under roleColours), a data-URL logo and cover or a coverStock path, footer, watermark and tenantLabel. Omitted -> the saved branding settings." }, "reportType": { "type": "string", "description": "Which report to preview: executive, reportBuilder, shadowAI, bec, becSummary, sharing, permissions, mailFlow, licensing or baseline." }, "tenantFilter": { "type": "string", "description": "Optional: the tenant whose %variables% (%cippurl%, custom variables) resolve in the footer and cover." } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read", "x-cipp-any-tenant": true } }, "/api/ExecPreviewReportBuilderPdf": { "post": { "summary": "ExecPreviewReportBuilderPdf", "operationId": "ExecPreviewReportBuilderPdf", "tags": [ "Tools > Report-Builder" ], "description": "Renders the current (unsaved) Report Builder state to a PDF and returns it as application/pdf\nbytes without persisting a generated-report row. Powers the builder's live preview and download.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Blocks": { "type": "string" }, "Settings": { "type": "string" }, "TemplateGUID": { "type": "string" }, "TemplateName": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" } }, "/api/ExecPushSubscription": { "post": { "summary": "ExecPushSubscription", "operationId": "ExecPushSubscription", "tags": [ "CIPP > Settings" ], "description": "Registers, removes or tests a Web Push subscription for the signed-in user's device.\nSubscriptions are per user: the row belongs to the principal that sent it and only that\nprincipal can remove it. Refused while impersonating, so a superadmin trying a role never\nbinds their own device to a browser session that is pretending to be someone else.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "DeviceName": { "type": "string" }, "RowKey": { "type": "string" }, "Subscription": { "type": "object", "properties": { "endpoint": { "type": "string" } }, "additionalProperties": true } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecQuarantineManagement": { "post": { "summary": "ExecQuarantineManagement", "operationId": "ExecQuarantineManagement", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AllowSender": { "type": "boolean" }, "Identity": { "type": "string" }, "PolicyName": { "type": "string" }, "RecipientAddress": { "type": "string" }, "SenderAddress": { "type": "string" }, "tenantFilter": { "type": "string" }, "Type": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/ExecReactivateSite": { "post": { "summary": "Reactivate an archived SharePoint or OneDrive site.", "operationId": "ExecReactivateSite", "tags": [ "Teams-Sharepoint" ], "description": "Reactivates (unarchives) a Microsoft 365 Archive site through the Graph beta\nsite: unarchive endpoint (POST /beta/sites/{site-id}/unarchive). Primarily used to\nreactivate archived OneDrive accounts before granting permissions to them.\nReactivation is asynchronous (can take up to 24 hours) and, for fully-archived\naccounts, may incur Microsoft 365 Archive charges and require Unlicensed OneDrive\nbilling to be enabled on the tenant.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "SiteId": { "type": "string", "description": "Site-collection GUID (the row's siteId / sharepointIds.siteId). Used to build the Graph composite site id without touching the locked, archived site." }, "SiteUrl": { "type": "string", "description": "Full web URL of the archived site / OneDrive (the row's webUrl)." }, "tenantFilter": { "type": "string", "description": "Tenant the archived site belongs to." }, "WebId": { "type": "string", "description": "Web GUID (the row's webId / sharepointIds.webId)." } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecRefreshMyAccess": { "get": { "summary": "Re-check the caller's Entra group membership and refresh their CIPP roles", "operationId": "ExecRefreshMyAccess", "tags": [ "CIPP > Settings" ], "description": "Clears the caller's cached role resolution and re-checks Entra group membership, so a\njust-activated PIM group grants its mapped CIPP role without waiting out the role cache.\nOnly ever refreshes the calling user's own access.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Role": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "429": { "description": "Throttled by the upstream Microsoft API" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Public", "x-cipp-any-tenant": true } }, "/api/ExecRegistrationCampaign": { "post": { "summary": "ExecRegistrationCampaign", "operationId": "ExecRegistrationCampaign", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "enforceRegistrationAfterAllowedSnoozes": { "type": "string" }, "excludeGroups": { "type": "string" }, "excludeUsers": { "type": "string" }, "includeAllUsers": { "type": "boolean", "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" }, "includeGroups": { "type": "string", "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" }, "includeUsers": { "type": "string", "description": "Build include/exclude target lists; $null means \"keep what is currently configured\"" }, "snoozeDurationInDays": { "type": "integer" }, "state": { "$ref": "#/components/schemas/LabelValue" }, "targetedAuthenticationMethod": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ExecRemoveAdminRole": { "post": { "summary": "ExecRemoveAdminRole", "operationId": "ExecRemoveAdminRole", "tags": [ "Identity > Administration > Users" ], "description": "Removes a user from an assigned Microsoft Entra admin role.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "RoleId": { "$ref": "#/components/schemas/LabelValue" }, "RoleName": { "$ref": "#/components/schemas/LabelValue" }, "RoleTemplateId": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "$ref": "#/components/schemas/LabelValue" }, "Users": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/ExecRemoveCippCveException": { "post": { "summary": "ExecRemoveCippCveException", "operationId": "ExecRemoveCippCveException", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "cveId": { "type": "string" }, "removeScope": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "cveId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "removeScope", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "AllAffected", "CurrentTenant", "Global" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Alert.ReadWrite" } }, "/api/ExecRemoveEnrollmentProfile": { "post": { "summary": "ExecRemoveEnrollmentProfile", "operationId": "ExecRemoveEnrollmentProfile", "tags": [ "Endpoint > MEM" ], "description": "Deletes an Apple ADE or Android Enterprise enrollment profile.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "id": { "type": "string" }, "profileId": { "type": "string" }, "profileType": { "type": "string" }, "tenantFilter": { "type": "string" }, "tokenId": { "type": "string" } }, "required": [ "profileId", "tenantFilter", "tokenId" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/ExecRemoveLibraryPermission": { "post": { "summary": "ExecRemoveLibraryPermission", "operationId": "ExecRemoveLibraryPermission", "tags": [ "Teams-Sharepoint" ], "description": "Removes a principal's permission on a document library (ListId) or on the site root web\n(ListId omitted) via the SharePoint REST API. Supplying RoleDefinitionId removes that one\npermission level; omitting it removes every level the principal holds on the scope.\n\nLimited Access is never removed: SharePoint creates and cleans it up itself so a user can\ntraverse to an item they were given access to further down, and deleting it by hand breaks\nthat navigation.\n\nRemoving a permission requires the library to hold its own permissions, so a library that\nstill inherits has its inheritance broken (copying the current permissions) first - the\nremoval then applies to that library only, not to the whole site.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "LibraryName": { "type": "string" }, "ListId": { "type": "string" }, "PrincipalId": { "type": "string" }, "PrincipalName": { "type": "string" }, "RoleDefinitionId": { "type": "string" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" }, "Title": { "type": "string" } }, "required": [ "PrincipalId", "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecRemoveMailboxRule": { "post": { "summary": "ExecRemoveMailboxRule", "operationId": "ExecRemoveMailboxRule", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ruleId": { "type": "string" }, "ruleName": { "type": "string" }, "TenantFilter": { "type": "string" }, "userPrincipalName": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "parameters": [ { "name": "ruleId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ruleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userPrincipalName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecRemoveOneDriveShortCut": { "post": { "summary": "ExecRemoveOneDriveShortCut", "operationId": "ExecRemoveOneDriveShortCut", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "$ref": "#/components/schemas/LabelValue" }, "name": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "username": { "$ref": "#/components/schemas/LabelValue" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecRemoveRestrictedUser": { "post": { "summary": "ExecRemoveRestrictedUser", "operationId": "ExecRemoveRestrictedUser", "tags": [ "Email-Exchange > Administration" ], "description": "Removes a user from the restricted senders list in Exchange Online.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "SenderAddress": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "SenderAddress", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecRemoveSharingLink": { "post": { "summary": "ExecRemoveSharingLink", "operationId": "ExecRemoveSharingLink", "tags": [ "Teams-Sharepoint" ], "description": "Revokes a sharing link (or direct sharing grant) on a SharePoint or OneDrive item by\ndeleting the permission from the drive item. Also removes the revoked link from the\nSharePointSharingLinks reporting cache so the sharing report reflects it immediately.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "CacheId": { "type": "string" }, "DriveId": { "type": "string" }, "FileName": { "type": "string" }, "ItemId": { "type": "string" }, "PermissionId": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecRemoveSiteUser": { "post": { "summary": "ExecRemoveSiteUser", "operationId": "ExecRemoveSiteUser", "tags": [ "Teams-Sharepoint" ], "description": "Removes a user from one or more SharePoint sites entirely: deleting the site user\nremoves them from every site group and direct permission grant at once. Uses the\nSharePoint REST API with certificate authentication. Note this does not revoke\nsharing links the user received by mail; use the sharing link actions for those.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "DisplayName": { "type": "string" }, "SiteUrl": { "type": "string", "description": "Single site (SiteUrl) or several at once (SiteUrls, e.g. from the External Users report)." }, "SiteUrls": { "type": "string", "description": "Single site (SiteUrl) or several at once (SiteUrls, e.g. from the External Users report)." }, "tenantFilter": { "type": "string" }, "user": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "LoginName": { "type": "string", "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." } }, "required": [ "LoginName" ], "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." }, "value": { "type": "string", "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." } }, "description": "The picker supplies the SP claims login via addedFields; fall back to building it from the UPN." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecRemoveSnooze": { "post": { "summary": "ExecRemoveSnooze", "operationId": "ExecRemoveSnooze", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "PartitionKey": { "type": "string" }, "RowKey": { "type": "string" } } } } } }, "parameters": [ { "name": "PartitionKey", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RowKey", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AlertSnooze.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecRemoveSPOExternalUser": { "post": { "summary": "ExecRemoveSPOExternalUser", "operationId": "ExecRemoveSPOExternalUser", "tags": [ "Teams-Sharepoint" ], "description": "Fully removes an external user's guest access: deletes their Entra guest account (when\none exists) AND removes them from every SharePoint site they hold membership on, in one\npass - so no orphaned accounts or lingering site access are left behind. The inert\nSharePoint external-store entry cannot be deleted (Microsoft deprecated\nRemoveExternalUsers) and ages out on its own; sharing links the user received are\nrevoked separately via the Sharing Report.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "DisplayName": { "type": "string" }, "EntraUserId": { "type": "string" }, "LoginName": { "type": "string" }, "SiteUrls": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecRemoveTeamsVoicePhoneNumberAssignment": { "post": { "summary": "ExecRemoveTeamsVoicePhoneNumberAssignment", "operationId": "ExecRemoveTeamsVoicePhoneNumberAssignment", "tags": [ "Teams-Sharepoint" ], "description": "Unassigns a phone number from a user or resource account via the Teams administration Graph API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignedTo": { "type": "string" }, "PhoneNumber": { "type": "string" }, "PhoneNumberType": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Voice.ReadWrite" } }, "/api/ExecRemoveTenant": { "post": { "summary": "ExecRemoveTenant", "operationId": "ExecRemoveTenant", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "TenantID": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "customerId": { "x-cipp-field-source": "storage" }, "defaultDomainName": { "x-cipp-field-source": "storage" }, "delegatedPrivilegeStatus": { "x-cipp-field-source": "storage" }, "directTenantAuthDate": { "x-cipp-field-source": "storage" }, "directTenantUserPrincipalName": { "x-cipp-field-source": "storage" }, "displayName": { "x-cipp-field-source": "storage" }, "domains": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Excluded": { "x-cipp-field-source": "storage" }, "ExcludeDate": { "x-cipp-field-source": "storage" }, "ExcludeUser": { "x-cipp-field-source": "storage" }, "hasAutoExtend": { "x-cipp-field-source": "storage" }, "initialDomainName": { "x-cipp-field-source": "storage" }, "LastGraphError": { "x-cipp-field-source": "storage" }, "LastGraphTokenError": { "x-cipp-field-source": "storage" }, "LastRefresh": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "relationshipCount": { "x-cipp-field-source": "storage" }, "relationshipEnd": { "x-cipp-field-source": "storage" }, "RequiresRefresh": { "type": "boolean", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ExecRenameAPDevice": { "post": { "summary": "ExecRenameAPDevice", "operationId": "ExecRenameAPDevice", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "deviceId": { "type": "string" }, "displayName": { "type": "array", "items": { "type": "string" } }, "serialNumber": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/ExecReportAttachmentRetentionConfig": { "post": { "summary": "ExecReportAttachmentRetentionConfig", "operationId": "ExecReportAttachmentRetentionConfig", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "RetentionDays": { "type": "integer" } } } } } }, "parameters": [ { "name": "List", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ApplicationId": { "x-cipp-field-source": "storage" }, "colour": { "x-cipp-field-source": "storage" }, "coverFooterText": { "x-cipp-field-source": "storage" }, "coverImage": { "x-cipp-field-source": "storage" }, "coverImageId": { "x-cipp-field-source": "storage" }, "coverImageIds": { "x-cipp-field-source": "storage" }, "coverStock": { "x-cipp-field-source": "storage" }, "coverUploads": { "x-cipp-field-source": "storage" }, "Enabled": { "type": "boolean", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "footerText": { "x-cipp-field-source": "storage" }, "logo": { "x-cipp-field-source": "storage" }, "logoImageId": { "x-cipp-field-source": "storage" }, "logoImageIds": { "x-cipp-field-source": "storage" }, "logoUploads": { "x-cipp-field-source": "storage" }, "MaxDuration": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "reportDefaults": { "x-cipp-field-source": "storage" }, "Resolver": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RetentionDays": { "x-cipp-field-source": "storage" }, "roleColours": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "secondaryColour": { "x-cipp-field-source": "storage" }, "showFooter": { "x-cipp-field-source": "storage" }, "showPageNumbers": { "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Timezone": { "x-cipp-field-source": "storage" }, "TimezoneSource": { "x-cipp-field-source": "storage" }, "Value": { "type": "string", "x-cipp-field-source": "storage" }, "watermarkEnabled": { "x-cipp-field-source": "storage" }, "watermarkText": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecReportBuilderTemplate": { "post": { "summary": "ExecReportBuilderTemplate", "operationId": "ExecReportBuilderTemplate", "tags": [ "Tools > Report-Builder" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "delete", "save" ] }, "Blocks": { "type": "string" }, "GUID": { "type": "string" }, "Name": { "type": "array", "items": { "type": "string" } }, "Settings": { "type": "string" } }, "required": [ "GUID", "Name" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.ReportBuilder.ReadWrite" } }, "/api/ExecReprocessUserLicenses": { "post": { "summary": "ExecReprocessUserLicenses", "operationId": "ExecReprocessUserLicenses", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "userPrincipalName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userPrincipalName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecRequirePasswordChange": { "post": { "summary": "ExecRequirePasswordChange", "operationId": "ExecRequirePasswordChange", "tags": [ "Identity > Administration > Users" ], "description": "Requires password change at next sign-in without resetting the password.\nSets passwordProfile.forceChangePasswordNextSignIn via Graph. Not supported for directory-synced users.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecResetMFA": { "post": { "summary": "ExecResetMFA", "operationId": "ExecResetMFA", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "MethodId": { "type": "string", "description": "When supplied, only this single authentication method is removed instead of all of them." }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecResetPass": { "post": { "summary": "ExecResetPass", "operationId": "ExecResetPass", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "ID": { "type": "string" }, "MustChange": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "displayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "MustChange", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecRestoreBackup": { "post": { "summary": "ExecRestoreBackup", "operationId": "ExecRestoreBackup", "tags": [ "CIPP > Settings" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "description": "The request body is a JSON array. Each element has the shape below.", "items": { "type": "object", "properties": { "BackupName": { "type": "string", "description": "Use Get-CIPPBackup which already handles fetching from blob storage" }, "PartitionKey": { "type": "string" }, "SelectedTypes": { "type": "array", "items": { "type": "string" } }, "table": { "type": "string" } } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecRestoreDeleted": { "post": { "summary": "ExecRestoreDeleted", "operationId": "ExecRestoreDeleted", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "userPrincipalName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.ReadWrite" } }, "/api/ExecRestoreDeletedSite": { "post": { "summary": "ExecRestoreDeletedSite", "operationId": "ExecRestoreDeletedSite", "tags": [ "Teams-Sharepoint" ], "description": "Restores a deleted SharePoint site from the tenant recycle bin via the SharePoint\nadmin CSOM API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" }, "Url": { "type": "string" } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecRestoreRecycleBinItems": { "post": { "summary": "ExecRestoreRecycleBinItems", "operationId": "ExecRestoreRecycleBinItems", "tags": [ "Teams-Sharepoint" ], "description": "Restores one or more items from a SharePoint site's recycle bin via the SharePoint\nREST API RestoreByIds method with certificate authentication.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Ids": { "type": "string" }, "ItemNames": { "type": "string" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.SiteRecycleBin.ReadWrite" } }, "/api/ExecRevokeSessions": { "post": { "summary": "ExecRevokeSessions", "operationId": "ExecRevokeSessions", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "Username": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Username", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecRunBackup": { "post": { "summary": "ExecRunBackup", "operationId": "ExecRunBackup", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "backup": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecRunTenantGroupRule": { "post": { "summary": "Execute tenant group dynamic rules immediately", "operationId": "ExecRunTenantGroupRule", "tags": [ "CIPP > Settings" ], "description": "This function executes dynamic tenant group rules for immediate membership updates", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "groupId": { "type": "string" } } } } } }, "parameters": [ { "name": "groupId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Description": { "x-cipp-field-source": "storage" }, "DynamicRules": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExcludePartnerTenant": { "type": "boolean", "x-cipp-field-source": "storage" }, "GroupType": { "x-cipp-field-source": "storage" }, "Name": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "RuleLogic": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Groups.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecSAMAppPermissions": { "post": { "summary": "ExecSAMAppPermissions", "operationId": "ExecSAMAppPermissions", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Permissions": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Reset", "Update" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "SHA": { "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecSAMCertificate": { "post": { "summary": "Get SAM certificate status or trigger a renewal", "operationId": "ExecSAMCertificate", "tags": [ "CIPP > Core" ], "description": "Returns status information about the SAM app certificate (thumbprint, validity,\nregistration state) or forces a renewal via Update-CIPPSAMCertificate. Never\nreturns private key material.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "addIns": { "type": "array", "x-cipp-field-source": "graph-entity" }, "api": { "type": "object", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "applicationTemplateId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appRoles": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationBehaviors": { "type": "object", "x-cipp-field-source": "graph-entity" }, "certification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultRedirectUri": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "disabledByMicrosoftStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "groupMembershipClaims": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identifierUris": { "type": "array", "x-cipp-field-source": "graph-entity" }, "info": { "type": "object", "x-cipp-field-source": "graph-entity" }, "isDeviceOnlyAuthSupported": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isDisabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFallbackPublicClient": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "keyCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "logo": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managerApplications": { "type": "array", "x-cipp-field-source": "graph-entity" }, "nativeAuthenticationApisEnabled": { "type": "object", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "oauth2RequirePostResponse": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "optionalClaims": { "type": "object", "x-cipp-field-source": "graph-entity" }, "parentalControlSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "passwordCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "publicClient": { "type": "object", "x-cipp-field-source": "graph-entity" }, "publisherDomain": { "type": "string", "x-cipp-field-source": "graph-entity" }, "requestSignatureVerification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "requiredResourceAccess": { "type": "array", "x-cipp-field-source": "graph-entity" }, "samlMetadataUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceManagementReference": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalLockConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInAudience": { "type": "string", "x-cipp-field-source": "graph-entity" }, "spa": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "tokenEncryptionKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedPublisher": { "type": "object", "x-cipp-field-source": "graph-entity" }, "web": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite" } }, "/api/ExecSAMRoles": { "post": { "summary": "ExecSAMRoles", "operationId": "ExecSAMRoles", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Roles": { "type": "string" }, "Tenants": { "type": "string" } } } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Update" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "Roles": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Tenants": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecSamSecretStatus": { "post": { "summary": "Reports whether the stored SAM application secret is usable yet.", "operationId": "ExecSamSecretStatus", "tags": [ "CIPP > Setup" ], "description": "The setup wizard creates a client secret on one step and uses it on the next, but Entra\ncan take several minutes to replicate a newly created secret. Until it has, every token\nrequest fails with AADSTS7000215 even though the value CIPP holds is correct. This lets\nthe wizard wait on that instead of failing the user after they have already signed in.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecScheduleAuditExclusionVacation": { "post": { "summary": "Schedule a location alert exclusion for a vacation period", "operationId": "ExecScheduleAuditExclusionVacation", "tags": [ "Tenant > Administration > Alerts" ], "description": "Adds the selected users to the audit log location alert exclusion list at the start date and removes them again at the end date, so location-based alerts do not fire while they travel. Works on its own and does not require a Conditional Access policy.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "endDate": { "type": "string", "description": "Unix timestamp for when the exclusion is removed" }, "postExecution": { "type": "string" }, "reference": { "type": "string" }, "startDate": { "type": "string", "description": "Unix timestamp for when the exclusion is added" }, "tenantFilter": { "type": "string" }, "Users": { "type": "string", "description": "The users going on vacation" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite" } }, "/api/ExecScheduleForwardingVacation": { "post": { "summary": "ExecScheduleForwardingVacation", "operationId": "ExecScheduleForwardingVacation", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "endDate": { "type": "string" }, "ForwardExternal": { "type": "string" }, "ForwardInternal": { "$ref": "#/components/schemas/LabelValue" }, "forwardOption": { "type": "string", "enum": [ "ExternalAddress", "internalAddress" ] }, "KeepCopy": { "type": "string" }, "postExecution": { "type": "string" }, "reference": { "type": "string" }, "startDate": { "type": "string" }, "tenantFilter": { "type": "string" }, "Users": { "type": "string" } }, "required": [ "ForwardExternal", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecScheduleMailboxVacation": { "post": { "summary": "ExecScheduleMailboxVacation", "operationId": "ExecScheduleMailboxVacation", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "autoMap": { "type": "boolean" }, "calendarPermission": { "$ref": "#/components/schemas/LabelValue" }, "canViewPrivateItems": { "type": "boolean" }, "delegates": { "type": "string" }, "endDate": { "type": "string" }, "includeCalendar": { "type": "boolean" }, "mailboxOwners": { "type": "string" }, "permissionTypes": { "type": "string" }, "postExecution": { "type": "string" }, "reference": { "type": "string" }, "startDate": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecScheduleOOOVacation": { "post": { "summary": "ExecScheduleOOOVacation", "operationId": "ExecScheduleOOOVacation", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AutoDeclineFutureRequestsWhenOOF": { "type": "string" }, "CreateOOFEvent": { "type": "string", "description": "Calendar options — conditionally add when truthy in the request body" }, "DeclineEventsForScheduledOOF": { "type": "string" }, "DeclineMeetingMessage": { "type": "string" }, "endDate": { "type": "string" }, "externalMessage": { "type": "string" }, "internalMessage": { "type": "string" }, "OOFEventSubject": { "type": "string" }, "postExecution": { "type": "string" }, "reference": { "type": "string" }, "startDate": { "type": "string" }, "tenantFilter": { "type": "string" }, "Users": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSchedulerBillingRun": { "post": { "summary": "ExecSchedulerBillingRun", "operationId": "ExecSchedulerBillingRun", "tags": [ "CIPP > Scheduler" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "config": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Scheduler.Billing.ReadWrite" } }, "/api/ExecSendOrgMessage": { "post": { "summary": "ExecSendOrgMessage", "operationId": "ExecSendOrgMessage", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "freq", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "type", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "getStarted", "notification", "taskbar" ] } }, { "name": "URL", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.ReadWrite" } }, "/api/ExecSendPush": { "post": { "summary": "ExecSendPush", "operationId": "ExecSendPush", "tags": [ "Identity > Administration > Users" ], "description": "Sends a test MFA push notification to a user's authenticator app and reports whether it was approved, or - when an OTP code is supplied - verifies that typed code without sending a push. Used to confirm a user's MFA registration works. The push path causes a real prompt on the user's device.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "OTP": { "type": "string", "description": "When an OTP code is supplied we verify that code instead of sending a push notification." }, "TenantFilter": { "type": "string" }, "UserEmail": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ExecServicePrincipals": { "post": { "summary": "ExecServicePrincipals", "operationId": "ExecServicePrincipals", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Create" ] } }, { "name": "AppId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Select", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "addIns": { "type": "array", "x-cipp-field-source": "graph-entity" }, "alternativeNames": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "applicationTemplateId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appOwnerOrganizationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appRoleAssignmentRequired": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "appRoles": { "type": "array", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "disabledByMicrosoftStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "errorUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "homepage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "info": { "type": "object", "x-cipp-field-source": "graph-entity" }, "isDisabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "keyCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "loginUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "logoutUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "notificationEmailAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordSingleSignOnSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "preferredSingleSignOnMode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredTokenSigningKeyEndDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredTokenSigningKeyThumbprint": { "type": "string", "x-cipp-field-source": "graph-entity" }, "publishedPermissionScopes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "publisherName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "replyUrls": { "type": "array", "x-cipp-field-source": "graph-entity" }, "samlMetadataUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "samlSingleSignOnSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "servicePrincipalNames": { "type": "array", "x-cipp-field-source": "graph-entity" }, "servicePrincipalType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "signInAudience": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "tokenEncryptionKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedPublisher": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecSetAPDeviceGroupTag": { "post": { "summary": "ExecSetAPDeviceGroupTag", "operationId": "ExecSetAPDeviceGroupTag", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "deviceId": { "type": "string" }, "groupTag": { "type": "array", "items": { "type": "string" } }, "serialNumber": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/ExecSetCalendarProcessing": { "post": { "summary": "ExecSetCalendarProcessing", "operationId": "ExecSetCalendarProcessing", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "additionalResponse": { "type": "string" }, "addOrganizerToSubject": { "type": "boolean" }, "allowConflicts": { "type": "boolean" }, "allowRecurringMeetings": { "type": "boolean" }, "automaticallyAccept": { "type": "boolean" }, "automaticallyProcess": { "type": "boolean" }, "bookingWindowInDays": { "type": "integer" }, "deleteComments": { "type": "boolean" }, "deleteSubject": { "type": "boolean" }, "maxConflicts": { "type": "integer", "description": "Add optional numeric parameters only if they have values" }, "maximumDurationInMinutes": { "type": "integer" }, "minimumDurationInMinutes": { "type": "integer" }, "processExternalMeetingMessages": { "type": "boolean" }, "removeCanceledMeetings": { "type": "boolean" }, "removeOldMeetingMessages": { "type": "boolean" }, "removePrivateProperty": { "type": "boolean" }, "scheduleOnlyDuringWorkHours": { "type": "boolean" }, "tenantFilter": { "type": "string" }, "UPN": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetCASMailbox": { "post": { "summary": "ExecSetCASMailbox", "operationId": "ExecSetCASMailbox", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "DisplayName": { "type": "string" }, "Identity": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetCIPPAutoBackup": { "post": { "summary": "ExecSetCIPPAutoBackup", "operationId": "ExecSetCIPPAutoBackup", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Enabled": { "type": "boolean" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Backup.ReadWrite" } }, "/api/ExecSetCloudManaged": { "post": { "summary": "ExecSetCloudManaged", "operationId": "ExecSetCloudManaged", "tags": [ "Identity > Administration > Users" ], "description": "Sets the cloud-managed status of a user, group, or contact.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "ID": { "type": "string" }, "isCloudManaged": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "type": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.DirSync.ReadWrite" } }, "/api/ExecSetDefaultMFAMethod": { "post": { "summary": "ExecSetDefaultMFAMethod", "operationId": "ExecSetDefaultMFAMethod", "tags": [ "Identity > Administration > Users" ], "description": "Sets the default second factor a user is prompted with, by patching signInPreferences.\nNote this is ignored at sign-in while system-preferred MFA is enabled for the user.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "MethodType": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecSetLibraryInheritance": { "post": { "summary": "ExecSetLibraryInheritance", "operationId": "ExecSetLibraryInheritance", "tags": [ "Teams-Sharepoint" ], "description": "Controls whether a document library inherits its permissions from the site, via the\nSharePoint REST API.\n\nAction 'Break' detaches the library so it holds its own permissions. CopyRoleAssignments\n(default true) copies the permissions it currently inherits, so nobody loses access at the\nmoment of the break; with it disabled the library starts with an empty permission set and\nonly site collection admins can reach it. ClearSubscopes (default false) resets any folder\nor item inside the library that has its own unique permissions.\n\nAction 'Reset' puts the library back to inheriting from the site. This discards every\npermission unique to the library and cannot be undone other than by granting them again.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "ClearSubscopes": { "type": "boolean" }, "CopyRoleAssignments": { "type": "string", "description": "Default to the safe options: keep current access on a break, leave sub-scopes alone." }, "LibraryName": { "type": "string" }, "ListId": { "type": "string" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "ListId", "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSetLibraryPermission": { "post": { "summary": "ExecSetLibraryPermission", "operationId": "ExecSetLibraryPermission", "tags": [ "Teams-Sharepoint" ], "description": "Grants users and/or groups a SharePoint permission level on a document library (ListId) or\non the site root web (ListId omitted) via the SharePoint REST API. Principals are resolved\nwith ensureuser unless PrincipalId is supplied, role inheritance on the library is broken\n(copying the existing permissions) when it still inherits, and the role assignment is added\nwith addroleassignment.\n\nMode 'Add' leaves any level the principal already holds in place - SharePoint allows a\nprincipal to hold several at once. Mode 'Replace' removes the levels it already holds on\nthis scope first, so the principal ends up with exactly the requested one.\n\nThe level is taken from RoleDefinitionId when supplied (which is how custom permission\nlevels are addressed), otherwise from the named PermissionLevel.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Groups": { "type": "string" }, "LibraryName": { "type": "string" }, "ListId": { "type": "string" }, "Mode": { "type": "string" }, "PermissionLevel": { "type": "string" }, "PrincipalId": { "type": "string" }, "PrincipalName": { "type": "string" }, "RoleDefinitionId": { "type": "string" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" }, "Users": { "type": "string" } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSetLitigationHold": { "post": { "summary": "ExecSetLitigationHold", "operationId": "ExecSetLitigationHold", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "days": { "type": "integer" }, "disable": { "type": "string" }, "Identity": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the query or body of the request" }, "UPN": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetMailboxEmailSize": { "post": { "summary": "ExecSetMailboxEmailSize", "operationId": "ExecSetMailboxEmailSize", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "maxReceiveSize": { "type": "string" }, "maxSendSize": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "UPN": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetMailboxLocale": { "post": { "summary": "ExecSetMailboxLocale", "operationId": "ExecSetMailboxLocale", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "locale": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "user": { "type": "object", "properties": { "x-forwarded-for": { "type": "string" }, "x-ms-client-principal": { "type": "string" }, "x-ms-client-principal-idp": { "type": "string", "x-cipp-observed-values": [ "aad", "azureStaticWebApps" ] }, "x-ms-client-principal-name": { "type": "string" } } } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite", "x-cipp-reads-via": [ "Write-LogMessage" ] } }, "/api/ExecSetMailboxQuota": { "post": { "summary": "ExecSetMailboxQuota", "operationId": "ExecSetMailboxQuota", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "IssueWarningQuota": { "type": "string" }, "ProhibitSendQuota": { "type": "string" }, "ProhibitSendReceiveQuota": { "type": "string" }, "quota": { "type": "string" }, "tenantfilter": { "type": "string" }, "user": { "type": "string" } }, "required": [ "tenantfilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetMailboxRetentionPolicies": { "post": { "summary": "ExecSetMailboxRetentionPolicies", "operationId": "ExecSetMailboxRetentionPolicies", "tags": [ "Email-Exchange > Administration > Mailbox Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Mailboxes": { "type": "array", "items": { "type": "string" } }, "PolicyName": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "PolicyName", "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetMailboxRule": { "post": { "summary": "ExecSetMailboxRule", "operationId": "ExecSetMailboxRule", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Disable": { "type": "boolean" }, "Enable": { "type": "boolean" }, "ruleId": { "type": "string" }, "ruleName": { "type": "string" }, "TenantFilter": { "type": "string", "description": "Interact with the query or body of the request" }, "userPrincipalName": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetMdoAlert": { "post": { "summary": "ExecSetMdoAlert", "operationId": "ExecSetMdoAlert", "tags": [ "Security > Incidents" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Assigned": { "type": "string" }, "Classification": { "type": "string" }, "Determination": { "type": "string" }, "GUID": { "type": "string" }, "Status": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Assigned", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Classification", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Determination", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Status", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Incident.ReadWrite" } }, "/api/ExecSetOneDriveSharing": { "post": { "summary": "ExecSetOneDriveSharing", "operationId": "ExecSetOneDriveSharing", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "SharingCapability": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "UPN": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.SharePoint.ReadWrite" } }, "/api/ExecSetOoO": { "post": { "summary": "ExecSetOoO", "operationId": "ExecSetOoO", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AutoDeclineFutureRequestsWhenOOF": { "type": "boolean" }, "AutoReplyState": { "$ref": "#/components/schemas/LabelValue" }, "CreateOOFEvent": { "type": "boolean", "description": "Calendar options — only pass when explicitly provided in the request body" }, "DeclineEventsForScheduledOOF": { "type": "boolean" }, "DeclineMeetingMessage": { "type": "string" }, "EndTime": { "type": "integer" }, "ExternalMessage": { "type": "string" }, "input": { "type": "string", "description": "User action uses input, edit exchange uses InternalMessage and ExternalMessage User action disable OoO doesn't send any input" }, "InternalMessage": { "type": "string" }, "OOFEventSubject": { "type": "string" }, "StartTime": { "type": "integer", "description": "If starttime and endtime are a number, they are unix timestamps and need to be converted to datetime, otherwise just use them." }, "tenantFilter": { "type": "string" }, "timezone": { "type": "string" }, "userId": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetPackageTag": { "post": { "summary": "ExecSetPackageTag", "operationId": "ExecSetPackageTag", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "Package": { "type": "string", "description": "Add package tag (existing logic)" }, "Remove": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecSetRecipientLimits": { "post": { "summary": "ExecSetRecipientLimits", "operationId": "ExecSetRecipientLimits", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "recipientLimit": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the query or body of the request" }, "userid": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetRetentionHold": { "post": { "summary": "ExecSetRetentionHold", "operationId": "ExecSetRetentionHold", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "disable": { "type": "string" }, "Identity": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with the query or body of the request" }, "UPN": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSetSecurityAlert": { "post": { "summary": "ExecSetSecurityAlert", "operationId": "ExecSetSecurityAlert", "tags": [ "Security > Incidents" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "Status": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Status", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Alert.ReadWrite" } }, "/api/ExecSetSecurityIncident": { "post": { "summary": "ExecSetSecurityIncident", "operationId": "ExecSetSecurityIncident", "tags": [ "Security > Incidents" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignToSelf": { "type": "string" }, "Classification": { "type": "string" }, "Comment": { "type": "string" }, "Determination": { "type": "string" }, "GUID": { "type": "string" }, "Redirected": { "type": "integer" }, "Severity": { "allOf": [ { "$ref": "#/components/schemas/LabelValue" } ], "description": "Severity autoComplete submits {label, value}" }, "Status": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "Determination", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Incident.ReadWrite" } }, "/api/ExecSetSharePointMember": { "post": { "summary": "ExecSetSharePointMember", "operationId": "ExecSetSharePointMember", "tags": [ "Teams-Sharepoint" ], "description": "Adds one or more users to, or removes a user from, a SharePoint site role (Owners, Members or Visitors).\nGroup-connected sites manage Owners/Members through the backing M365 group via Graph;\nVisitors (and classic/communication sites entirely) are managed through the site's\nassociated SharePoint role groups via the SharePoint REST API using certificate\nauthentication. Removals sourced from ListSiteMembers carry the group and type of the\nselected entry, so users directly added to a role group on a group-connected site are\nremoved from that group rather than from the M365 group.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Add": { "type": "boolean" }, "GroupID": { "type": "string" }, "Role": { "type": "string" }, "SharePointType": { "type": "string" }, "tenantFilter": { "type": "string" }, "URL": { "type": "string" }, "user": { "type": "object", "properties": { "addedFields": { "type": "object", "properties": { "Group": { "type": "string" }, "Type": { "type": "string" } } }, "value": { "type": "string" } } } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSetSiteProperties": { "post": { "summary": "ExecSetSiteProperties", "operationId": "ExecSetSiteProperties", "tags": [ "Teams-Sharepoint" ], "description": "Sets admin-level properties on a single SharePoint site (sharing, lifecycle, version\npolicy) through Set-CIPPSPOSite. Only whitelisted properties are accepted; enum values\narrive as friendly names (matching Invoke-ListSiteProperties output) and are converted\nto their numeric CSOM values here.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "LockState": { "$ref": "#/components/schemas/LabelValue" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSetUserPhoto": { "post": { "summary": "ExecSetUserPhoto", "operationId": "ExecSetUserPhoto", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string" }, "photoData": { "type": "string" }, "tenantFilter": { "type": "string" }, "userId": { "type": "string" } }, "required": [ "photoData", "tenantFilter" ] } } } }, "parameters": [ { "name": "action", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userId", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/ExecShadowAISanction": { "post": { "summary": "ExecShadowAISanction", "operationId": "ExecShadowAISanction", "tags": [ "Tenant > AI" ], "description": "Marks an AI tool from the Shadow AI catalog as company sanctioned for a tenant, or removes\nthat status. Sanctioned tools are stored per tenant in the ShadowAIConfig table and are\nreported by ListShadowAI with risk 'Informational' and status 'Sanctioned'; all other\ndetected AI tools report status 'Unsanctioned'.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "tenantFilter": { "type": "string" }, "Tool": { "type": "string" }, "Tools": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.ReadWrite" } }, "/api/ExecSharePointPerms": { "post": { "summary": "ExecSharePointPerms", "operationId": "ExecSharePointPerms", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "onedriveAccessUser": { "type": "string", "description": "The UPN(s) of the user(s) we are adding or removing permissions for. Passed through as-is: a plain string, an array of strings, or the { value = ... } objects the frontend autoComplete posts are all accepted, and Set-CIPPSharePointPerms normalises them." }, "RemovePermission": { "type": "string" }, "tenantFilter": { "type": "string" }, "UPN": { "type": "string", "description": "The UPN or ID of the users OneDrive we are changing permissions on" }, "URL": { "type": "string" }, "user": { "type": "string", "description": "The UPN(s) of the user(s) we are adding or removing permissions for. Passed through as-is: a plain string, an array of strings, or the { value = ... } objects the frontend autoComplete posts are all accepted, and Set-CIPPSharePointPerms normalises them." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSharePointTemplate": { "post": { "summary": "ExecSharePointTemplate", "operationId": "ExecSharePointTemplate", "tags": [ "Teams-Sharepoint" ], "description": "Saves, retrieves, deletes and deploys SharePoint provisioning templates. A template holds\none or more site templates, each with its own document libraries and permission grants.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "DeploymentId": { "type": "string" }, "SiteOwner": { "type": "string" }, "siteTemplates": { "type": "array", "items": { "type": "object", "properties": { "permissions": { "type": "string", "description": "Every site template must carry at least one root-level permission object." } } }, "description": "Every site template must carry at least one root-level permission object." }, "TemplateId": { "type": "string", "description": "Frontend sends TemplateId only when editing (add.js). Create/copy omit it." }, "templateName": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "SiteOwner", "tenantFilter" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Delete", "Deploy", "DeployStatus", "Get", "Save" ] } }, { "name": "DeploymentId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "TemplateId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Admin.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecSiteBrowserActions": { "post": { "summary": "ExecSiteBrowserActions", "operationId": "ExecSiteBrowserActions", "tags": [ "Teams-Sharepoint" ], "description": "Mutating / operational actions for the SharePoint site browser (non-permissions).\nBody.Action selects the operation. SiteUrl + tenantFilter are always required.\nVersion cleanup: StartVersionCleanup, GetVersionCleanupStatus.\nSite admin properties (incl. version policy): GetSiteProperties.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "BatchDeleteMode": { "$ref": "#/components/schemas/LabelValueNumber" }, "DeleteOlderThanDays": { "type": "string" }, "MajorVersionLimit": { "type": "string" }, "MajorWithMinorVersionsLimit": { "type": "string" }, "SiteId": { "type": "string" }, "SiteUrl": { "type": "string" }, "SyncListPolicy": { "type": "boolean" }, "tenantFilter": { "type": "string" } }, "required": [ "Action", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSiteBrowserLibraryCopy": { "post": { "summary": "ExecSiteBrowserLibraryCopy", "operationId": "ExecSiteBrowserLibraryCopy", "tags": [ "Teams-Sharepoint" ], "description": "Starts or preflights a SharePoint document library content copy (CreateCopyJobs + MoveButKeepSource).\nActions: PreflightLibraryCopy, StartLibraryCopy.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "DestLibraryName": { "type": "string" }, "DestListId": { "type": "string" }, "DestSiteId": { "type": "string" }, "DestSiteName": { "type": "string" }, "DestSiteUrl": { "type": "string" }, "NameConflictBehavior": { "type": "string" }, "SourceLibraryName": { "type": "string" }, "SourceListId": { "type": "string" }, "SourceSiteId": { "type": "string" }, "SourceSiteName": { "type": "string" }, "SourceSiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "Action", "tenantFilter" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSiteBrowserPermissions": { "post": { "summary": "ExecSiteBrowserPermissions", "operationId": "ExecSiteBrowserPermissions", "tags": [ "Teams-Sharepoint" ], "description": "Mutating actions for the SharePoint site browser permissions dialog.\nBody.Action selects the operation. SiteUrl + tenantFilter are always required.\nListId scopes library actions; omit it for the site root web.\nSharing links / Graph drive permissions are out of scope.\nGraph site permissions (Sites.Selected app grants): RemoveGraphSitePermission.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "ClearSubscopes": { "type": "boolean" }, "CopyRoleAssignments": { "type": "string" }, "GroupId": { "type": "string" }, "GroupName": { "type": "string" }, "Groups": { "type": "string" }, "LibraryName": { "type": "string" }, "ListId": { "type": "string" }, "PermissionId": { "type": "string" }, "PermissionLevel": { "$ref": "#/components/schemas/LabelValue" }, "PrincipalId": { "type": "string" }, "PrincipalName": { "type": "string", "description": "Allow a single login/UPN from a selected admin row." }, "RoleDefinitionId": { "$ref": "#/components/schemas/LabelValue" }, "SiteId": { "type": "string" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" }, "Title": { "type": "string" }, "userPrincipalName": { "type": "string", "description": "Allow a single login/UPN from a selected admin row." }, "Users": { "type": "string" } }, "required": [ "Action", "GroupId", "ListId", "PermissionId", "PrincipalId", "SiteId", "SiteUrl", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite", "x-cipp-reads-via": [ "Resolve-BrowserPermissionRoleDefId" ] } }, "/api/ExecSnoozeAlert": { "post": { "summary": "ExecSnoozeAlert", "operationId": "ExecSnoozeAlert", "tags": [ "CIPP > Core" ], "description": "Snoozes one alert item so it stops notifying. Body: CmdletName, TenantFilter, AlertItem,\nand either Duration (7, 14, 30 or 90 days) or UntilResolved=true, which keeps the snooze\nuntil the alert stops reporting the item and is then removed automatically. KeepVisible=true\nleaves the item on the dashboard, marked as snoozed, rather than hiding it. Reason is an\noptional note. There is no indefinite snooze.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AlertItem": { "type": "string" }, "CmdletName": { "type": "string" }, "Duration": { "type": "string" }, "KeepVisible": { "type": "string" }, "Reason": { "type": "string" }, "TenantFilter": { "type": "string" }, "UntilResolved": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AlertSnooze.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecSPOVersionCleanup": { "post": { "summary": "ExecSPOVersionCleanup", "operationId": "ExecSPOVersionCleanup", "tags": [ "Teams-Sharepoint" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "BatchDeleteMode": { "type": "string" }, "DeleteOlderThanDays": { "type": "string" }, "MajorVersionLimit": { "type": "string" }, "MajorWithMinorVersionsLimit": { "type": "string" }, "SiteUrl": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.ReadWrite" } }, "/api/ExecSSOSetup": { "post": { "summary": "ExecSSOSetup", "operationId": "ExecSSOSetup", "tags": [ "CIPP > Setup" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string" }, "appId": { "type": "string" }, "appSecret": { "type": "string" }, "multiTenant": { "type": "boolean" }, "targetUrl": { "type": "string" } }, "required": [ "appSecret" ] } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "AppId": { "type": "string", "x-cipp-field-source": "graph,backend" }, "CreatedAt": { "x-cipp-field-source": "backend" }, "MultiTenant": { "x-cipp-field-source": "backend" }, "Status": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecStandardConvert": { "post": { "summary": "ExecStandardConvert", "operationId": "ExecStandardConvert", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/ExecStandardsRun": { "post": { "summary": "ExecStandardsRun", "operationId": "ExecStandardsRun", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "templateId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/ExecStandardTemplateSchedule": { "post": { "summary": "ExecStandardTemplateSchedule", "operationId": "ExecStandardTemplateSchedule", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "runManually": { "type": "boolean", "description": "The stored field is runManually: $true means \"do not run on schedule\"." }, "TemplateId": { "type": "string" } } } } } }, "parameters": [ { "name": "TemplateId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/ExecStartManagedFolderAssistant": { "post": { "summary": "ExecStartManagedFolderAssistant", "operationId": "ExecStartManagedFolderAssistant", "tags": [ "Email-Exchange > Administration" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Id": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "UserPrincipalName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/ExecSyncAPDevices": { "post": { "summary": "ExecSyncAPDevices", "operationId": "ExecSyncAPDevices", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/ExecSyncDEP": { "post": { "summary": "ExecSyncDEP", "operationId": "ExecSyncDEP", "tags": [ "Endpoint > MEM" ], "description": "Syncs devices from Apple Business Manager to Intune", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/ExecSyncVPP": { "post": { "summary": "ExecSyncVPP", "operationId": "ExecSyncVPP", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite" } }, "/api/ExecTeamsVoicePhoneNumberAssignment": { "post": { "summary": "ExecTeamsVoicePhoneNumberAssignment", "operationId": "ExecTeamsVoicePhoneNumberAssignment", "tags": [ "Teams-Sharepoint" ], "description": "Assigns a phone number to a user or resource account, or sets the emergency location on a\nnumber, via the Teams administration Graph API.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "AssignmentCategory": { "type": "string" }, "input": { "$ref": "#/components/schemas/LabelValue" }, "locationOnly": { "type": "string" }, "PhoneNumber": { "type": "string" }, "PhoneNumberType": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Voice.ReadWrite" } }, "/api/ExecTenantGroup": { "post": { "summary": "Entrypoint for tenant group management", "operationId": "ExecTenantGroup", "tags": [ "CIPP > Settings" ], "description": "This function is used to manage tenant groups in CIPP", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Action": { "type": "string", "enum": [ "AddEdit", "Delete" ] }, "dynamicRules": { "type": "array", "items": { "type": "object", "properties": { "operator": { "type": "string" }, "property": { "type": "string" } } } }, "excludePartnerTenant": { "type": "boolean" }, "groupDescription": { "type": "string" }, "groupId": { "type": "string" }, "groupName": { "type": "string" }, "groupType": { "type": "string" }, "members": { "type": "array", "items": { "$ref": "#/components/schemas/LabelValue" } }, "ruleLogic": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Groups.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecTestRefresh": { "post": { "summary": "ExecTestRefresh", "operationId": "ExecTestRefresh", "tags": [ "Tenant > Tests" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string" }, "testName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "testName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Tests.ReadWrite" } }, "/api/ExecTestRun": { "post": { "summary": "ExecTestRun", "operationId": "ExecTestRun", "tags": [ "Tenant > Tests" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "mode": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "mode", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Tests.ReadWrite" } }, "/api/ExecTimeSettings": { "post": { "summary": "ExecTimeSettings", "operationId": "ExecTimeSettings", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Timezone": { "$ref": "#/components/schemas/LabelValue" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.ReadWrite" } }, "/api/ExecToggleAlert": { "post": { "summary": "ExecToggleAlert", "operationId": "ExecToggleAlert", "tags": [ "Tenant > Administration > Alerts" ], "description": "Enables or disables an alert rule without deleting it. Works for both audit log alerts and scheduled alert tasks.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Disabled": { "type": "string" }, "EventType": { "type": "string", "description": "Interact with the query or body of the request" }, "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "Disabled", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "EventType", "in": "query", "description": "Interact with the query or body of the request", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite" } }, "/api/ExecTokenExchange": { "post": { "summary": "ExecTokenExchange", "operationId": "ExecTokenExchange", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantId": { "type": "string" }, "tokenRequest": { "type": "string" }, "tokenUrl": { "type": "string" } }, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "APIKey": { "x-cipp-field-source": "storage" }, "ApplicationId": { "x-cipp-field-source": "storage" }, "ApplicationSecret": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RefreshToken": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "SASUrl": { "x-cipp-field-source": "storage" }, "SecretValue": { "type": "string", "x-cipp-field-source": "storage" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecUniversalSearch": { "get": { "summary": "ExecUniversalSearch", "operationId": "ExecUniversalSearch", "tags": [ "CIPP > Core" ], "description": "Searches every tenant for a user by display name or user principal name, using a cross-tenant Graph query. Superseded by ExecUniversalSearchV2, which searches the cached data and covers groups, applications and licences as well.", "parameters": [ { "name": "name", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ExecUniversalSearchV2": { "get": { "summary": "ExecUniversalSearchV2", "operationId": "ExecUniversalSearchV2", "tags": [ "CIPP > Core" ], "description": "Searches across every tenant the caller can access and returns matches with the tenant each belongs to. type selects what is searched: Users (the default), Groups, Applications or Licenses. Reads the cached report data, so results are as fresh as the last cache run.", "parameters": [ { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer" } }, { "name": "searchTerms", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Data": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "backend" }, "Tenant": { "x-cipp-field-source": "backend" }, "Type": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ExecUpdateBaselineDeviation": { "post": { "summary": "ExecUpdateBaselineDeviation", "operationId": "ExecUpdateBaselineDeviation", "tags": [ "Tenant > Standards" ], "description": "Triage for baseline drift on a resolved (tenant, standard) row:\nAccept (reason required, optional expiry, optional remediate-on-expire),\nDeny (method remediate|delete - the engine remediates on the next run regardless of\nthe configured posture, or holds Delete Pending for object-type standards),\nClear (re-surface as Drift), AcceptPath (tolerate one property while others keep\nalerting), and CompleteTask (mark a manual task done). One Status column; timestamps\nare unix seconds.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "action": { "type": "string" }, "expires": { "type": "string" }, "method": { "type": "string" }, "path": { "type": "string" }, "reason": { "type": "string" }, "remediateOnExpire": { "type": "boolean" }, "standard": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "path", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PendingVerification": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.BaselinesDeviations.ReadWrite" } }, "/api/ExecUpdateDriftDeviation": { "post": { "summary": "ExecUpdateDriftDeviation", "operationId": "ExecUpdateDriftDeviation", "tags": [ "Tenant > Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "deviations": { "type": "array", "items": { "type": "object", "properties": { "receivedValue": { "type": "string" }, "standardName": { "type": "string", "description": "Take everything after the prefix: template ids can contain dots (built-in templates are keyed '.IntuneTemplate.json')" }, "status": { "type": "string", "description": "The status is written at the end of this block, after the action it implies succeeds.", "x-cipp-observed-values": [ "deniedDelete", "DeniedRemediate" ] } } } }, "persistentDeny": { "type": "boolean" }, "reason": { "type": "string" }, "RemoveDriftCustomization": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "copyField": { "x-cipp-field-source": "backend" }, "error": { "x-cipp-field-source": "backend" }, "result": { "x-cipp-field-source": "backend" }, "resultText": { "x-cipp-field-source": "backend" }, "Settings": { "x-cipp-field-source": "backend" }, "standardName": { "x-cipp-field-source": "backend" }, "state": { "x-cipp-field-source": "backend" }, "success": { "x-cipp-field-source": "backend" }, "Tenant": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/ExecUpdateRefreshToken": { "post": { "summary": "ExecUpdateRefreshToken", "operationId": "ExecUpdateRefreshToken", "tags": [ "CIPP > Setup" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "refreshtoken": { "type": "string" }, "tenantId": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecUpdateSecureScore": { "post": { "summary": "ExecUpdateSecureScore", "operationId": "ExecUpdateSecureScore", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ControlName": { "type": "string" }, "reason": { "type": "string" }, "resolutionType": { "$ref": "#/components/schemas/LabelValue" }, "TenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "vendorInformation": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ExecUserBookmarks": { "post": { "summary": "ExecUserBookmarks", "operationId": "ExecUserBookmarks", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "currentSettings": { "type": "object", "properties": { "bookmarks": { "type": "string" } } }, "user": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ExecUserSettings": { "post": { "summary": "ExecUserSettings", "operationId": "ExecUserSettings", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "currentSettings": { "type": "string" }, "user": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite" } }, "/api/ExecWebhookSubscriptions": { "post": { "summary": "ExecWebhookSubscriptions", "operationId": "ExecWebhookSubscriptions", "tags": [ "CIPP > Settings" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Delete", "Resubscribe", "Unsubscribe", "UnsubscribeAll" ] } }, { "name": "WebhookID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Alert.ReadWrite" } }, "/api/GetCippAlerts": { "get": { "summary": "GetCippAlerts", "operationId": "GetCippAlerts", "tags": [ "CIPP > Core" ], "description": "Returns the CIPP dashboard banner notifications: any hosted maintenance notice, a legacy infrastructure warning for instances still on Function Apps, today's most recent entries from the alert log, and warnings for an out-of-date or misconfigured deployment.", "parameters": [ { "name": "localversion", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/GetVersion": { "get": { "summary": "GetVersion", "operationId": "GetVersion", "tags": [ "CIPP > Core" ], "description": "Compares the caller's reported CIPP version against the latest published release and reports whether the frontend or the API is out of date, alongside the hosting shape (hosting type, App Service SKU, runtime stack) and the recorded version-update history.", "parameters": [ { "name": "LocalVersion", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "LocalCIPPAPIVersion": { "x-cipp-field-source": "backend" }, "LocalCIPPVersion": { "x-cipp-field-source": "backend" }, "OutOfDateCIPP": { "x-cipp-field-source": "backend" }, "OutOfDateCIPPAPI": { "x-cipp-field-source": "backend" }, "RemoteCIPPAPIVersion": { "x-cipp-field-source": "backend" }, "RemoteCIPPVersion": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListActiveSyncDevices": { "get": { "summary": "ListActiveSyncDevices", "operationId": "ListActiveSyncDevices", "tags": [ "Email-Exchange > Reports" ], "description": "Lists all ActiveSync mobile devices registered across Exchange Online mailboxes in a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "clientType": { "x-cipp-field-source": "backend,frontend" }, "clientVersion": { "x-cipp-field-source": "backend,frontend" }, "deviceAccessState": { "x-cipp-field-source": "backend,frontend" }, "deviceFriendlyName": { "x-cipp-field-source": "backend,frontend" }, "deviceID": { "x-cipp-field-source": "backend" }, "deviceModel": { "x-cipp-field-source": "backend,frontend" }, "deviceOS": { "x-cipp-field-source": "backend,frontend" }, "deviceType": { "x-cipp-field-source": "backend,frontend" }, "firstSyncTime": { "x-cipp-field-source": "backend,frontend" }, "Guid": { "x-cipp-field-source": "backend" }, "identity": { "x-cipp-field-source": "backend" }, "lastSuccessSync": { "x-cipp-field-source": "backend,frontend" }, "lastSyncAttemptTime": { "x-cipp-field-source": "backend,frontend" }, "syncInfoNote": { "x-cipp-field-source": "backend" }, "userDisplayName": { "x-cipp-field-source": "backend,frontend" }, "userPrincipalName": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListAdminPortalLicenses": { "get": { "summary": "ListAdminPortalLicenses", "operationId": "ListAdminPortalLicenses", "tags": [ "CIPP > Core" ], "description": "Retrieves license information from the Microsoft 365 Admin Portal for a tenant, including low-friction trial allotments.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListAgent365PackageDetail": { "get": { "summary": "ListAgent365PackageDetail", "operationId": "ListAgent365PackageDetail", "tags": [ "Tenant > AI" ], "description": "Gets the full detail for a single Microsoft Agent 365 / Copilot package by id, including the\nallowedUsersAndGroups, acquireUsersAndGroups and elementDetails that the list endpoint omits.\nUses delegated auth: this call returns 424 Failed Dependency under application context.", "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "acquireUsersAndGroups": { "type": "array", "x-cipp-field-source": "graph-entity" }, "activeUsers": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "allowedUsersAndGroups": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assetId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "availableTo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "categories": { "type": "array", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deployedTo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "elementDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "elementTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "error": { "x-cipp-field-source": "backend" }, "exceptionRate": { "type": "number", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isBlocked": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastUsedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "longDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manifestId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manifestVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ownerId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "platform": { "type": "string", "x-cipp-field-source": "graph-entity" }, "publisher": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sensitivity": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sharedWithUsersAndGroups": { "type": "array", "x-cipp-field-source": "graph-entity" }, "shortDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "supportedHosts": { "type": "array", "x-cipp-field-source": "graph-entity" }, "totalRunTimeInHours": { "type": "number", "x-cipp-field-source": "graph-entity" }, "totalSessions": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "type": { "type": "object", "x-cipp-field-source": "graph-entity" }, "version": { "type": "string", "x-cipp-field-source": "graph-entity" }, "zipFile": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.Read" } }, "/api/ListAgent365Packages": { "get": { "summary": "ListAgent365Packages", "operationId": "ListAgent365Packages", "tags": [ "Tenant > AI" ], "description": "Lists Microsoft Agent 365 / Copilot packages (agents and Microsoft 365 apps) in the tenant\ncatalog via the Package Management API. Requires a Microsoft Agent 365 license on the tenant.\nUses delegated auth: the Package Management API currently fails under application context\n(424 Failed Dependency on GET, partial on LIST). Agents are NOT returned by the default list,\nso this also queries supportedHosts=Copilot and merges the results (deduped by id). An explicit\nOData $filter (Filter query parameter) overrides the default merge.", "parameters": [ { "name": "Filter", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "acquireUsersAndGroups": { "type": "array", "x-cipp-field-source": "graph-entity" }, "activeUsers": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "allowedUsersAndGroups": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assetId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "availableTo": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "categories": { "type": "array", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deployedTo": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "elementDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "elementTypes": { "type": "array", "x-cipp-field-source": "graph-entity,frontend" }, "exceptionRate": { "type": "number", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isBlocked": { "type": "boolean", "x-cipp-field-source": "graph-entity,frontend" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "lastUsedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "longDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manifestId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manifestVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ownerId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "platform": { "type": "string", "x-cipp-field-source": "graph-entity" }, "publisher": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "sensitivity": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sharedWithUsersAndGroups": { "type": "array", "x-cipp-field-source": "graph-entity" }, "shortDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "supportedHosts": { "type": "array", "x-cipp-field-source": "graph-entity,frontend" }, "totalRunTimeInHours": { "type": "number", "x-cipp-field-source": "graph-entity" }, "totalSessions": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "type": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "version": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "zipFile": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.Read" } }, "/api/ListAlertResults": { "get": { "summary": "ListAlertResults", "operationId": "ListAlertResults", "tags": [ "CIPP > Core" ], "description": "Lists the tracked alert items for a tenant from the AlertLifecycle table, which\nWrite-AlertTrace maintains: one row per alert item with its Status (Open, Snoozed or\nResolved), when it was first and last seen, when it was last checked, how often it\nreopened and the snooze details when one applies. Pass tenantFilter (or AllTenants for\nevery tenant the caller may see). Open and Snoozed items are always returned; Resolved\nitems are included when IncludeResolved=true, limited to those resolved within the last\nDays days (default 2, at most 366). Each item carries the raw alert item and the keys\nneeded to snooze or unsnooze it.", "parameters": [ { "name": "Days", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IncludeResolved", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CmdletName": { "x-cipp-field-source": "frontend" }, "ContentPreview": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "FirstSeen": { "x-cipp-field-source": "frontend" }, "LastChecked": { "x-cipp-field-source": "frontend" }, "LastSeen": { "x-cipp-field-source": "frontend" }, "ReopenCount": { "x-cipp-field-source": "frontend" }, "ResolvedAt": { "x-cipp-field-source": "frontend" }, "SnoozedBy": { "x-cipp-field-source": "storage,frontend" }, "SnoozeReason": { "x-cipp-field-source": "storage,frontend" }, "SnoozeRowKey": { "x-cipp-field-source": "storage" }, "SnoozeUntil": { "x-cipp-field-source": "storage" }, "SnoozeUntilResolved": { "x-cipp-field-source": "storage,frontend" }, "SnoozeVisible": { "x-cipp-field-source": "storage,frontend" }, "Status": { "x-cipp-field-source": "storage,frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.Read", "x-cipp-any-tenant": true } }, "/api/ListAlertsQueue": { "get": { "summary": "ListAlertsQueue", "operationId": "ListAlertsQueue", "tags": [ "Tenant > Administration > Alerts" ], "description": "Lists configured alert rules including webhook rules and scheduled alert tasks, showing their configuration and tenant scope.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Actions": { "x-cipp-field-source": "frontend" }, "AlertComment": { "x-cipp-field-source": "frontend" }, "Conditions": { "x-cipp-field-source": "frontend" }, "Enabled": { "x-cipp-field-source": "frontend" }, "EventType": { "x-cipp-field-source": "frontend" }, "excludedTenants": { "x-cipp-field-source": "frontend" }, "RepeatsEvery": { "x-cipp-field-source": "frontend" }, "Tenants": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.Read" } }, "/api/ListAllTenantDeviceCompliance": { "get": { "summary": "ListAllTenantDeviceCompliance", "operationId": "ListAllTenantDeviceCompliance", "tags": [ "Endpoint > Reports" ], "description": "Lists device compliance summary across all managed tenants using the Lighthouse managedDeviceCompliances API, or for a single tenant via Intune.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "complianceStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "inGracePeriodUntilDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastRefreshedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managedDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managedDeviceName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manufacturer": { "type": "string", "x-cipp-field-source": "graph-entity" }, "model": { "type": "string", "x-cipp-field-source": "graph-entity" }, "osDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "osVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ownerType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tenantDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.DeviceCompliance.Read" } }, "/api/ListAndroidEnrollmentProfiles": { "get": { "summary": "ListAndroidEnrollmentProfiles", "operationId": "ListAndroidEnrollmentProfiles", "tags": [ "Endpoint > MEM" ], "description": "Lists Android Enterprise enrollment profiles and hydrates token fields when Graph omits them from the list response.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.Read" } }, "/api/ListAntiPhishingFilters": { "get": { "summary": "ListAntiPhishingFilters", "operationId": "ListAntiPhishingFilters", "tags": [ "Email-Exchange > Reports" ], "description": "Lists anti-phishing policies and their associated rules configured in Exchange Online Protection.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AuthenticationFailAction": { "x-cipp-field-source": "frontend" }, "EnableFirstContactSafetyTips": { "x-cipp-field-source": "frontend" }, "EnableMailboxIntelligence": { "x-cipp-field-source": "frontend" }, "EnableMailboxIntelligenceProtection": { "x-cipp-field-source": "frontend" }, "EnableOrganizationDomainsProtection": { "x-cipp-field-source": "frontend" }, "EnableSimilarDomainsSafetyTips": { "x-cipp-field-source": "frontend" }, "EnableSimilarUsersSafetyTips": { "x-cipp-field-source": "frontend" }, "EnableSpoofIntelligence": { "x-cipp-field-source": "frontend" }, "EnableUnauthenticatedSender": { "x-cipp-field-source": "frontend" }, "EnableUnusualCharactersSafetyTips": { "x-cipp-field-source": "frontend" }, "EnableViaTag": { "x-cipp-field-source": "frontend" }, "ExcludedDomains": { "x-cipp-field-source": "frontend" }, "ExcludedSenders": { "x-cipp-field-source": "frontend" }, "MailboxIntelligenceProtectionAction": { "x-cipp-field-source": "frontend" }, "MailboxIntelligenceQuarantineTag": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "PhishThresholdLevel": { "x-cipp-field-source": "frontend" }, "Priority": { "x-cipp-field-source": "backend,frontend" }, "RecipientDomainIs": { "x-cipp-field-source": "backend,frontend" }, "RuleName": { "x-cipp-field-source": "backend,frontend" }, "SpoofQuarantineTag": { "x-cipp-field-source": "frontend" }, "State": { "x-cipp-field-source": "backend,frontend" }, "TargetedDomainProtectionAction": { "x-cipp-field-source": "frontend" }, "TargetedDomainQuarantineTag": { "x-cipp-field-source": "frontend" }, "TargetedUserProtectionAction": { "x-cipp-field-source": "frontend" }, "TargetedUserQuarantineTag": { "x-cipp-field-source": "frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListAPDevices": { "get": { "summary": "ListAPDevices", "operationId": "ListAPDevices", "tags": [ "Endpoint > Autopilot" ], "description": "Lists Windows Autopilot device identities registered in a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "addressableUserName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureActiveDirectoryDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureAdDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deploymentProfileAssignedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deploymentProfileAssignmentDetailedStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deploymentProfileAssignmentStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceAccountPassword": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceAccountUpn": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceFriendlyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrollmentState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "groupTag": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastContactedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managedDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "manufacturer": { "type": "string", "x-cipp-field-source": "graph-entity" }, "model": { "type": "string", "x-cipp-field-source": "graph-entity" }, "productKey": { "type": "string", "x-cipp-field-source": "graph-entity" }, "purchaseOrderIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "remediationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "remediationStateLastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serialNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skuNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "systemFamily": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userlessEnrollmentStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.Read" } }, "/api/ListApiEgress": { "get": { "summary": "ListApiEgress", "operationId": "ListApiEgress", "tags": [ "CIPP > Settings" ], "description": "Per-API-client egress usage for this instance against the daily cap. Reads the\nCraftEgressAccounting table that the Craft runtime mirrors its egress accounting into (the same\nstorage account, so this reads it directly): a per-day audit row per client plus an instance\ntotal, and 15-minute buckets for the trend. Returns today's instance summary (used-of-cap,\nenforcing, when the cap was first hit, how many requests were shed), the per-client breakdown,\nthe top endpoints by egress (instance-wide and per client), signed-in user traffic (reported,\nnever capped), and the last-24h instance trend. When the table has no data for today - accounting off, a\nnon-hosted instance, or simply no app-only traffic yet - Enabled is false and the UI hides the\ncard. SuperAdmin only.", "parameters": [ { "name": "Hours", "in": "query", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read", "x-cipp-any-tenant": true } }, "/api/ListApiTest": { "get": { "summary": "ListApiTest", "operationId": "ListApiTest", "tags": [ "CIPP > Core" ], "description": "Returns debug information about the current API request, trigger metadata, and environment variables. Used for CIPP platform diagnostics.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListAppApprovalTemplates": { "get": { "summary": "ListAppApprovalTemplates", "operationId": "ListAppApprovalTemplates", "tags": [ "Tenant > Administration > Application Approval" ], "description": "Lists saved application approval templates for standardized app consent configurations.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AppId": { "x-cipp-field-source": "frontend" }, "AppName": { "x-cipp-field-source": "frontend" }, "AppType": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "Error": { "x-cipp-field-source": "backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "PermissionSetName": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateId": { "x-cipp-field-source": "backend" }, "TemplateName": { "x-cipp-field-source": "storage,backend,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "UpdatedBy": { "x-cipp-field-source": "storage,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.Read", "x-cipp-any-tenant": true } }, "/api/ListAppConsentRequests": { "get": { "summary": "ListAppConsentRequests", "operationId": "ListAppConsentRequests", "tags": [ "Tenant > Administration > Application Approval" ], "description": "Lists pending application consent requests in a tenant, filterable by request status.", "parameters": [ { "name": "Filter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RequestStatus", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "InProgress" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "appDisplayName": { "x-cipp-field-source": "backend,frontend" }, "appId": { "x-cipp-field-source": "backend,frontend" }, "consentUrl": { "x-cipp-field-source": "backend,frontend" }, "requestDate": { "x-cipp-field-source": "backend,frontend" }, "requestReason": { "x-cipp-field-source": "backend,frontend" }, "requestStatus": { "x-cipp-field-source": "backend,frontend" }, "requestUser": { "x-cipp-field-source": "backend,frontend" }, "reviewedBy": { "x-cipp-field-source": "backend,frontend" }, "reviewedDate": { "x-cipp-field-source": "backend" }, "reviewedJustification": { "x-cipp-field-source": "backend,frontend" }, "reviewedStatus": { "x-cipp-field-source": "backend" }, "scopes": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListAppleEnrollmentProfiles": { "get": { "summary": "ListAppleEnrollmentProfiles", "operationId": "ListAppleEnrollmentProfiles", "tags": [ "Endpoint > MEM" ], "description": "Lists Apple Automated Device Enrollment tokens and enrollment profiles.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "appleIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "dataSharingConsentGranted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastSuccessfulSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastSyncErrorCode": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "lastSyncTriggeredDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" }, "shareTokenWithSchoolDataSyncService": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "syncedDeviceCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "tokenExpirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tokenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tokenType": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.Read" } }, "/api/ListApplicationQueue": { "get": { "summary": "ListApplicationQueue", "operationId": "ListApplicationQueue", "tags": [ "Endpoint > Applications" ], "description": "Lists queued Intune application deployments that are pending assignment to tenants.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "applicationName": { "x-cipp-field-source": "backend,frontend" }, "assignTo": { "x-cipp-field-source": "backend,frontend" }, "cmdLine": { "x-cipp-field-source": "backend,frontend" }, "id": { "x-cipp-field-source": "backend" }, "status": { "x-cipp-field-source": "backend" }, "tenantName": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.Read" } }, "/api/ListAppProtectionPolicies": { "get": { "summary": "ListAppProtectionPolicies", "operationId": "ListAppProtectionPolicies", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune app protection policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "displayName": { "x-cipp-field-source": "frontend" }, "lastModifiedDateTime": { "x-cipp-field-source": "frontend" }, "PolicyAssignment": { "x-cipp-field-source": "frontend" }, "PolicyExclude": { "x-cipp-field-source": "frontend" }, "PolicyTypeName": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListApps": { "get": { "summary": "ListApps", "operationId": "ListApps", "tags": [ "Endpoint > Applications" ], "description": "Lists Intune managed applications for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AppAssignment": { "x-cipp-field-source": "frontend" }, "AppExclude": { "x-cipp-field-source": "frontend" }, "createdDateTime": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "lastModifiedDateTime": { "x-cipp-field-source": "frontend" }, "publishingState": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.Read" } }, "/api/ListAppsRepository": { "post": { "summary": "ListAppsRepository", "operationId": "ListAppsRepository", "tags": [ "Endpoint > Applications" ], "description": "Searches external application repositories (WinGet, Chocolatey, etc.) for available application packages.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "Repository": { "type": "string" }, "Search": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "applicationName": { "x-cipp-field-source": "backend" }, "author": { "x-cipp-field-source": "backend" }, "created": { "x-cipp-field-source": "backend" }, "customRepo": { "x-cipp-field-source": "backend" }, "description": { "x-cipp-field-source": "backend" }, "packagename": { "x-cipp-field-source": "backend" }, "version": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.Read", "x-cipp-any-tenant": true } }, "/api/ListAppStatus": { "get": { "summary": "ListAppStatus", "operationId": "ListAppStatus", "tags": [ "Endpoint > Applications" ], "description": "Lists Intune application installation status across devices for a specific application, including install state and error codes.", "parameters": [ { "name": "AppFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Device.Read" } }, "/api/ListAppTemplates": { "get": { "summary": "ListAppTemplates", "operationId": "ListAppTemplates", "tags": [ "Endpoint > Applications" ], "description": "Lists the saved application deployment templates, each with its display name, description and the applications it bundles. These are CIPP templates, not a tenant's deployed apps.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "appCount": { "x-cipp-field-source": "backend,frontend" }, "appNames": { "x-cipp-field-source": "backend,frontend" }, "Apps": { "x-cipp-field-source": "backend" }, "appTypes": { "x-cipp-field-source": "backend,frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "description": { "x-cipp-field-source": "backend,frontend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,backend" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.Read", "x-cipp-any-tenant": true } }, "/api/ListAssignmentFilters": { "get": { "summary": "ListAssignmentFilters", "operationId": "ListAssignmentFilters", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune assignment filters for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "filterId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "assignmentFilterManagementType": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "payloads": { "type": "array", "x-cipp-field-source": "graph-entity" }, "platform": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "roleScopeTags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "rule": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListAssignmentFilterTemplates": { "get": { "summary": "ListAssignmentFilterTemplates", "operationId": "ListAssignmentFilterTemplates", "tags": [ "Endpoint > MEM" ], "description": "Lists the saved Intune assignment filter templates, each with its platform, filter rule and management type. Pass ID to return a single template. These are CIPP templates, not a tenant's deployed filters.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "assignmentFilterManagementType": { "x-cipp-field-source": "backend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "description": { "x-cipp-field-source": "backend,frontend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,backend,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "platform": { "x-cipp-field-source": "backend,frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "rule": { "x-cipp-field-source": "backend" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read", "x-cipp-any-tenant": true } }, "/api/ListAsyncDeployment": { "get": { "summary": "Get the live progress of a background job", "operationId": "ListAsyncDeployment", "tags": [ "CIPP > Scheduler" ], "description": "Returns the status rows of a background job that reports progress while it runs, such as a\nuser offboarding started from the wizard: one row per target (the user) with its overall\nstatus and the status and message of every step.", "parameters": [ { "name": "DeploymentId", "in": "query", "description": "The job id handed back when the work was queued (e.g. DeploymentId from ExecOffboardUser)", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Scheduler.Read", "x-cipp-any-tenant": true } }, "/api/ListAuditLogCoverage": { "get": { "summary": "ListAuditLogCoverage", "operationId": "ListAuditLogCoverage", "tags": [ "Tenant > Administration > Alerts" ], "description": "Lists the V2 audit-log coverage ledger (AuditLogCoverage) - one row per tenant + 60-minute\nsearch window with its state (Planned / Created / Downloaded / Retry / DeadLetter / Skipped),\nrecord count, attempts and last error. Honours the tenant selector (a specific tenant or\nAllTenants) and CIPP tenant access control. Accepts the same date filters as the Saved Logs\nview: RelativeTime (e.g. 48h, 7d) or StartDate/EndDate. Defaults to the last 48 hours.", "parameters": [ { "name": "EndDate", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RelativeTime", "in": "query", "description": "--- Date range (mirrors Invoke-ListAuditLogs) ---", "required": false, "schema": { "type": "string" } }, { "name": "StartDate", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Attempts": { "x-cipp-field-source": "storage" }, "CreatedUtc": { "x-cipp-field-source": "storage" }, "DownloadedUtc": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "LastError": { "x-cipp-field-source": "storage,frontend" }, "LastPolledUtc": { "x-cipp-field-source": "storage" }, "MatchedCount": { "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "ProcessedUtc": { "x-cipp-field-source": "storage" }, "RecordCount": { "type": "integer", "x-cipp-field-source": "storage,frontend" }, "RetryCount": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "SearchId": { "type": "string", "x-cipp-field-source": "storage" }, "SearchStatus": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "State": { "x-cipp-field-source": "storage,frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "TenantId": { "type": "string", "x-cipp-field-source": "storage" }, "ThrottleCount": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Type": { "x-cipp-field-source": "storage,frontend" }, "WindowEnd": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "WindowStart": { "type": "string", "x-cipp-field-source": "storage,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Alert.Read", "x-cipp-any-tenant": true } }, "/api/ListAuditLogs": { "get": { "summary": "ListAuditLogs", "operationId": "ListAuditLogs", "tags": [ "Tenant > Administration > Alerts" ], "description": "Lists audit log entries from the CIPP audit log store, filterable by tenant, date range, and log ID.", "parameters": [ { "name": "EndDate", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "LogId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RelativeTime", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "StartDate", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Data": { "type": "string", "x-cipp-field-source": "storage,backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "EventCreationTime": { "x-cipp-field-source": "storage" }, "LogId": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "storage,backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Title": { "x-cipp-field-source": "storage,backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.Read" } }, "/api/ListAuditLogSearches": { "get": { "summary": "ListAuditLogSearches", "operationId": "ListAuditLogSearches", "tags": [ "Tenant > Administration > Alerts" ], "description": "Lists or creates Microsoft 365 Unified Audit Log searches for a tenant, with support for retrieving search results.", "parameters": [ { "name": "Days", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SearchId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Searches", "SearchResults" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CippStatus": { "type": "string", "x-cipp-field-source": "storage" }, "DisplayName": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "EndTime": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "filterEndDateTime": { "x-cipp-field-source": "frontend" }, "filterStartDateTime": { "x-cipp-field-source": "frontend" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "Query": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "StartTime": { "type": "string", "x-cipp-field-source": "storage" }, "status": { "x-cipp-field-source": "frontend" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Alert.Read" } }, "/api/ListAuditLogTest": { "get": { "summary": "ListAuditLogTest", "operationId": "ListAuditLogTest", "tags": [ "Tenant > Administration > Alerts" ], "description": "Tests audit log webhook rules against a specific search to validate rule matching and alert triggering.", "parameters": [ { "name": "SearchId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "TenantFilter", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Alert.Read", "x-cipp-any-tenant": true } }, "/api/ListAutopilotconfig": { "get": { "summary": "ListAutopilotconfig", "operationId": "ListAutopilotconfig", "tags": [ "Endpoint > Autopilot" ], "description": "Lists Windows Autopilot deployment profiles, Enrollment Status Page configurations, or Windows Hello for Business policies for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "type", "in": "query", "required": false, "schema": { "type": "string", "x-cipp-observed-values": [ "ApProfile", "ESP" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "deviceEnrollmentConfigurationType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceNameTemplate": { "x-cipp-field-source": "frontend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "extractHardwareHash": { "x-cipp-field-source": "frontend" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "language": { "x-cipp-field-source": "frontend" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "PolicyAssignment": { "x-cipp-field-source": "frontend" }, "priority": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" }, "version": { "type": "integer", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.Read" } }, "/api/ListAvailableTests": { "get": { "summary": "ListAvailableTests", "operationId": "ListAvailableTests", "tags": [ "Tenant > Tests" ], "description": "Lists the compliance tests CIPP can run against a tenant, both the built-in framework tests (CIS, CISA, Essential Eight, EIDSCA, ORCA) and any custom PowerShell tests added to this instance. Returns the catalogue of tests, not their results.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AlertOnFailure": { "x-cipp-field-source": "storage" }, "AlertStatuses": { "x-cipp-field-source": "storage" }, "Category": { "x-cipp-field-source": "storage" }, "CreatedBy": { "x-cipp-field-source": "storage" }, "CreatedDate": { "x-cipp-field-source": "storage" }, "CustomTests": { "x-cipp-field-source": "backend" }, "Description": { "x-cipp-field-source": "storage" }, "DevicesTests": { "x-cipp-field-source": "backend" }, "Enabled": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "IdentityTests": { "x-cipp-field-source": "backend" }, "ImplementationEffort": { "x-cipp-field-source": "storage" }, "MarkdownTemplate": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Pillar": { "x-cipp-field-source": "storage" }, "ResultMode": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "ResultSchema": { "x-cipp-field-source": "storage" }, "ReturnType": { "x-cipp-field-source": "storage" }, "Risk": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "ScriptContent": { "x-cipp-field-source": "storage" }, "ScriptGuid": { "x-cipp-field-source": "storage" }, "ScriptName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UserImpact": { "x-cipp-field-source": "storage" }, "Version": { "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Dashboard.Read", "x-cipp-any-tenant": true } }, "/api/ListAzureADConnectStatus": { "get": { "summary": "ListAzureADConnectStatus", "operationId": "ListAzureADConnectStatus", "tags": [ "Identity > Reports" ], "description": "Retrieves Entra ID Connect (Azure AD Connect) synchronization status and configuration for a tenant, including sync intervals, password sync, and pass-through authentication settings.", "parameters": [ { "name": "DataToReturn", "in": "query", "description": "Optional. Which section to return: 'AzureADConnectSettings' for the sync status and configuration, or 'AzureADObjectsInError' for objects that failed to sync. Omit to return both.", "required": false, "schema": { "type": "string", "enum": [ "AzureADConnectSettings", "AzureADObjectsInError" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "AzureADConnectSettings": { "x-cipp-field-source": "backend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph,frontend" }, "dirSyncEnabled": { "x-cipp-field-source": "backend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph,frontend" }, "id": { "type": "string", "x-cipp-field-source": "graph" }, "lastSyncDateTime": { "x-cipp-field-source": "backend" }, "numberOfHoursFromLastSync": { "x-cipp-field-source": "backend" }, "ObjectsInError": { "x-cipp-field-source": "backend" }, "ObjectType": { "x-cipp-field-source": "frontend" }, "onPremisesProvisioningErrors": { "x-cipp-field-source": "frontend" }, "raw": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListBaselineAlignment": { "get": { "summary": "ListBaselineAlignment", "operationId": "ListBaselineAlignment", "tags": [ "Tenant > Standards" ], "description": "Baseline alignment data. With ?tenantFilter= returns the tenant payload (summary,\nresolved rows with history, stage states, deviation feed); with\n?tenantFilter=&history=true returns the flattened run-event history; with\n?byStandard=true returns the aggregate payload (fleet score, per-standard rollups,\ntenant summaries, trend, and the accepted/denied deviation list).", "parameters": [ { "name": "byStandard", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "history", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.Read" } }, "/api/ListBaselines": { "get": { "summary": "ListBaselines", "operationId": "ListBaselines", "tags": [ "Tenant > Standards" ], "description": "Lists baselines with their stages, per-stage rollout occupancy, and\nper-tenant stage states.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "assignedTenants": { "x-cipp-field-source": "frontend" }, "baselineName": { "x-cipp-field-source": "frontend" }, "description": { "x-cipp-field-source": "frontend" }, "remediationPosture": { "x-cipp-field-source": "frontend" }, "source": { "x-cipp-field-source": "frontend" }, "stageNames": { "x-cipp-field-source": "frontend" }, "standardsCount": { "x-cipp-field-source": "frontend" }, "updatedAt": { "x-cipp-field-source": "frontend" }, "updatedBy": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.Read" } }, "/api/ListBaselineStandards": { "get": { "summary": "ListBaselineStandards", "operationId": "ListBaselineStandards", "tags": [ "Tenant > Standards" ], "description": "Lists the Baseline definition catalog: the standards available to add to a baseline,\nincluding their configurable variables and metadata.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.Read" } }, "/api/ListBasicAuth": { "get": { "summary": "ListBasicAuth", "operationId": "ListBasicAuth", "tags": [ "Identity > Reports" ], "description": "Lists sign-in events using basic authentication (legacy protocols) for a tenant from the audit logs.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "clientAppUsed": { "type": "string", "x-cipp-field-source": "graph,storage,backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "MetaData": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Status": { "type": "object", "x-cipp-field-source": "graph,backend" }, "Tenant": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph,storage,backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.AuditLog.Read" } }, "/api/ListBECPhishingSpread": { "get": { "summary": "Lists who else received mail from a sender, from message-trace metadata.", "operationId": "ListBECPhishingSpread", "tags": [ "Identity > Administration > Users" ], "description": "Given a sender address (and optionally a subject fragment), walks the message trace for the last N days and groups the recipients: address, internal or external, message count, first and last delivery and the subjects seen. Use it to find the spread of a phishing message from a compromised or look-alike sender. Metadata only - no message content is read.", "parameters": [ { "name": "days", "in": "query", "description": "look-back in days (1-90)", "required": false, "schema": { "type": "string" } }, { "name": "sender", "in": "query", "description": "the sender to trace", "required": false, "schema": { "type": "string" } }, { "name": "subject", "in": "query", "description": "optional subject fragment to narrow the trace (case-insensitive contains)", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Complete": { "x-cipp-field-source": "backend" }, "Days": { "x-cipp-field-source": "backend" }, "ExternalCount": { "x-cipp-field-source": "backend" }, "InternalCount": { "x-cipp-field-source": "backend" }, "Recipients": { "x-cipp-field-source": "backend" }, "Sender": { "x-cipp-field-source": "backend" }, "TotalMessages": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListBECRemediationActions": { "post": { "summary": "Lists the available Business Email Compromise containment actions.", "operationId": "ListBECRemediationActions", "tags": [ "Identity > Administration > Users" ], "description": "Returns the catalog of containment actions ExecBECRemediate accepts - id, label, description, impact (Low/Medium/High/Critical), whether it is reversible and whether it runs by default (the instance-wide defaults from CIPP settings).", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "DefaultSelected": { "x-cipp-field-source": "backend" }, "Description": { "x-cipp-field-source": "backend" }, "Id": { "x-cipp-field-source": "backend" }, "Impact": { "x-cipp-field-source": "backend" }, "Label": { "x-cipp-field-source": "backend" }, "Order": { "x-cipp-field-source": "backend" }, "ParameterName": { "x-cipp-field-source": "backend" }, "Reversible": { "x-cipp-field-source": "backend" }, "TargetSource": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite", "x-cipp-any-tenant": true } }, "/api/ListBECReports": { "get": { "summary": "Lists Business Email Compromise runs.", "operationId": "ListBECReports", "tags": [ "Identity > Administration > Users" ], "description": "Lists every stored BEC run (case id, user, status, threat level and score, when it was extracted, who requested it) for a tenant, or for every tenant with tenantFilter=AllTenants. Optionally narrowed to one user with userId. Runs are kept until deleted; this list never reads the result payloads.", "parameters": [ { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "userId", "in": "query", "description": "Narrow the list to one user's run history", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "CaseId": { "x-cipp-field-source": "backend" }, "ContainmentRuns": { "x-cipp-field-source": "backend" }, "DisplayName": { "x-cipp-field-source": "backend" }, "ErrorMessage": { "x-cipp-field-source": "backend" }, "ExtractedAt": { "x-cipp-field-source": "backend" }, "IncompleteCount": { "x-cipp-field-source": "backend" }, "Level": { "x-cipp-field-source": "backend" }, "RequestedAt": { "x-cipp-field-source": "backend" }, "RequestedBy": { "x-cipp-field-source": "backend" }, "Score": { "x-cipp-field-source": "backend" }, "Status": { "x-cipp-field-source": "backend" }, "Tenant": { "x-cipp-field-source": "backend" }, "UserId": { "x-cipp-field-source": "backend" }, "UserPrincipalName": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read", "x-cipp-any-tenant": true } }, "/api/ListBrandingPresets": { "get": { "summary": "ListBrandingPresets", "operationId": "ListBrandingPresets", "tags": [ "Tools > Report-Builder" ], "description": "Lists named report branding presets — colours, logo, cover image, footer and watermark —\nthat a report template can be pointed at instead of the default branding.\n\nRead-only and separate from ExecBrandingSettings on purpose: building a report should not\nrequire the app-settings permission that editing branding does.", "parameters": [ { "name": "includeImages", "in": "query", "description": "Image payloads are large and a picker only needs names and colours, so callers ask for the artwork explicitly.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListBrandingSettings": { "get": { "summary": "ListBrandingSettings", "operationId": "ListBrandingSettings", "tags": [ "CIPP > Settings" ], "description": "Returns the report branding: colours, logo and cover images, footer and watermark text.\n\nBranding was previously returned by ListUserSettings, which put every uploaded cover\ninline on every page load and ran the legacy-image migration - a write - on that read\npath. This read never writes; migration belongs to ExecBrandingSettings -Action Get.\n\nThe role matches ListUserSettings rather than the branding write role, since every user\nwho renders a report needs the branding on it.", "parameters": [ { "name": "includeGallery", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read", "x-cipp-any-tenant": true } }, "/api/ListBreachesAccount": { "get": { "summary": "ListBreachesAccount", "operationId": "ListBreachesAccount", "tags": [ "Tools > Breach-Lookup" ], "description": "Checks an email account or domain against the Have I Been Pwned (HIBP) breach database.", "parameters": [ { "name": "account", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.BreachLookup.Read", "x-cipp-any-tenant": true } }, "/api/ListBreachesTenant": { "get": { "summary": "ListBreachesTenant", "operationId": "ListBreachesTenant", "tags": [ "Tools > Breach-Lookup" ], "description": "Lists cached data breach results for user accounts in a tenant from the CIPP breach monitoring cache.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "breaches": { "x-cipp-field-source": "storage" }, "email": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "password": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "sources": { "x-cipp-field-source": "frontend" }, "sum": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.BreachLookup.Read" } }, "/api/ListCAGapAnalysis": { "get": { "summary": "ListCAGapAnalysis", "operationId": "ListCAGapAnalysis", "tags": [ "Tenant > SecuritySimulations" ], "description": "Conditional Access gap analysis for one tenant from the cached policies: findings, the\npersona-by-control coverage matrix and the 1 to 10 posture score.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "analysis": { "x-cipp-field-source": "backend" }, "analysisError": { "x-cipp-field-source": "backend" }, "licensed": { "x-cipp-field-source": "backend" }, "tenantFilter": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.SecuritySimulations.Read" } }, "/api/ListCalendarPermissions": { "get": { "summary": "ListCalendarPermissions", "operationId": "ListCalendarPermissions", "tags": [ "Email-Exchange > Administration" ], "description": "Lists calendar permissions for mailboxes in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "ByUser", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "AccessRights": { "x-cipp-field-source": "backend" }, "FolderName": { "x-cipp-field-source": "backend" }, "Identity": { "x-cipp-field-source": "backend" }, "MailboxInfo": { "x-cipp-field-source": "backend" }, "User": { "x-cipp-field-source": "backend" }, "UserId": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListCAPolicyCoverage": { "get": { "summary": "ListCAPolicyCoverage", "operationId": "ListCAPolicyCoverage", "tags": [ "Tenant > Conditional" ], "description": "Resolves identity assignment coverage for a single Conditional Access policy: which users\nare touched by includes or exclusions, their net status (covered or excluded), and why\n(users, transitive groups, roles, guests, special tokens). Does not evaluate apps,\nlocations, or sign-in what-if conditions.", "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.Read" } }, "/api/ListCASituations": { "get": { "summary": "ListCASituations", "operationId": "ListCASituations", "tags": [ "Tenant > SecuritySimulations" ], "description": "Evaluates every predefined sign-in situation (admin, user and guest personas under unmanaged\ndevices, foreign locations, legacy clients, device-code flow, risk levels and more) live against the\ntenant's Conditional Access through the What If API, and names the control missing wherever a\nsign-in gets through. Optional adminUserId, userUserId and guestUserId pick the accounts to sign\nin as; country picks where the foreign-country sign-ins come from.", "parameters": [ { "name": "country", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "candidates": { "x-cipp-field-source": "backend" }, "country": { "x-cipp-field-source": "backend" }, "excluded": { "x-cipp-field-source": "backend" }, "identities": { "x-cipp-field-source": "backend" }, "licensed": { "x-cipp-field-source": "backend" }, "situations": { "x-cipp-field-source": "backend" }, "summary": { "x-cipp-field-source": "backend" }, "tenantFilter": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.SecuritySimulations.Read" } }, "/api/ListCAtemplates": { "get": { "summary": "ListCAtemplates", "operationId": "ListCAtemplates", "tags": [ "Tenant > Conditional" ], "description": "Lists saved Conditional Access policy templates for deploying standardized CA configurations.", "parameters": [ { "name": "guid", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "mode", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "displayName": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "label": { "x-cipp-field-source": "backend" }, "Package": { "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage,frontend" }, "SourcePath": { "x-cipp-field-source": "storage" }, "templateCount": { "x-cipp-field-source": "backend" }, "TemplateName": { "x-cipp-field-source": "storage" }, "templates": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "type": { "x-cipp-field-source": "backend" }, "UpdatedBy": { "x-cipp-field-source": "storage" }, "value": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.Read", "x-cipp-any-tenant": true } }, "/api/ListCheckExtAlerts": { "get": { "summary": "ListCheckExtAlerts", "operationId": "ListCheckExtAlerts", "tags": [ "Security > Incidents" ], "description": "Lists extension alert check results from third-party integrations for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "message": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "potentialUserDisplayName": { "type": "string", "x-cipp-field-source": "storage" }, "potentialUserName": { "type": "string", "x-cipp-field-source": "storage" }, "rawBody": { "x-cipp-field-source": "storage" }, "reason": { "type": "string", "x-cipp-field-source": "storage" }, "reportedByIP": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "score": { "type": "string", "x-cipp-field-source": "storage" }, "tenantFilter": { "type": "string", "x-cipp-field-source": "storage" }, "threshold": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "type": { "type": "string", "x-cipp-field-source": "storage" }, "url": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListCippDocs": { "get": { "summary": "Search the CIPP documentation, or fetch one documentation page in full.", "operationId": "ListCippDocs", "tags": [ "CIPP > Core" ], "description": "Searches the GitBook documentation shipped with this build and returns matching sections,\neach with an excerpt and links back to docs.cipp.app and to the file on GitHub. Pages under\nuser-documentation also report the CIPP route they document, so a screen can be traced to\nits docs and back.\n\nPass path on its own to list the pages under a documentation subtree or a CIPP route, or\nwith full=true to return one page's entire text. This backs the SearchDocs and GetDoc MCP\ntools and is available to the UI and API clients on the same terms.", "parameters": [ { "name": "full", "in": "query", "description": "Return the whole page rather than matching sections. Requires path.", "required": false, "schema": { "type": "string" } }, { "name": "limit", "in": "query", "description": "Maximum results to return (default 8, max 25).", "required": false, "schema": { "type": "string" } }, { "name": "path", "in": "query", "description": "A documentation subtree ('user-documentation/identity') or a CIPP route ('/identity/administration/users').", "required": true, "schema": { "type": "string" } }, { "name": "query", "in": "query", "description": "Keywords or a plain-language question, e.g. 'how do I set up GDAP'.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListCippQueue": { "get": { "summary": "ListCippQueue", "operationId": "ListCippQueue", "tags": [ "CIPP > Core" ], "description": "Lists active and recent CIPP background processing queue items and their status.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListCippQueues": { "get": { "summary": "ListCippQueues", "operationId": "ListCippQueues", "tags": [ "CIPP > Core" ], "description": "Lists several CIPP background queues at once and rolls them up into a single progress\nfigure. ListCippQueue reports one queue; this exists for the actions that start several\nat a time - syncing a report that is compiled from more than one cache, for instance -\nwhere the useful answer is \"how far along is the refresh\" rather than the state of each\nindividual queue.\n\nPass QueueIds as a comma-separated list. Each is resolved through Get-CIPPQueueData, so\nthe same data shape and status derivation applies as for a single queue. Ids that no\nlonger exist are reported in MissingQueueIds rather than silently dropped, because a\ncaller polling for completion needs to know the difference between a queue that finished\nand one that was never found.\n\nThe rolled-up Status is the least complete state across the set: anything still running\nkeeps the whole refresh Running, and a failure anywhere is surfaced rather than averaged\naway.", "parameters": [ { "name": "QueueIds", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "CompletedQueues": { "x-cipp-field-source": "backend" }, "CompletedTasks": { "x-cipp-field-source": "backend" }, "FailedQueues": { "x-cipp-field-source": "backend" }, "FailedTasks": { "x-cipp-field-source": "backend" }, "FoundQueues": { "x-cipp-field-source": "backend" }, "IsComplete": { "x-cipp-field-source": "backend" }, "MissingQueueIds": { "x-cipp-field-source": "backend" }, "PercentComplete": { "x-cipp-field-source": "backend" }, "Queues": { "x-cipp-field-source": "backend" }, "RunningQueues": { "x-cipp-field-source": "backend" }, "RunningTasks": { "x-cipp-field-source": "backend" }, "Status": { "x-cipp-field-source": "backend" }, "Summary": { "x-cipp-field-source": "backend" }, "TotalQueues": { "x-cipp-field-source": "backend" }, "TotalTasks": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListCIPPUsers": { "get": { "summary": "ListCIPPUsers", "operationId": "ListCIPPUsers", "tags": [ "CIPP > Settings" ], "description": "Lists CIPP platform users and their role assignments from the allowedUsers table. Requires SuperAdmin access.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read", "x-cipp-any-tenant": true } }, "/api/ListCommunityRepos": { "get": { "summary": "List community repositories in Table Storage", "operationId": "ListCommunityRepos", "tags": [ "Tools > GitHub" ], "description": "This function lists community repositories in Table Storage", "parameters": [ { "name": "WriteAccess", "in": "query", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "BuiltIn": { "x-cipp-field-source": "storage,backend" }, "DefaultBranch": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Description": { "type": "string", "x-cipp-field-source": "storage,backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "FullName": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Id": { "x-cipp-field-source": "backend" }, "Name": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Owner": { "type": "string", "x-cipp-field-source": "storage,backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RepoPermissions": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "TemplateTypes": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UploadBranch": { "x-cipp-field-source": "storage,backend" }, "URL": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Visibility": { "type": "string", "x-cipp-field-source": "storage,backend" }, "WriteAccess": { "type": "boolean", "x-cipp-field-source": "storage,backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.TemplateLibrary.Read", "x-cipp-any-tenant": true } }, "/api/ListCommunityRepoTemplates": { "get": { "summary": "List templates available in community repositories", "operationId": "ListCommunityRepoTemplates", "tags": [ "Tools > GitHub" ], "description": "Builds a catalog of templates across community repositories using a single git tree call\nper repository. Joins against the templates table to flag imported templates and available\nupdates. When a Path is supplied, returns the contents of that single file instead (preview).", "parameters": [ { "name": "Branch", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "FullName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Path", "in": "query", "description": "Preview mode: return the contents of a single file", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.TemplateLibrary.Read", "x-cipp-any-tenant": true } }, "/api/ListCompliancePolicies": { "get": { "summary": "ListCompliancePolicies", "operationId": "ListCompliancePolicies", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune device compliance policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "description": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "lastModifiedDateTime": { "x-cipp-field-source": "frontend" }, "PolicyAssignment": { "x-cipp-field-source": "frontend" }, "PolicyExclude": { "x-cipp-field-source": "frontend" }, "PolicyTypeName": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListConditionalAccessPolicies": { "get": { "summary": "ListConditionalAccessPolicies", "operationId": "ListConditionalAccessPolicies", "tags": [ "Tenant > Conditional" ], "description": "Lists Conditional Access policies for a tenant with resolved display names for users, groups, applications, and locations. When manualPagination is set on an AllTenants read, one page is returned per request with a continuation token in Metadata.nextLink.", "parameters": [ { "name": "manualPagination", "in": "query", "description": "Return one page per request with a continuation token in Metadata.nextLink; AllTenants reads only.", "required": false, "schema": { "type": "string" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { "name": "PageSize", "in": "query", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "builtInControls": { "x-cipp-field-source": "frontend" }, "clientAppTypes": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "excludeApplications": { "x-cipp-field-source": "frontend" }, "excludeGroups": { "x-cipp-field-source": "frontend" }, "excludeLocations": { "x-cipp-field-source": "frontend" }, "excludePlatforms": { "x-cipp-field-source": "frontend" }, "excludeUsers": { "x-cipp-field-source": "frontend" }, "grantControlsOperator": { "x-cipp-field-source": "frontend" }, "includeApplications": { "x-cipp-field-source": "frontend" }, "includeGroups": { "x-cipp-field-source": "frontend" }, "includeLocations": { "x-cipp-field-source": "frontend" }, "includePlatforms": { "x-cipp-field-source": "frontend" }, "includeUsers": { "x-cipp-field-source": "frontend" }, "Metadata": { "x-cipp-field-source": "backend" }, "modifiedDateTime": { "x-cipp-field-source": "frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Policy": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "state": { "x-cipp-field-source": "frontend" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.Read" } }, "/api/ListConditionalAccessPolicyChanges": { "get": { "summary": "ListConditionalAccessPolicyChanges", "operationId": "ListConditionalAccessPolicyChanges", "tags": [ "Tenant > Conditional" ], "description": "Lists audit log entries showing changes to a specific Conditional Access policy, including before/after values.", "parameters": [ { "name": "displayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "activityDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "activityDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "additionalDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "category": { "type": "string", "x-cipp-field-source": "graph-entity" }, "correlationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "initiatedBy": { "type": "object", "x-cipp-field-source": "graph-entity" }, "loggedByService": { "type": "string", "x-cipp-field-source": "graph-entity" }, "operationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "result": { "type": "object", "x-cipp-field-source": "graph-entity" }, "resultReason": { "type": "string", "x-cipp-field-source": "graph-entity" }, "targetResources": { "type": "array", "x-cipp-field-source": "graph-entity" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.Read" } }, "/api/ListConnectionFilter": { "get": { "summary": "ListConnectionFilter", "operationId": "ListConnectionFilter", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists hosted connection filter policies (IP allow/block lists) in Exchange Online Protection.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "EnableSafeList": { "x-cipp-field-source": "frontend" }, "IPAllowList": { "x-cipp-field-source": "frontend" }, "IPBlockList": { "x-cipp-field-source": "frontend" }, "IsDefault": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.ConnectionFilter.Read" } }, "/api/ListConnectionFilterTemplates": { "get": { "summary": "ListConnectionFilterTemplates", "operationId": "ListConnectionFilterTemplates", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists saved connection filter policy templates for Exchange Online Protection.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "EnableSafeList": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "IPAllowList": { "x-cipp-field-source": "frontend" }, "IPBlockList": { "x-cipp-field-source": "frontend" }, "IsDefault": { "x-cipp-field-source": "frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.ConnectionFilter.Read", "x-cipp-any-tenant": true } }, "/api/ListContactPermissions": { "get": { "summary": "ListContactPermissions", "operationId": "ListContactPermissions", "tags": [ "Email-Exchange > Administration" ], "description": "Lists folder-level permissions on a user's Contacts folder in Exchange Online.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "AccessRights": { "x-cipp-field-source": "backend" }, "FolderName": { "x-cipp-field-source": "backend" }, "Identity": { "x-cipp-field-source": "backend" }, "MailboxInfo": { "x-cipp-field-source": "backend" }, "User": { "x-cipp-field-source": "backend" }, "UserId": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListContacts": { "get": { "summary": "ListContacts", "operationId": "ListContacts", "tags": [ "Email-Exchange > Administration > Contacts" ], "description": "Lists Exchange Online mail contacts for a tenant, with optional filtering by contact ID for detailed view.", "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "City": { "x-cipp-field-source": "backend" }, "Company": { "x-cipp-field-source": "backend,frontend" }, "Department": { "type": "string", "x-cipp-field-source": "graph,backend" }, "DisplayName": { "type": "string", "x-cipp-field-source": "graph,backend,frontend" }, "FirstName": { "x-cipp-field-source": "backend" }, "Guid": { "x-cipp-field-source": "backend" }, "IsDirSynced": { "x-cipp-field-source": "backend,frontend" }, "LastName": { "x-cipp-field-source": "backend" }, "WindowsEmailAddress": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.Read" } }, "/api/ListContactTemplates": { "get": { "summary": "ListContactTemplates", "operationId": "ListContactTemplates", "tags": [ "Email-Exchange > Administration > Contacts" ], "description": "Lists saved mail contact templates used for creating new Exchange contacts.", "parameters": [ { "name": "ID", "in": "query", "description": "Check if a specific template ID is requested", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "companyName": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "displayName": { "x-cipp-field-source": "frontend" }, "email": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "hidefromGAL": { "x-cipp-field-source": "frontend" }, "jobTitle": { "x-cipp-field-source": "frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.Read", "x-cipp-any-tenant": true } }, "/api/ListContainerLogs": { "get": { "summary": "ListContainerLogs", "operationId": "ListContainerLogs", "tags": [ "CIPP > Settings" ], "description": "Retrieves container logs for the CIPP backend process. Requires SuperAdmin access. Supports ReadLog, ListFiles, and snapshot actions.", "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "GetInfo", "ListFiles", "Query", "ReadLog", "SearchAll" ] } }, { "name": "Exclude", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "File", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "From", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Level", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Query", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "Regex", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Search", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SortDesc", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Tail", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "To", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read", "x-cipp-any-tenant": true } }, "/api/ListCopilotSettings": { "get": { "summary": "ListCopilotSettings", "operationId": "ListCopilotSettings", "tags": [ "Tenant > AI" ], "description": "Lists the Microsoft 365 Copilot admin policy settings for a tenant, one row per setting,\nwith the current raw value and a friendly state (Enabled / Disabled / Not configured).", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "setting": { "x-cipp-field-source": "backend,frontend" }, "settingId": { "x-cipp-field-source": "backend" }, "state": { "x-cipp-field-source": "backend,frontend" }, "value": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.Read" } }, "/api/ListCopilotUsage": { "get": { "summary": "ListCopilotUsage", "operationId": "ListCopilotUsage", "tags": [ "Tenant > AI" ], "description": "Returns Microsoft 365 Copilot usage reports for a tenant, flattened into table rows.\nType=Adoption -> getMicrosoft365CopilotUserCountSummary (per-product enabled vs active users)\nType=Trend -> getMicrosoft365CopilotUserCountTrend (per-date active/enabled users)\nType=UserDetail-> getMicrosoft365CopilotUsageUserDetail (per-user last activity per app)", "parameters": [ { "name": "period", "in": "query", "description": "Prefer D30 (Copilot reports v1). Some tenants are already on v2, which rejects D30 (as RL30) and wants D28 (RL28) instead. Get-CopilotReportPeriod falls back on that Graph error.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "activeUsers": { "x-cipp-field-source": "backend" }, "anyAppActive": { "x-cipp-field-source": "backend" }, "anyAppEnabled": { "x-cipp-field-source": "backend" }, "copilotChat": { "x-cipp-field-source": "backend" }, "copilotChatActive": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend" }, "enabledUsers": { "x-cipp-field-source": "backend" }, "excel": { "x-cipp-field-source": "backend" }, "excelActive": { "x-cipp-field-source": "backend" }, "lastActivityDate": { "x-cipp-field-source": "backend" }, "loop": { "x-cipp-field-source": "backend" }, "loopActive": { "x-cipp-field-source": "backend" }, "oneNote": { "x-cipp-field-source": "backend" }, "oneNoteActive": { "x-cipp-field-source": "backend" }, "outlook": { "x-cipp-field-source": "backend" }, "outlookActive": { "x-cipp-field-source": "backend" }, "powerPoint": { "x-cipp-field-source": "backend" }, "powerPointActive": { "x-cipp-field-source": "backend" }, "product": { "x-cipp-field-source": "backend" }, "reportDate": { "x-cipp-field-source": "backend" }, "teams": { "x-cipp-field-source": "backend" }, "teamsActive": { "x-cipp-field-source": "backend" }, "userPrincipalName": { "x-cipp-field-source": "backend" }, "word": { "x-cipp-field-source": "backend" }, "wordActive": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.Read" } }, "/api/ListCSPLicenses": { "get": { "summary": "ListCSPLicenses", "operationId": "ListCSPLicenses", "tags": [ "Tenant > Reports" ], "description": "Lists CSP (Cloud Solution Provider) license subscriptions for a tenant via the Sherweb integration.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "commitmentTerm.renewalConfiguration.renewalDate": { "x-cipp-field-source": "frontend" }, "productName": { "x-cipp-field-source": "frontend" }, "purchaseDate": { "x-cipp-field-source": "frontend" }, "quantity": { "x-cipp-field-source": "frontend" }, "sku": { "x-cipp-field-source": "frontend" }, "TermInfo": { "x-cipp-field-source": "frontend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListCSPsku": { "get": { "summary": "ListCSPsku", "operationId": "ListCSPsku", "tags": [ "Tenant > Reports" ], "description": "Lists available CSP SKUs and current subscriptions for a tenant via the Sherweb integration.", "parameters": [ { "name": "currentSkuOnly", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "name": { "x-cipp-field-source": "backend" }, "sku": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListCustomDataMappings": { "get": { "summary": "ListCustomDataMappings", "operationId": "ListCustomDataMappings", "tags": [ "CIPP > Core" ], "description": "Lists custom data mappings that define how external data sources map to CIPP directory objects, filterable by source type, directory object, and tenant.", "parameters": [ { "name": "directoryObject", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "sourceType", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "customDataAttribute": { "x-cipp-field-source": "backend" }, "dataset": { "x-cipp-field-source": "backend" }, "directoryObject": { "x-cipp-field-source": "backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "id": { "x-cipp-field-source": "backend" }, "JSON": { "type": "string", "x-cipp-field-source": "storage" }, "manualEntryFieldLabel": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "sourceType": { "x-cipp-field-source": "backend" }, "syncProperty": { "x-cipp-field-source": "backend" }, "tenant": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListCustomRole": { "get": { "summary": "ListCustomRole", "operationId": "ListCustomRole", "tags": [ "CIPP > Settings" ], "description": "Lists custom RBAC roles defined in CIPP, including their permission sets and associated access role groups.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListCustomScripts": { "get": { "summary": "ListCustomScripts", "operationId": "ListCustomScripts", "tags": [ "Tools > Custom-Scripts" ], "description": "Lists custom PowerShell scripts stored in CIPP, with optional filtering by script GUID and version history.", "parameters": [ { "name": "IncludeAllVersions", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ScriptGuid", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AlertOnFailure": { "x-cipp-field-source": "storage" }, "AlertStatuses": { "x-cipp-field-source": "storage" }, "Category": { "x-cipp-field-source": "storage" }, "CreatedBy": { "x-cipp-field-source": "storage" }, "CreatedDate": { "x-cipp-field-source": "storage" }, "Description": { "x-cipp-field-source": "storage" }, "Enabled": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ImplementationEffort": { "x-cipp-field-source": "storage" }, "MarkdownTemplate": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Pillar": { "x-cipp-field-source": "storage" }, "ResultMode": { "x-cipp-field-source": "storage" }, "ResultSchema": { "x-cipp-field-source": "storage" }, "ReturnType": { "x-cipp-field-source": "storage" }, "Risk": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "ScriptContent": { "x-cipp-field-source": "storage" }, "ScriptGuid": { "x-cipp-field-source": "storage" }, "ScriptName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UserImpact": { "x-cipp-field-source": "storage" }, "Version": { "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Tests.Read", "x-cipp-any-tenant": true } }, "/api/ListCustomVariables": { "get": { "summary": "ListCustomVariables", "operationId": "ListCustomVariables", "tags": [ "CIPP > Settings" ], "description": "Lists custom variables configured in CIPP for use in templates and automation.", "parameters": [ { "name": "allTenants", "in": "query", "description": "A template is not bound to a tenant - the same template deploys to many, and each variable in it resolves against whichever tenant it lands on. So a caller editing one needs every variable *name* that exists anywhere, not the set belonging to whichever tenant happens to be selected. Values are deliberately not returned here: they differ per tenant, so there is no single correct one to show.", "required": false, "schema": { "type": "boolean" } }, { "name": "excludeGlobalReserved", "in": "query", "description": "Filter out global reserved variables if requested (for tenant group rules) These variables are the same for all tenants so they're not useful for grouping", "required": false, "schema": { "type": "boolean" } }, { "name": "includeSystem", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Description": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Value": { "x-cipp-field-source": "storage" }, "VariableType": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListCVEManagement": { "get": { "summary": "ListCVEManagement", "operationId": "ListCVEManagement", "tags": [ "Endpoint > MEM" ], "description": "Lists CVEs affecting a tenant's devices, from Defender threat and vulnerability management, along with any exceptions recorded in CIPP. AllTenants and UseReportDB=true read the cached report database instead of Defender directly, because the live path can only query one tenant per request.", "parameters": [ { "name": "tenantFilter", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Security.Read", "x-cipp-any-tenant": true } }, "/api/ListDBCache": { "get": { "summary": "ListDBCache", "operationId": "ListDBCache", "tags": [ "CIPP > Core" ], "description": "Retrieves cached tenant data from the CIPP reporting database (CippReportingDB). This is the fastest\nand most efficient way to query tenant data across single or multiple tenants. The database is populated\nnightly by background cache jobs, so data is typically at most 24 hours old.\n\nRequired query parameters:\n - tenantFilter: The tenant domain or 'AllTenants' to query all managed tenants.\n\nOptional query parameters:\n - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).\n Omit it (or pass type=_availableTypes) to get the list of collections for the tenant\n instead of records; it is also not needed when countsOnly=true.\n - countsOnly: When 'true', returns one row per tenant per collection containing only the record\n count and the time that collection was last cached. This reads the pre-computed\n '-Count' rows, so it is a single table query regardless of tenant count and\n never materializes the underlying records. Combine with tenantFilter=AllTenants to\n get an estate-wide inventory and per-tenant cache freshness in one call. Pass a\n type alongside it to restrict the result to a single collection.\n - select: Comma-separated list of top-level fields to keep on each record (e.g.\n select=id,displayName,userPrincipalName). Everything else is dropped during parse,\n shrinking the response. A kept field keeps its ENTIRE subtree, so select=conditions\n keeps conditions.users.includeRoles too; projection never reaches inside a kept\n value. The owning Tenant is always stamped on each record regardless of select.\n - top: Return at most this many records. For tenantFilter=AllTenants this is a GLOBAL cap\n across all tenants when ungrouped, so use it to sample rather than to page. When\n groupBy=Tenant is also set, top instead caps the records within each tenant bucket.\n - latestOnly: When 'true', keep only the newest record per tenant, ranked by dateField (or\n an auto-detected date field such as createdDateTime). Collapses per-day\n snapshot types like SecureScore to one current row per tenant.\n - groupBy: Set to 'Tenant' to return one bucket per tenant as\n { Tenant, Count, Records } objects instead of a flat record list.\n - dateField: The record field latestOnly ranks by. Omit to auto-detect.\n\nUse type=_shape for every collection's row count and fields (recorded when the cache was written).\nUse type=_availableTypes to discover which cache collections exist for a given tenant. Omitting the\ntype parameter also returns the available types.\n\nPERFORMANCE GUIDANCE: For AllTenants queries or any bulk/cross-tenant data retrieval, prefer\nListDBCache over calling individual endpoints (e.g. ListUsers, ListGroups, ListMailboxes) directly.\nIndividual endpoints make live API calls per tenant which is significantly slower and may hit\nthrottling limits. ListDBCache reads pre-cached data from Azure Table Storage and returns results\nin seconds regardless of tenant count.\n\nNote that tenantFilter=AllTenants WITH a type performs a cross-partition scan and materializes every\nrecord of that collection across every tenant, so it grows with the size of the estate. Where only\ntotals are needed, countsOnly=true is dramatically cheaper and should always be preferred.\n\nRecommended workflow for MCP tool selection:\n 1. Call ListDBCache with type=_availableTypes to discover available cache collections.\n 2. If the data you need exists as a cache type, use ListDBCache with that type.\n 3. Only fall back to individual List* endpoints when you need real-time data for a single tenant\n or when the data is not available in the cache.\n\nCommon cache types include: Users, Groups, Mailboxes, Devices, ConditionalAccess, Applications,\nIntunePolicy, CompliancePolicy, and many more. The exact set depends on what has been configured.", "parameters": [ { "name": "countsOnly", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "dateField", "in": "query", "description": "The record date field latestOnly ranks by. Omit to auto-detect (createdDateTime, lastRefresh, etc).", "required": false, "schema": { "type": "string" } }, { "name": "groupBy", "in": "query", "description": "Group the result into one bucket per tenant. Only 'Tenant' is supported.", "required": false, "schema": { "type": "string" } }, { "name": "latestOnly", "in": "query", "description": "When true, keep only the newest record per tenant (by dateField, or an auto-detected date field). Collapses e.g. SecureScore's per-day snapshots to one current row per tenant.", "required": false, "schema": { "type": "boolean" } }, { "name": "select", "in": "query", "description": "Comma-separated list of top-level fields to keep on each record; everything else is dropped during parse. A kept field keeps its ENTIRE subtree (e.g. select=conditions keeps conditions.users.includeRoles). The Tenant stamp is always preserved. Omit to return all fields.", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "top", "in": "query", "description": "Return at most this many records. For AllTenants this is a global cap across all tenants, unless groupBy=Tenant is set, in which case it caps records within each tenant bucket.", "required": false, "schema": { "type": "integer" } }, { "name": "type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListDefenderState": { "get": { "summary": "ListDefenderState", "operationId": "ListDefenderState", "tags": [ "Endpoint > MEM" ], "description": "Lists Microsoft Defender antivirus state and detected threats for Intune-managed devices in a tenant.", "parameters": [ { "name": "DeviceID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aadRegistered": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "activationLockBypassCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "androidSecurityPatchLevel": { "type": "string", "x-cipp-field-source": "graph-entity" }, "autopilotEnrolled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "azureActiveDirectoryDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureADDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureADRegistered": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "bootstrapTokenEscrowed": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "chassisType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "chromeOSDeviceInfo": { "type": "array", "x-cipp-field-source": "graph-entity" }, "cloudPcRemoteActionResults": { "type": "array", "x-cipp-field-source": "graph-entity" }, "complianceGracePeriodExpirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "complianceState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "configurationManagerClientEnabledFeatures": { "type": "object", "x-cipp-field-source": "graph-entity" }, "configurationManagerClientHealthState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "configurationManagerClientInformation": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceActionResults": { "type": "array", "x-cipp-field-source": "graph-entity" }, "deviceCategoryDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceFirmwareConfigurationInterfaceManaged": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "deviceHealthAttestationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "deviceRegistrationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "easActivated": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "easActivationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "easDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "emailAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrolledByUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrolledDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrollmentProfileName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ethernetMacAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "exchangeAccessState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "exchangeAccessStateReason": { "type": "object", "x-cipp-field-source": "graph-entity" }, "exchangeLastSuccessfulSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "freeStorageSpaceInBytes": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "hardwareInformation": { "type": "object", "x-cipp-field-source": "graph-entity" }, "iccid": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imei": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isEncrypted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSupervised": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jailBroken": { "type": "string", "x-cipp-field-source": "graph-entity" }, "joinType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "lastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lostModeState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managedDeviceName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managedDeviceOwnerType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managementAgent": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managementCertificateExpirationDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managementFeatures": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managementState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "manufacturer": { "type": "string", "x-cipp-field-source": "graph-entity" }, "meid": { "type": "string", "x-cipp-field-source": "graph-entity" }, "model": { "type": "string", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "operatingSystem": { "type": "string", "x-cipp-field-source": "graph-entity" }, "osVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ownerType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "partnerReportedThreatState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "phoneNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "physicalMemoryInBytes": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "preferMdmOverGroupPolicyAppliedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "processorArchitecture": { "type": "object", "x-cipp-field-source": "graph-entity" }, "remoteAssistanceSessionErrorDetails": { "type": "string", "x-cipp-field-source": "graph-entity" }, "remoteAssistanceSessionUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "requireUserEnrollmentApproval": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "retireAfterDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityPatchLevel": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serialNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skuFamily": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skuNumber": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "specificationVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "subscriberCarrier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "totalStorageSpaceInBytes": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "udid": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usersLoggedOn": { "type": "array", "x-cipp-field-source": "graph-entity" }, "wiFiMacAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "windowsActiveMalwareCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "windowsProtectionState.deviceState": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.fullScanOverdue": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.lastReportedDateTime": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.malwareProtectionEnabled": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.networkInspectionSystemEnabled": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.quickScanOverdue": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.realTimeProtectionEnabled": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.rebootRequired": { "x-cipp-field-source": "frontend" }, "windowsProtectionState.signatureUpdateOverdue": { "x-cipp-field-source": "frontend" }, "windowsRemediatedMalwareCount": { "type": "integer", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListDefenderTVM": { "get": { "summary": "ListDefenderTVM", "operationId": "ListDefenderTVM", "tags": [ "Endpoint > MEM" ], "description": "Lists software vulnerabilities from Microsoft Defender Threat and Vulnerability Management (TVM), grouped by CVE ID.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "affectedDevices": { "x-cipp-field-source": "frontend" }, "affectedDevicesCount": { "x-cipp-field-source": "frontend" }, "cveId": { "x-cipp-field-source": "frontend" }, "cvssScore": { "x-cipp-field-source": "frontend" }, "exploitabilityLevel": { "x-cipp-field-source": "frontend" }, "osPlatform": { "x-cipp-field-source": "frontend" }, "securityUpdateAvailable": { "x-cipp-field-source": "frontend" }, "softwareName": { "x-cipp-field-source": "frontend" }, "softwareVendor": { "x-cipp-field-source": "frontend" }, "vulnerabilitySeverityLevel": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListDeletedItems": { "get": { "summary": "ListDeletedItems", "operationId": "ListDeletedItems", "tags": [ "Identity > Administration > Users" ], "description": "Lists soft-deleted directory objects in Entra ID, including users, groups, applications, service principals, and administrative units.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListDeletedSites": { "get": { "summary": "ListDeletedSites", "operationId": "ListDeletedSites", "tags": [ "Teams-Sharepoint" ], "description": "Lists deleted SharePoint sites still restorable from the tenant recycle bin, via the\nSharePoint admin CSOM API.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListDetectedAppDevices": { "get": { "summary": "ListDetectedAppDevices", "operationId": "ListDetectedAppDevices", "tags": [ "Endpoint > Applications" ], "description": "Lists Intune-managed devices that have a specific detected application installed, identified by App ID.", "parameters": [ { "name": "AppID", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "deviceCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "platform": { "type": "object", "x-cipp-field-source": "graph-entity" }, "publisher": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sizeInByte": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "version": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Device.Read" } }, "/api/ListDetectedApps": { "get": { "summary": "ListDetectedApps", "operationId": "ListDetectedApps", "tags": [ "Endpoint > Applications" ], "description": "Lists applications detected on Intune-managed devices in a tenant, optionally including device associations.", "parameters": [ { "name": "DeviceID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "includeDevices", "in": "query", "description": "Also return the devices each detected app is installed on.", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Device.Read" } }, "/api/ListDeviceDetails": { "get": { "summary": "ListDeviceDetails", "operationId": "ListDeviceDetails", "tags": [ "Endpoint > MEM" ], "description": "Retrieves detailed information about a specific Intune-managed device by ID, name, or serial number.", "parameters": [ { "name": "DeviceID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "DeviceName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "DeviceSerial", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "description": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend" }, "id": { "type": "string", "x-cipp-field-source": "graph,backend" }, "state": { "x-cipp-field-source": "backend" }, "UserPrincipalName": { "type": "string", "x-cipp-field-source": "graph,backend" }, "version": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Device.Read" } }, "/api/ListDevices": { "get": { "summary": "ListDevices", "operationId": "ListDevices", "tags": [ "Endpoint > Reports" ], "description": "Lists Intune-managed devices for a tenant, including device compliance and configuration status.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aadRegistered": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "activationLockBypassCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "androidSecurityPatchLevel": { "type": "string", "x-cipp-field-source": "graph-entity" }, "autopilotEnrolled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "azureActiveDirectoryDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureADDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "azureADRegistered": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "bootstrapTokenEscrowed": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "chassisType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "chromeOSDeviceInfo": { "type": "array", "x-cipp-field-source": "graph-entity" }, "cloudPcRemoteActionResults": { "type": "array", "x-cipp-field-source": "graph-entity" }, "complianceGracePeriodExpirationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "complianceState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "configurationManagerClientEnabledFeatures": { "type": "object", "x-cipp-field-source": "graph-entity" }, "configurationManagerClientHealthState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "configurationManagerClientInformation": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceActionResults": { "type": "array", "x-cipp-field-source": "graph-entity" }, "deviceCategoryDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceFirmwareConfigurationInterfaceManaged": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "deviceHealthAttestationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceRegistrationState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "easActivated": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "easActivationDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "easDeviceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "emailAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrolledByUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrolledDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "enrollmentProfileName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ethernetMacAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "exchangeAccessState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "exchangeAccessStateReason": { "type": "object", "x-cipp-field-source": "graph-entity" }, "exchangeLastSuccessfulSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "freeStorageSpaceInBytes": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "hardwareInformation": { "type": "object", "x-cipp-field-source": "graph-entity" }, "iccid": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imei": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isEncrypted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSupervised": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jailBroken": { "type": "string", "x-cipp-field-source": "graph-entity" }, "joinType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "lastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lostModeState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managedDeviceName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managedDeviceOwnerType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managementAgent": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managementCertificateExpirationDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managementFeatures": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managementState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "manufacturer": { "type": "string", "x-cipp-field-source": "graph-entity" }, "meid": { "type": "string", "x-cipp-field-source": "graph-entity" }, "model": { "type": "string", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "operatingSystem": { "type": "string", "x-cipp-field-source": "graph-entity" }, "osVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ownerType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "partnerReportedThreatState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "phoneNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "physicalMemoryInBytes": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "preferMdmOverGroupPolicyAppliedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "processorArchitecture": { "type": "object", "x-cipp-field-source": "graph-entity" }, "remoteAssistanceSessionErrorDetails": { "type": "string", "x-cipp-field-source": "graph-entity" }, "remoteAssistanceSessionUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "requireUserEnrollmentApproval": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "retireAfterDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityPatchLevel": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serialNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skuFamily": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skuNumber": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "specificationVersion": { "type": "string", "x-cipp-field-source": "graph-entity" }, "subscriberCarrier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "totalStorageSpaceInBytes": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "udid": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usersLoggedOn": { "type": "array", "x-cipp-field-source": "graph-entity" }, "wiFiMacAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "windowsActiveMalwareCount": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "windowsRemediatedMalwareCount": { "type": "integer", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Device.Read" } }, "/api/ListDiagnosticsPresets": { "get": { "summary": "ListDiagnosticsPresets", "operationId": "ListDiagnosticsPresets", "tags": [ "CIPP > Core" ], "description": "Lists saved diagnostics presets used for troubleshooting CIPP configuration. Requires SuperAdmin access.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "data": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "backend" }, "name": { "type": "string", "x-cipp-field-source": "storage,backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "query": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read" } }, "/api/ListDirectoryObjects": { "post": { "summary": "ListDirectoryObjects", "operationId": "ListDirectoryObjects", "tags": [ "CIPP > Core" ], "description": "Resolves Entra ID directory objects by their IDs using the directoryObjects/getByIds batch endpoint. Accepts an array of object IDs in the request body.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "$select": { "type": "string" }, "asApp": { "type": "string" }, "ids": { "type": "string" }, "partnerLookup": { "type": "string", "description": "AnyTenant: enforce tenant scope here; Get-Tenants is narrowed to the caller's allowed tenants" }, "tenantFilter": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListDlpCompliancePolicy": { "get": { "summary": "ListDlpCompliancePolicy", "operationId": "ListDlpCompliancePolicy", "tags": [ "Security > Compliance-DLP" ], "description": "Lists Data Loss Prevention (DLP) compliance policies and their associated rules from the Security & Compliance Center.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AssociatedRules": { "x-cipp-field-source": "backend" }, "CreatedBy": { "x-cipp-field-source": "frontend" }, "Enabled": { "x-cipp-field-source": "frontend" }, "Mode": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "RuleCount": { "x-cipp-field-source": "backend,frontend" }, "WhenChangedUTC": { "x-cipp-field-source": "frontend" }, "WhenCreatedUTC": { "x-cipp-field-source": "frontend" }, "Workload": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.Read" } }, "/api/ListDlpCompliancePolicyTemplates": { "get": { "summary": "ListDlpCompliancePolicyTemplates", "operationId": "ListDlpCompliancePolicyTemplates", "tags": [ "Security > Compliance-DLP" ], "description": "Lists saved DLP compliance policy templates for deploying standardized DLP configurations.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "comments": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "Enabled": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "Mode": { "x-cipp-field-source": "frontend" }, "name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" }, "Workload": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.Read", "x-cipp-any-tenant": true } }, "/api/ListDomainAnalyser": { "get": { "summary": "ListDomainAnalyser", "operationId": "ListDomainAnalyser", "tags": [ "Tenant > Standards" ], "description": "Lists domain analysis results (SPF, DKIM, DMARC, DNSSEC) for tenant domains.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "DKIMEnabled": { "x-cipp-field-source": "frontend" }, "DMARCActionPolicy": { "x-cipp-field-source": "frontend" }, "DMARCPercentagePass": { "x-cipp-field-source": "frontend" }, "DMARCPresent": { "x-cipp-field-source": "frontend" }, "DNSSECPresent": { "x-cipp-field-source": "frontend" }, "Domain": { "x-cipp-field-source": "frontend" }, "EnterpriseEnrollment": { "x-cipp-field-source": "frontend" }, "EnterpriseRegistration": { "x-cipp-field-source": "frontend" }, "MailProvider": { "x-cipp-field-source": "frontend" }, "MXPassTest": { "x-cipp-field-source": "frontend" }, "ScorePercentage": { "x-cipp-field-source": "frontend" }, "SPFPassAll": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.DomainAnalyser.Read" } }, "/api/ListDomainHealth": { "get": { "summary": "ListDomainHealth", "operationId": "ListDomainHealth", "tags": [ "Tenant > Standards" ], "description": "Performs real-time DNS health checks (MX, SPF, DMARC, DKIM, DNSSEC, MTA-STS, HTTPS) for a specific domain.", "parameters": [ { "name": "Action", "in": "query", "description": "The DNS check to run. Without it there is nothing to dispatch on, so reject rather than fall through and return an empty body that reads like \"no findings\".", "required": true, "schema": { "type": "string", "enum": [ "GetDkimSelectors", "ListDomainInfo", "ReadAutoDiscover", "ReadDkimRecord", "ReadDmarcPolicy", "ReadMXRecord", "ReadNSRecord", "ReadSpfRecord", "ReadWhoisRecord", "TestDNSSEC", "TestHttpsCertificate", "TestMtaSts" ] } }, { "name": "Domain", "in": "query", "description": "The domain every check resolves against.", "required": true, "schema": { "type": "string" } }, { "name": "ExpectedInclude", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ExpectedTarget", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Record", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Selector", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Subdomains", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.DomainAnalyser.Read", "x-cipp-any-tenant": true } }, "/api/ListDomains": { "get": { "summary": "ListDomains", "operationId": "ListDomains", "tags": [ "Tenant > Administration > Domains" ], "description": "Lists verified domains for a tenant, showing default and initial domain status.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "id": { "type": "string", "x-cipp-field-source": "graph,backend" }, "isdefault": { "type": "boolean", "x-cipp-field-source": "graph,backend" }, "isinitial": { "type": "boolean", "x-cipp-field-source": "graph,backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListEmptyResults": { "get": { "summary": "- Purposely lists an empty result", "operationId": "ListEmptyResults", "tags": [ "CIPP > Core" ], "description": "Returns an empty results array. Used as a placeholder endpoint.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListEquipment": { "get": { "summary": "ListEquipment", "operationId": "ListEquipment", "tags": [ "Email-Exchange > Resources" ], "description": "Lists equipment mailboxes (projectors, vehicles, etc.) in Exchange Online for a tenant.", "parameters": [ { "name": "EquipmentId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "allowConflicts": { "x-cipp-field-source": "backend" }, "allowRecurringMeetings": { "x-cipp-field-source": "backend" }, "automateProcessing": { "x-cipp-field-source": "backend" }, "bookingWindowInDays": { "x-cipp-field-source": "backend" }, "city": { "x-cipp-field-source": "backend" }, "company": { "x-cipp-field-source": "backend" }, "countryOrRegion": { "x-cipp-field-source": "backend" }, "department": { "x-cipp-field-source": "backend" }, "DisplayName": { "x-cipp-field-source": "backend,frontend" }, "forwardRequestsToDelegates": { "x-cipp-field-source": "backend" }, "HiddenFromAddressListsEnabled": { "x-cipp-field-source": "backend,frontend" }, "maximumDurationInMinutes": { "x-cipp-field-source": "backend" }, "phone": { "x-cipp-field-source": "backend" }, "postalCode": { "x-cipp-field-source": "backend" }, "PrimarySmtpAddress": { "x-cipp-field-source": "backend,frontend" }, "processExternalMeetingMessages": { "x-cipp-field-source": "backend" }, "scheduleOnlyDuringWorkHours": { "x-cipp-field-source": "backend" }, "state": { "x-cipp-field-source": "backend" }, "street": { "x-cipp-field-source": "backend" }, "tags": { "x-cipp-field-source": "backend" }, "UserPrincipalName": { "x-cipp-field-source": "backend,frontend" }, "workDays": { "x-cipp-field-source": "backend" }, "workHoursEndTime": { "x-cipp-field-source": "backend" }, "workHoursStartTime": { "x-cipp-field-source": "backend" }, "workingHoursTimeZone": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Equipment.Read" } }, "/api/ListExchangeConnectors": { "get": { "summary": "ListExchangeConnectors", "operationId": "ListExchangeConnectors", "tags": [ "Email-Exchange > Transport" ], "description": "Lists inbound and outbound mail flow connectors configured in Exchange Online.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "cippconnectortype": { "x-cipp-field-source": "backend,frontend" }, "Comment": { "x-cipp-field-source": "frontend" }, "Enabled": { "x-cipp-field-source": "frontend" }, "IsTransportRuleScoped": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "SenderIPAddresses": { "x-cipp-field-source": "frontend" }, "SmartHosts": { "x-cipp-field-source": "frontend" }, "TlsDomain": { "x-cipp-field-source": "frontend" }, "TlsSenderCertificateName": { "x-cipp-field-source": "frontend" }, "TlsSettings": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.Read" } }, "/api/ListExcludedLicenses": { "get": { "summary": "ListExcludedLicenses", "operationId": "ListExcludedLicenses", "tags": [ "CIPP > Settings" ], "description": "Lists license SKUs that have been excluded from CIPP license counts and reporting.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExcludedEverywhere": { "x-cipp-field-source": "storage" }, "ExclusionType": { "x-cipp-field-source": "frontend" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Product_Display_Name": { "x-cipp-field-source": "storage,frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "ShowInLicenseDropdown": { "x-cipp-field-source": "frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read" } }, "/api/ListExConnectorTemplates": { "get": { "summary": "ListExConnectorTemplates", "operationId": "ListExConnectorTemplates", "tags": [ "Email-Exchange > Transport" ], "description": "Lists saved Exchange connector templates for creating inbound/outbound connectors.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "cippconnectortype": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.Read", "x-cipp-any-tenant": true } }, "/api/ListExoRequest": { "post": { "summary": "ListExoRequest", "operationId": "ListExoRequest", "tags": [ "Email-Exchange > Tools" ], "description": "Executes an arbitrary read-only Exchange Online cmdlet (Get-* or Search-*) for a tenant. Accepts cmdlet name and parameters in the request body.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Anchor": { "type": "string" }, "AsApp": { "type": "boolean" }, "AvailableCmdlets": { "type": "string" }, "Cmdlet": { "type": "string" }, "cmdParams": { "type": "object", "description": "Parameters to splat onto the Exchange cmdlet, as an object of name/value pairs (e.g. { \"Identity\": \"user@contoso.com\" }). Cast to an object so the generated schema types cmdParams as an object rather than a string - a string-typed schema made the client reject an object body, leaving no way to pass parameters." }, "Compliance": { "type": "boolean" }, "Select": { "type": "string" }, "TenantFilter": { "type": "string" }, "UseSystemMailbox": { "type": "boolean" } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Cmdlet": { "x-cipp-field-source": "backend,frontend" }, "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListExtensionCacheData": { "get": { "summary": "List Extension Cache Data", "operationId": "ListExtensionCacheData", "tags": [ "CIPP > Core" ], "description": "This function is used to list the extension cache data.", "parameters": [ { "name": "dataTypes", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListExtensionsConfig": { "get": { "summary": "ListExtensionsConfig", "operationId": "ListExtensionsConfig", "tags": [ "CIPP > Extensions" ], "description": "Lists the current CIPP extension configuration, including settings for HaloPSA, NinjaOne, Hudu, and other integrations.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "config": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.Read", "x-cipp-any-tenant": true } }, "/api/ListExtensionSync": { "get": { "summary": "ListExtensionSync", "operationId": "ListExtensionSync", "tags": [ "CIPP > Extensions" ], "description": "Lists extension synchronization tasks and their status, including last sync results for configured third-party integrations (Hudu, Halo, NinjaOne, etc.).", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AdditionalProperties": { "type": "string", "x-cipp-field-source": "storage" }, "AlertComment": { "type": "string", "x-cipp-field-source": "storage" }, "Command": { "type": "string", "x-cipp-field-source": "storage" }, "CustomSubject": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "excludedTenantGroups": { "type": "string", "x-cipp-field-source": "storage" }, "excludedTenants": { "type": "string", "x-cipp-field-source": "storage" }, "ExecutedTime": { "x-cipp-field-source": "storage,frontend" }, "Hidden": { "type": "boolean", "x-cipp-field-source": "storage" }, "Name": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Parameters": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "PostExecution": { "type": "string", "x-cipp-field-source": "storage" }, "PsaTicketId": { "type": "string", "x-cipp-field-source": "storage" }, "PsaTicketPriority": { "type": "string", "x-cipp-field-source": "storage" }, "PsaTicketStrategy": { "type": "string", "x-cipp-field-source": "storage" }, "Recurrence": { "type": "string", "x-cipp-field-source": "storage" }, "Reference": { "type": "string", "x-cipp-field-source": "storage" }, "RepeatsEvery": { "x-cipp-field-source": "frontend" }, "Results": { "x-cipp-field-source": "storage,frontend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "ScheduledTime": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "SyncType": { "x-cipp-field-source": "storage,frontend" }, "TaskState": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Trigger": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.Read", "x-cipp-any-tenant": true } }, "/api/ListExternalTenantInfo": { "get": { "summary": "ListExternalTenantInfo", "operationId": "ListExternalTenantInfo", "tags": [ "Tenant > Administration > Tenant" ], "description": "Looks up publicly available tenant information for an external Entra ID tenant by domain or tenant ID.", "parameters": [ { "name": "tenant", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListFeatureFlags": { "get": { "summary": "ListFeatureFlags", "operationId": "ListFeatureFlags", "tags": [ "CIPP > Core" ], "description": "Lists CIPP feature flags and their enabled/disabled state, including environment-driven overrides.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Description": { "x-cipp-field-source": "frontend" }, "Enabled": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListFunctionParameters": { "get": { "summary": "ListFunctionParameters", "operationId": "ListFunctionParameters", "tags": [ "CIPP > Scheduler" ], "description": "Lists the CIPP PowerShell functions that can be run from the scheduler, with each one's parameters and help text. Filter with Module or Function. Internal and entrypoint functions are excluded, so this is the set of commands a scheduled task may call.", "parameters": [ { "name": "Compliance", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "Function", "in": "query", "required": false, "schema": { "type": "object", "properties": { "Name": { "type": "string" }, "Parameters": { "type": "string" } } } }, { "name": "Module", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Description": { "x-cipp-field-source": "backend" }, "Function": { "x-cipp-field-source": "backend" }, "Functionality": { "x-cipp-field-source": "backend" }, "Name": { "x-cipp-field-source": "backend" }, "Parameters": { "x-cipp-field-source": "backend" }, "Required": { "x-cipp-field-source": "backend" }, "Synopsis": { "x-cipp-field-source": "backend" }, "Type": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListFunctionStats": { "get": { "summary": "ListFunctionStats", "operationId": "ListFunctionStats", "tags": [ "CIPP > Core" ], "description": "Lists execution statistics for CIPP functions, including timing and performance metrics, filterable by function type and time range.", "parameters": [ { "name": "FunctionType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Interval", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Days", "Hours", "Minutes" ] } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Time", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AvgSeconds": { "x-cipp-field-source": "backend" }, "Duration": { "x-cipp-field-source": "storage" }, "DurationMS": { "x-cipp-field-source": "storage" }, "End": { "x-cipp-field-source": "storage" }, "ErrorMsg": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExecutionCount": { "x-cipp-field-source": "backend" }, "MaxSeconds": { "x-cipp-field-source": "backend" }, "Name": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Start": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "TotalSeconds": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListGDAPAccessAssignments": { "get": { "summary": "ListGDAPAccessAssignments", "operationId": "ListGDAPAccessAssignments", "tags": [ "Tenant > GDAP" ], "description": "Lists GDAP access assignments for a specific delegated admin relationship, including security group members and their role mappings.", "parameters": [ { "name": "Id", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "createdDateTime": { "x-cipp-field-source": "backend" }, "group": { "x-cipp-field-source": "backend" }, "id": { "x-cipp-field-source": "backend" }, "members": { "x-cipp-field-source": "backend" }, "modifiedDateTime": { "x-cipp-field-source": "backend" }, "roles": { "x-cipp-field-source": "backend" }, "status": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read", "x-cipp-any-tenant": true } }, "/api/ListGDAPContracts": { "get": { "summary": "ListGDAPContracts", "operationId": "ListGDAPContracts", "tags": [ "Tenant > GDAP" ], "description": "Lists Microsoft partner contracts (customer tenant relationships) from the Graph API.", "parameters": [ { "name": "$top", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "contractType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customerId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read", "x-cipp-any-tenant": true } }, "/api/ListGDAPInvite": { "get": { "summary": "ListGDAPInvite", "operationId": "ListGDAPInvite", "tags": [ "Tenant > GDAP" ], "description": "Lists GDAP relationship invitations and their role mappings, optionally filtered by relationship ID.", "parameters": [ { "name": "RelationshipId", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "InviteUrl": { "x-cipp-field-source": "storage,frontend" }, "OnboardingUrl": { "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Reference": { "x-cipp-field-source": "storage,frontend" }, "RoleMappings": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "RowKey": { "x-cipp-field-source": "storage,frontend" }, "Technician": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read", "x-cipp-any-tenant": true } }, "/api/ListGDAPRelationships": { "get": { "summary": "ListGDAPRelationships", "operationId": "ListGDAPRelationships", "tags": [ "Tenant > GDAP" ], "description": "Lists GDAP delegated admin relationships with customer tenants, with optional filtering by relationship ID or OData filter.", "parameters": [ { "name": "$filter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$top", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "accessDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "accessDetails.unifiedRoles": { "x-cipp-field-source": "frontend" }, "activatedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "autoExtendDuration": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "customer": { "type": "object", "x-cipp-field-source": "graph-entity" }, "customer.displayName": { "x-cipp-field-source": "frontend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "duration": { "type": "string", "x-cipp-field-source": "graph-entity" }, "endDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read", "x-cipp-any-tenant": true } }, "/api/ListGDAPRoles": { "get": { "summary": "ListGDAPRoles", "operationId": "ListGDAPRoles", "tags": [ "Tenant > GDAP" ], "description": "Lists the configured GDAP role-to-security-group mappings used for delegated admin access.\nPass ?validate=true to annotate each mapping with the state of its partner tenant group.", "parameters": [ { "name": "validate", "in": "query", "description": "Opt-in only: other consumers of this endpoint depend on the unannotated shape.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GroupId": { "x-cipp-field-source": "storage,backend" }, "GroupName": { "x-cipp-field-source": "storage,backend,frontend" }, "GroupStatus": { "x-cipp-field-source": "backend,frontend" }, "GroupStatusMessage": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "resultText": { "x-cipp-field-source": "storage" }, "roleDefinitionId": { "x-cipp-field-source": "storage,backend" }, "RoleName": { "x-cipp-field-source": "storage,backend,frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "state": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UsedInTemplates": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read", "x-cipp-any-tenant": true } }, "/api/ListGDAPServicePrincipals": { "get": { "summary": "ListGDAPServicePrincipals", "operationId": "ListGDAPServicePrincipals", "tags": [ "Tenant > GDAP" ], "description": "Lists service principals in a customer tenant owned by the partner or specified vendor tenant IDs, useful for identifying GDAP-related app registrations.", "parameters": [ { "name": "$top", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ownerType", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "vendorTenantIds", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read" } }, "/api/ListGeneratedReports": { "get": { "summary": "ListGeneratedReports", "operationId": "ListGeneratedReports", "tags": [ "Tools > Report-Builder" ], "description": "Lists generated reports from the CIPP Report Builder, filterable by tenant or report GUID.", "parameters": [ { "name": "ReportGUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Blocks": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GeneratedAt": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Sections": { "x-cipp-field-source": "frontend" }, "Settings": { "x-cipp-field-source": "storage" }, "Status": { "x-cipp-field-source": "storage,frontend" }, "TemplateName": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "TenantFilter": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.ReportBuilder.Read" } }, "/api/ListGenericTestFunction": { "get": { "summary": "ListGenericTestFunction", "operationId": "ListGenericTestFunction", "tags": [ "CIPP > Core" ], "description": "Returns the original request URL for debugging purposes. Used for CIPP platform diagnostics.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListGitHubReleaseNotes": { "get": { "summary": "Retrieves release notes for a GitHub repository.", "operationId": "ListGitHubReleaseNotes", "tags": [ "Tools > GitHub" ], "description": "Returns release metadata for the provided repository. Results are cached and refreshed\nwhen the cache has no entry for the running version - hotfix releases (e.g. v8.5.2)\npublish their own notes, so a v8.5.0 entry no longer counts as current.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GitHubReleases": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListGlobalAddressList": { "get": { "summary": "ListGlobalAddressList", "operationId": "ListGlobalAddressList", "tags": [ "Email-Exchange > Reports" ], "description": "Lists all recipients in the Exchange Online Global Address List, including display names, email addresses, and recipient types.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "DisplayName": { "x-cipp-field-source": "frontend" }, "HiddenFromAddressListsEnabled": { "x-cipp-field-source": "frontend" }, "IsDirSynced": { "x-cipp-field-source": "frontend" }, "PrimarySmtpAddress": { "x-cipp-field-source": "frontend" }, "RecipientTypeDetails": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListGraphBulkRequest": { "post": { "summary": "ListGraphBulkRequest", "operationId": "ListGraphBulkRequest", "tags": [ "CIPP > Core" ], "description": "Executes multiple Microsoft Graph API requests in a single batch call for a given tenant. Accepts an array of request objects in the body.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "asApp": { "type": "string" }, "noPaginateIds": { "type": "string" }, "requests": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "method": { "type": "string" }, "url": { "type": "string" } } } }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListGraphExplorerPresets": { "get": { "summary": "ListGraphExplorerPresets", "operationId": "ListGraphExplorerPresets", "tags": [ "Tenant > Tools" ], "description": "Lists saved Graph Explorer query presets for the current user or shared presets.", "parameters": [ { "name": "Endpoint", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListGraphReports": { "get": { "summary": "ListGraphReports", "operationId": "ListGraphReports", "tags": [ "Tenant > Reports" ], "description": "Retrieves Microsoft 365 usage reports (Graph or Office reports) for a tenant, such as email activity, OneDrive usage, or Teams device usage.", "parameters": [ { "name": "period", "in": "query", "description": "Reporting window for Graph reports: 'D7', 'D30' (default), 'D90' or 'D180'.", "required": false, "schema": { "type": "string", "enum": [ "D180", "D30", "D7", "D90" ] } }, { "name": "report", "in": "query", "description": "The report name to fetch (e.g. 'getEmailActivityUserDetail'). Omit to enumerate the reports available for the selected Type instead of fetching one.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "type", "in": "query", "description": "Report source: 'graph' (default) for Microsoft Graph usage reports, or 'office' for the reports.office.com service.", "required": false, "schema": { "type": "string", "enum": [ "graph", "office" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "kind": { "x-cipp-field-source": "backend" }, "name": { "x-cipp-field-source": "backend" }, "uri": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Reports.Read" } }, "/api/ListGraphRequest": { "get": { "summary": "ListGraphRequest", "operationId": "ListGraphRequest", "tags": [ "CIPP > Core" ], "description": "Proxies an arbitrary Microsoft Graph API GET request for a tenant. Supports custom endpoints, filters, pagination, and field selection via query parameters. If a request returns a permission error, retry with AsApp set to true: admin and application-scoped endpoints (for example admin/sharepoint/settings) require the application's own permissions rather than the default delegated access.", "parameters": [ { "name": "$count", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$expand", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$filter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$format", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$orderby", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$search", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$select", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "$top", "in": "query", "description": "Graph's page size, NOT a result limit. This endpoint follows @odata.nextLink to the end by default, so $top alone changes how many round trips it makes and not how many records come back - asking for 1 still returns everything. Pair it with NoPagination to stop after one page, or manualPagination to page through deliberately.", "required": false, "schema": { "type": "string" } }, { "name": "AsApp", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "CountOnly", "in": "query", "description": "Return just the number of matching records instead of the records themselves. The cheapest way to size a collection before deciding whether to fetch it.", "required": false, "schema": { "type": "string" } }, { "name": "Endpoint", "in": "query", "description": "Craft breaks egress accounting out per Graph resource on this header.", "required": false, "schema": { "type": "string" } }, { "name": "expand", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "graphFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IgnoreErrors", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ListProperties", "in": "query", "description": "Use raw JSON passthrough for AllTenants cached results when no post-processing is needed.", "required": false, "schema": { "type": "string" } }, { "name": "manualPagination", "in": "query", "description": "Return one page plus its @odata.nextLink in the response metadata, so the caller can fetch the next page itself by passing that link back as nextLink. Use this to walk a large collection in bounded steps rather than pulling it all at once.", "required": false, "schema": { "type": "string" } }, { "name": "maxPageBytes", "in": "query", "description": "Paged AllTenants cache reads only: target page size in bytes of raw JSON, clamped between 262144 and 8388608 (default 4000000). Pages always hold at least one whole tenant.", "required": false, "schema": { "type": "integer" } }, { "name": "nextLink", "in": "query", "description": "Continue a manualPagination walk: pass back the @odata.nextLink returned with the previous page. Endpoint is still required, and the other query options are already encoded in the link.", "required": false, "schema": { "type": "string" } }, { "name": "NoPagination", "in": "query", "description": "Return only the first page and stop. The default follows every @odata.nextLink until the collection is exhausted, which on a large tenant is both slow and very large - use this with $top when a sample is enough.", "required": false, "schema": { "type": "string" } }, { "name": "QueueId", "in": "query", "description": "Use raw JSON passthrough for AllTenants cached results when no post-processing is needed.", "required": false, "schema": { "type": "string" } }, { "name": "QueueNameOverride", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ReverseTenantLookup", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ReverseTenantLookupProperty", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SkipCache", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Sort", "in": "query", "description": "Use raw JSON passthrough for AllTenants cached results when no post-processing is needed.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Version", "in": "query", "description": "Graph API version to call: v1.0 or beta. Defaults to beta when omitted.", "required": false, "schema": { "type": "string", "enum": [ "beta", "v1.0" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Metadata": { "x-cipp-field-source": "backend" }, "Results": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListGraphSchema": { "get": { "summary": "ListGraphSchema", "operationId": "ListGraphSchema", "tags": [ "CIPP > Core" ], "description": "Describes what a Microsoft Graph endpoint returns without calling it: the entity type\nbehind the path, every property with its type, and the navigation properties that can\nbe expanded or traversed. Use it to check whether an endpoint carries the field you\nneed before spending a request on it - particularly before an AllTenants run, where a\nsingle call is multiplied by the tenant count. Answers come from the Graph metadata\nshipped with CIPP, so no tenant is contacted and no permissions are required.", "parameters": [ { "name": "Endpoint", "in": "query", "description": "The Graph path to describe, e.g. 'users', 'groups/{id}/members', or a full Graph URL.", "required": true, "schema": { "type": "string" } }, { "name": "Version", "in": "query", "description": "Which Graph API version to resolve against: 'beta' (default) or 'v1.0'.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListGroups": { "get": { "summary": "ListGroups", "operationId": "ListGroups", "tags": [ "Identity > Administration > Groups" ], "description": "Lists Entra ID groups for a tenant, including group members and owners. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. When manualPagination is also set on a cached read, one page is returned per request as { Results, Metadata } with a continuation token in Metadata.nextLink.", "parameters": [ { "name": "expandMembers", "in": "query", "description": "Expand each listed group's members inline. Graph allows only one expand, and members wins over owners.", "required": false, "schema": { "type": "boolean" } }, { "name": "expandOwners", "in": "query", "description": "Expand each listed group's owners inline. Ignored when expandMembers is also set.", "required": false, "schema": { "type": "boolean" } }, { "name": "groupID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "groupType", "in": "query", "description": "Type of the group named by groupID, used to pick the owners lookup. This does NOT filter the group list.", "required": false, "schema": { "type": "string" } }, { "name": "manualPagination", "in": "query", "description": "Return one page per request as { Results, Metadata } with a continuation token in Metadata.nextLink; cached reads only.", "required": false, "schema": { "type": "string" } }, { "name": "members", "in": "query", "description": "Return the members of the group named by groupID instead of the group list. Requires groupID.", "required": false, "schema": { "type": "boolean" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers. Stream the cached blobs as raw JSON so member arrays are never re-parsed here.", "required": false, "schema": { "type": "string" } }, { "name": "owners", "in": "query", "description": "Return the owners of the group named by groupID instead of the group list. Requires groupID.", "required": false, "schema": { "type": "boolean" } }, { "name": "PageSize", "in": "query", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "allowExternal": { "x-cipp-field-source": "backend" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph" }, "AutoSubscribeNewMembers": { "type": "boolean", "x-cipp-field-source": "graph" }, "calculatedGroupType": { "x-cipp-field-source": "backend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph" }, "description": { "type": "string", "x-cipp-field-source": "graph" }, "displayName": { "type": "string", "x-cipp-field-source": "graph" }, "dynamicGroupBool": { "x-cipp-field-source": "backend" }, "groupInfo": { "x-cipp-field-source": "backend" }, "groupType": { "x-cipp-field-source": "backend" }, "groupTypes": { "type": "array", "x-cipp-field-source": "graph" }, "hideFromAddressLists": { "type": "boolean", "x-cipp-field-source": "graph" }, "hideFromOutlookClients": { "type": "boolean", "x-cipp-field-source": "graph,backend" }, "id": { "type": "string", "x-cipp-field-source": "graph" }, "licenseProcessingState": { "type": "object", "x-cipp-field-source": "graph" }, "mail": { "type": "string", "x-cipp-field-source": "graph" }, "mailEnabled": { "type": "boolean", "x-cipp-field-source": "graph" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph" }, "members": { "x-cipp-field-source": "backend" }, "membershipRule": { "type": "string", "x-cipp-field-source": "graph" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph" }, "organizationId": { "type": "string", "x-cipp-field-source": "graph" }, "owners": { "x-cipp-field-source": "backend" }, "primDomain": { "x-cipp-field-source": "backend" }, "resourceProvisioningOptions": { "type": "array", "x-cipp-field-source": "graph" }, "securityEnabled": { "type": "boolean", "x-cipp-field-source": "graph" }, "sendCopies": { "x-cipp-field-source": "backend" }, "SID": { "x-cipp-field-source": "backend" }, "teamsEnabled": { "x-cipp-field-source": "backend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "visibility": { "type": "string", "x-cipp-field-source": "graph" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.Read" } }, "/api/ListGroupSenderAuthentication": { "get": { "summary": "ListGroupSenderAuthentication", "operationId": "ListGroupSenderAuthentication", "tags": [ "Identity > Administration > Groups" ], "description": "Lists sender authentication settings for an Exchange distribution group or mail-enabled security group, controlling who can send to the group.", "parameters": [ { "name": "groupid", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Distribution List", "Microsoft 365" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Groups.Read" } }, "/api/ListGroupTemplates": { "get": { "summary": "ListGroupTemplates", "operationId": "ListGroupTemplates", "tags": [ "Identity > Administration > Groups" ], "description": "Lists the saved group templates, each with its display name, description and group type. Pass id to return a single template. These are CIPP templates, not a tenant's existing groups.", "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "aliases": { "x-cipp-field-source": "backend" }, "allowExternal": { "x-cipp-field-source": "backend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "description": { "x-cipp-field-source": "backend,frontend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "groupType": { "x-cipp-field-source": "backend,frontend" }, "GUID": { "x-cipp-field-source": "storage,backend,frontend" }, "hideFromGAL": { "x-cipp-field-source": "backend" }, "isSynced": { "x-cipp-field-source": "backend" }, "JSON": { "x-cipp-field-source": "storage" }, "licenses": { "x-cipp-field-source": "backend" }, "membershipRules": { "x-cipp-field-source": "backend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage,backend" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" }, "username": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.Read", "x-cipp-any-tenant": true } }, "/api/ListGroupUsage": { "get": { "summary": "ListGroupUsage", "operationId": "ListGroupUsage", "tags": [ "Identity > Reports" ], "description": "Compiles where each Entra group is used (Conditional Access, Intune assignments, group-based\nlicensing, Teams, nested groups, Entra roles, enterprise applications, Exchange transport\nrules) from the CIPP reporting database cache. Always served from cache — no live Graph calls.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "displayName": { "x-cipp-field-source": "frontend" }, "groupType": { "x-cipp-field-source": "frontend" }, "isUsed": { "x-cipp-field-source": "frontend" }, "mail": { "x-cipp-field-source": "frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "usageCount": { "x-cipp-field-source": "frontend" }, "usedIn": { "x-cipp-field-source": "frontend" }, "usedLocations": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.Read" } }, "/api/ListGuestUsers": { "get": { "summary": "List guest users with lifecycle status", "operationId": "ListGuestUsers", "tags": [ "Identity > Administration > Users" ], "description": "Lists all guest accounts in a tenant with a computed lifecycle status (Active, Pending Acceptance, Stale, Never Signed In or Disabled) based on the invitation state and sign-in activity. Supports UseReportDB=true to serve cached data from the reporting database; AllTenants always uses the cache. When manualPagination is set on a cached read, one page is returned per request as { Results, Metadata } with a continuation token in Metadata.nextLink.", "parameters": [ { "name": "manualPagination", "in": "query", "description": "Return one page per request as { Results, Metadata } with a continuation token in Metadata.nextLink; cached reads only.", "required": false, "schema": { "type": "string" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { "name": "PageSize", "in": "query", "required": false, "schema": { "type": "integer" } }, { "name": "staleDays", "in": "query", "description": "Days without any sign-in before an enabled guest is considered stale. Defaults to 90.", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. AllTenants always uses the cache.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph,backend,frontend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph,backend,frontend" }, "daysSinceSignIn": { "x-cipp-field-source": "backend,frontend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph,backend,frontend" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph,backend" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph,backend" }, "id": { "type": "string", "x-cipp-field-source": "graph,backend" }, "lastInteractiveSignInDateTime": { "x-cipp-field-source": "backend" }, "lastNonInteractiveSignInDateTime": { "x-cipp-field-source": "backend" }, "lastSignInDateTime": { "x-cipp-field-source": "backend,frontend" }, "lastSuccessfulSignInDateTime": { "x-cipp-field-source": "backend" }, "mail": { "type": "string", "x-cipp-field-source": "graph,backend,frontend" }, "sourceDomain": { "x-cipp-field-source": "backend,frontend" }, "sponsors": { "x-cipp-field-source": "backend" }, "status": { "x-cipp-field-source": "backend,frontend" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph,backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListHaloClients": { "get": { "summary": "ListHaloClients", "operationId": "ListHaloClients", "tags": [ "CIPP > Extensions" ], "description": "Lists client records from the configured HaloPSA instance for tenant mapping purposes.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "config": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "label": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "value": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Extension.Read" } }, "/api/ListHistoricalSearches": { "get": { "summary": "ListHistoricalSearches", "operationId": "ListHistoricalSearches", "tags": [ "Email-Exchange > Tools" ], "description": "Lists Exchange Online historical searches (async message trace/report jobs) submitted in the last 10 days.", "parameters": [ { "name": "jobId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "EndDate": { "x-cipp-field-source": "frontend" }, "JobProgress": { "x-cipp-field-source": "frontend" }, "ReportTitle": { "x-cipp-field-source": "frontend" }, "ReportType": { "x-cipp-field-source": "frontend" }, "Rows": { "x-cipp-field-source": "frontend" }, "StartDate": { "x-cipp-field-source": "frontend" }, "Status": { "x-cipp-field-source": "frontend" }, "SubmitDate": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListHVEAccounts": { "get": { "summary": "ListHVEAccounts", "operationId": "ListHVEAccounts", "tags": [ "Email-Exchange > Administration" ], "description": "Lists High Volume Email (HVE) accounts and billing policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ListBillingPolicies", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AdditionalEmailAddresses": { "x-cipp-field-source": "backend,frontend" }, "Alias": { "x-cipp-field-source": "backend,frontend" }, "Authentication": { "x-cipp-field-source": "backend" }, "BillingPolicyId": { "x-cipp-field-source": "backend" }, "BillingPolicyName": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "ExternalDirectoryObjectId": { "x-cipp-field-source": "backend" }, "HiddenFromAddressListsEnabled": { "x-cipp-field-source": "backend" }, "primarySmtpAddress": { "x-cipp-field-source": "backend,frontend" }, "recipientType": { "x-cipp-field-source": "backend" }, "recipientTypeDetails": { "x-cipp-field-source": "backend" }, "ReplyTo": { "x-cipp-field-source": "backend" }, "SMTPPort": { "x-cipp-field-source": "backend" }, "SMTPServer": { "x-cipp-field-source": "backend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListInactiveAccounts": { "get": { "summary": "ListInactiveAccounts", "operationId": "ListInactiveAccounts", "tags": [ "Identity > Reports" ], "description": "Lists user accounts that have not signed in for a configurable number of days (default 180), based on sign-in activity data.", "parameters": [ { "name": "InactiveDays", "in": "query", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "accountEnabled": { "x-cipp-field-source": "frontend" }, "daysSinceLastSignIn": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "lastNonInteractiveSignInDateTime": { "x-cipp-field-source": "frontend" }, "lastSignInDateTime": { "x-cipp-field-source": "frontend" }, "lastSuccessfulSignInDateTime": { "x-cipp-field-source": "frontend" }, "numberOfAssignedLicenses": { "x-cipp-field-source": "frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "tenantDisplayName": { "x-cipp-field-source": "frontend" }, "userPrincipalName": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListInstanceDiagnostics": { "get": { "summary": "ListInstanceDiagnostics", "operationId": "ListInstanceDiagnostics", "tags": [ "CIPP > Settings" ], "description": "Self diagnostics for this instance. Checks turns the recorded InstanceHealth samples\ninto a pass/warn/fail list with a suggested fix per finding; Timeline returns the raw\nbuckets plus the restart and out-of-memory events, with the API clients that were\nbusiest in the hour leading up to each event. Requires SuperAdmin access.", "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "Checks", "Timeline" ] } }, { "name": "Hours", "in": "query", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "BootTime": { "x-cipp-field-source": "storage" }, "Bucket": { "x-cipp-field-source": "storage" }, "ErrCount": { "type": "integer", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GapMinutes": { "type": "integer", "x-cipp-field-source": "storage" }, "GcHeapLimitMb": { "type": "integer", "x-cipp-field-source": "storage" }, "HeapMb": { "type": "integer", "x-cipp-field-source": "storage" }, "HeapMbLive": { "type": "integer", "x-cipp-field-source": "storage" }, "Kind": { "x-cipp-field-source": "storage" }, "MaxLimiterWaitMs": { "type": "integer", "x-cipp-field-source": "storage" }, "OomCount": { "type": "integer", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "PoolExhaustedCount": { "type": "integer", "x-cipp-field-source": "storage" }, "PreviousSample": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "StalledRunCount": { "type": "integer", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "TopEndpointsMs": { "type": "string", "x-cipp-field-source": "storage" }, "Version": { "type": "string", "x-cipp-field-source": "storage" }, "WatchdogCount": { "type": "integer", "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read", "x-cipp-any-tenant": true } }, "/api/ListIntuneApprovalRequests": { "get": { "summary": "List Intune multi-admin approval requests", "operationId": "ListIntuneApprovalRequests", "tags": [ "Endpoint > MEM" ], "description": "Lists the multi-admin approval (MAA) requests raised in a tenant. When an access policy protects\na resource type, Intune defers the change and records it here until a second administrator\napproves it, so this is where a change made from CIPP that appears to have done nothing ends up.", "parameters": [ { "name": "PendingOnly", "in": "query", "description": "Only return requests still waiting on a decision. Off by default so the table shows history too.", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListIntuneIntents": { "get": { "summary": "ListIntuneIntents", "operationId": "ListIntuneIntents", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune security baseline and endpoint protection intents (legacy template-based policies) with their settings and categories.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isAssigned": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isMigratingToConfigurationPolicy": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "roleScopeTagIds": { "type": "array", "x-cipp-field-source": "graph-entity" }, "templateId": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListIntunePolicy": { "get": { "summary": "ListIntunePolicy", "operationId": "ListIntunePolicy", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune device configuration policies for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "DefinitionIds", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IncludeSettingDefinitions", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "URLName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "description": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "lastModifiedDateTime": { "x-cipp-field-source": "frontend" }, "PolicyAssignment": { "x-cipp-field-source": "frontend" }, "PolicyExclude": { "x-cipp-field-source": "frontend" }, "PolicyTypeName": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListIntuneReusableSettings": { "get": { "summary": "ListIntuneReusableSettings", "operationId": "ListIntuneReusableSettings", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune reusable policy settings for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListIntuneReusableSettingTemplates": { "get": { "summary": "ListIntuneReusableSettingTemplates", "operationId": "ListIntuneReusableSettingTemplates", "tags": [ "Endpoint > MEM" ], "description": "Lists the saved Intune reusable setting templates, the shared setting groups that settings catalog policies reference rather than redefining. Pass ID to return a single template.", "parameters": [ { "name": "ID", "in": "query", "description": "escape OData quotes", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "description": { "x-cipp-field-source": "backend,frontend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,backend" }, "isSynced": { "x-cipp-field-source": "backend,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RawJSON": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read", "x-cipp-any-tenant": true } }, "/api/ListIntuneScript": { "get": { "summary": "ListIntuneScript", "operationId": "ListIntuneScript", "tags": [ "Endpoint > MEM" ], "description": "Lists Intune device management scripts (Windows, macOS, Linux, and remediation scripts) for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "description": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "lastModifiedDateTime": { "x-cipp-field-source": "frontend" }, "runAsAccount": { "x-cipp-field-source": "frontend" }, "ScriptAssignment": { "x-cipp-field-source": "frontend" }, "ScriptExclude": { "x-cipp-field-source": "frontend" }, "scriptType": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read" } }, "/api/ListIntuneTemplates": { "get": { "summary": "ListIntuneTemplates", "operationId": "ListIntuneTemplates", "tags": [ "Endpoint > MEM" ], "description": "Lists the saved Intune policy templates. On first call the templates shipped with CIPP are imported into the templates table. These are CIPP templates, not a tenant's deployed policies.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "mode", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "View", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "corrupt": { "x-cipp-field-source": "backend" }, "description": { "x-cipp-field-source": "backend,frontend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "guid": { "x-cipp-field-source": "storage,backend" }, "isSynced": { "x-cipp-field-source": "backend,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "label": { "x-cipp-field-source": "backend" }, "package": { "x-cipp-field-source": "storage,backend,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage,backend,frontend" }, "SourcePath": { "x-cipp-field-source": "storage" }, "templateCount": { "x-cipp-field-source": "backend" }, "TemplateName": { "x-cipp-field-source": "storage" }, "templates": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Type": { "x-cipp-field-source": "backend,frontend" }, "UpdatedBy": { "x-cipp-field-source": "storage" }, "usage": { "x-cipp-field-source": "frontend" }, "value": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.Read", "x-cipp-any-tenant": true } }, "/api/ListIPWhitelist": { "get": { "summary": "ListIPWhitelist", "operationId": "ListIPWhitelist", "tags": [ "CIPP > Settings" ], "description": "Lists CIPP's IP allow/block list: every tenant or AllTenants entry with its address or CIDR range (Range) and state (Trusted, Blocked or NotTrusted).", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.IPDatabase.Read", "x-cipp-any-tenant": true } }, "/api/ListIRMConfiguration": { "get": { "summary": "ListIRMConfiguration", "operationId": "ListIRMConfiguration", "tags": [ "Email-Exchange > Tools" ], "description": "Lists the Information Rights Management (IRM) configuration for a tenant. Used to check whether Microsoft Purview Message Encryption is active and whether an on-premises AD RMS deployment still has to be migrated to Azure RMS first.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "AdRmsDetected": { "x-cipp-field-source": "backend" }, "AzureRMSLicensingEnabled": { "x-cipp-field-source": "backend" }, "DecryptAttachmentForEncryptOnly": { "x-cipp-field-source": "backend" }, "EnablePdfEncryption": { "x-cipp-field-source": "backend" }, "ExternalLicensingEnabled": { "x-cipp-field-source": "backend" }, "InternalLicensingEnabled": { "x-cipp-field-source": "backend" }, "JournalReportDecryptionEnabled": { "x-cipp-field-source": "backend" }, "LicensingLocation": { "x-cipp-field-source": "backend" }, "MessageEncryptionEnabled": { "x-cipp-field-source": "backend" }, "SimplifiedClientAccessDoNotForwardDisabled": { "x-cipp-field-source": "backend" }, "SimplifiedClientAccessEnabled": { "x-cipp-field-source": "backend" }, "SimplifiedClientAccessEncryptOnlyDisabled": { "x-cipp-field-source": "backend" }, "TransportDecryptionSetting": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListJITAdmin": { "get": { "summary": "ListJITAdmin", "operationId": "ListJITAdmin", "tags": [ "Identity > Administration > Users" ], "description": "List Just-in-time admin users for a tenant or all tenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read" } }, "/api/ListJITAdminTemplates": { "get": { "summary": "ListJITAdminTemplates", "operationId": "ListJITAdminTemplates", "tags": [ "Identity > Administration > Users" ], "description": "Lists Just-in-Time admin role templates that define temporary admin role assignments.", "parameters": [ { "name": "GUID", "in": "query", "description": "If a specific GUID is requested, filter to that template", "required": false, "schema": { "type": "string" } }, { "name": "includeAllTenants", "in": "query", "description": "Get the includeAllTenants flag from query or body parameters (defaults to true)", "required": false, "schema": { "type": "boolean" } }, { "name": "TenantFilter", "in": "query", "description": "Get the TenantFilter from query parameters", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "defaultDuration.label": { "x-cipp-field-source": "frontend" }, "defaultExpireAction.label": { "x-cipp-field-source": "frontend" }, "defaultForTenant": { "x-cipp-field-source": "frontend" }, "defaultNotificationActions": { "x-cipp-field-source": "frontend" }, "defaultRoles": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "generateTAPByDefault": { "x-cipp-field-source": "frontend" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "reasonTemplate": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "templateName": { "x-cipp-field-source": "storage,frontend" }, "tenantFilter": { "x-cipp-field-source": "frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read", "x-cipp-any-tenant": true } }, "/api/ListJITAllowedRoles": { "get": { "summary": "ListJITAllowedRoles", "operationId": "ListJITAllowedRoles", "tags": [ "Identity > Administration > Users" ], "description": "Returns the directory roles the calling user is permitted to assign via JIT Admin, based on the\nJIT Role Template(s) attached to their CIPP custom role(s). When the caller is unrestricted the\nfull role catalog is available (Restricted = false).", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read", "x-cipp-any-tenant": true } }, "/api/ListJITRoleTemplates": { "get": { "summary": "ListJITRoleTemplates", "operationId": "ListJITRoleTemplates", "tags": [ "Identity > Administration > Users" ], "description": "Lists JIT Role Templates - named allow-lists of directory roles used to restrict which roles a\nCIPP custom role may assign via JIT Admin.", "parameters": [ { "name": "GUID", "in": "query", "description": "If a specific GUID is requested, filter to that template", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "createdBy": { "x-cipp-field-source": "frontend" }, "createdDate": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "roles": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "templateName": { "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read", "x-cipp-any-tenant": true } }, "/api/ListKnownIPDb": { "get": { "summary": "ListKnownIPDb", "operationId": "ListKnownIPDb", "tags": [ "CIPP > Core" ], "description": "Lists known IP address entries from the CIPP IP database, optionally filtered by tenant.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.IPDatabase.Read", "x-cipp-any-tenant": true } }, "/api/ListLicenseOptimization": { "get": { "summary": "ListLicenseOptimization", "operationId": "ListLicenseOptimization", "tags": [ "Tenant > Reports" ], "description": "License cost-optimization report for a tenant: a monetary summary plus reclaim\nopportunities across five waste tiers (unassigned seats, disabled and inactive licensed\naccounts, mailbox-only downgrade candidates, and redundant overlapping SKUs). Computed from\nthe reporting-DB cache. For tenantFilter=AllTenants it returns a per-tenant summary money\nmap (ranked by reclaimable spend) instead of the full opportunity detail.", "parameters": [ { "name": "currency", "in": "query", "description": "Currency the money figures are resolved in (ISO code); defaults to USD", "required": false, "schema": { "type": "string" } }, { "name": "inactiveDays", "in": "query", "description": "Sign-in age in days past which an enabled licensed user counts as inactive (default 90)", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "description": "The tenant to report on, or AllTenants for the cross-tenant summary money map", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read", "x-cipp-any-tenant": true } }, "/api/ListLicensePricing": { "get": { "summary": "ListLicensePricing", "operationId": "ListLicensePricing", "tags": [ "Tenant > Reports" ], "description": "Lists the resolved monthly price for every known license SKU: MSP price overrides merged\nover the shipped MSRP estimates. Consumed by the license optimization report and its\nprice-management UI. Each row carries a Source of Override, Estimate, or Unknown.\n\nPrices are resolved in the requested currency (?currency=, default USD). The response also\ncarries the list of currencies present in the price data so the UI can offer a selector.", "parameters": [ { "name": "currency", "in": "query", "description": "Currency to resolve prices in (ISO code); defaults to USD", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Currency": { "x-cipp-field-source": "frontend" }, "MonthlyPrice": { "x-cipp-field-source": "frontend" }, "Product_Display_Name": { "x-cipp-field-source": "frontend" }, "skuId": { "x-cipp-field-source": "frontend" }, "skuPartNumber": { "x-cipp-field-source": "frontend" }, "Source": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read", "x-cipp-any-tenant": true } }, "/api/ListLicenseRecommendations": { "get": { "summary": "ListLicenseRecommendations", "operationId": "ListLicenseRecommendations", "tags": [ "Tenant > Reports" ], "description": "License recommendation report for a tenant: the waste tiers from ListLicenseOptimization\nplus evidence-based downgrade targets (from 90-day usage reports against the license\ncatalog), consolidation and protection upgrades, and the recommended annual/monthly\ncommitment split per SKU. Feeds the License Optimization page and the client PDF.", "parameters": [ { "name": "currency", "in": "query", "description": "Currency the money figures are resolved in (ISO code); defaults to USD", "required": false, "schema": { "type": "string" } }, { "name": "inactiveDays", "in": "query", "description": "Sign-in / activity age in days past which a user counts as inactive (default 90)", "required": false, "schema": { "type": "string" } }, { "name": "protectSecurityFeatures", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "recommendDowngrades", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "recommendTerms", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "recommendUpgrades", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "tenureMonths", "in": "query", "description": "Months a seat must have been assigned to count as stable for an annual commitment (default 6)", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "License": { "x-cipp-field-source": "frontend" }, "Reason": { "x-cipp-field-source": "frontend" }, "Suggestion": { "x-cipp-field-source": "frontend" }, "Type": { "x-cipp-field-source": "frontend" }, "User": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListLicenses": { "get": { "summary": "ListLicenses", "operationId": "ListLicenses", "tags": [ "Tenant > Reports" ], "description": "Lists Microsoft 365 license SKUs and their assigned/available counts for a tenant. For AllTenants queries, consider using ListDBCache for better performance.", "parameters": [ { "name": "IncludeExcluded", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "License": { "type": "string", "x-cipp-field-source": "storage,backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListLicensesReport": { "get": { "summary": "ListLicensesReport", "operationId": "ListLicensesReport", "tags": [ "Tenant > Reports" ], "description": "Lists a detailed license overview across all tenants or a single tenant, including SKU breakdowns, costs, and availability.", "parameters": [ { "name": "QueueId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AssignedGroups": { "x-cipp-field-source": "frontend" }, "AssignedUsers": { "x-cipp-field-source": "frontend" }, "CountAvailable": { "x-cipp-field-source": "frontend" }, "CountUsed": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "License": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Metadata": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "frontend" }, "TermInfo": { "x-cipp-field-source": "frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "TotalLicenses": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListLogs": { "get": { "summary": "ListLogs", "operationId": "ListLogs", "tags": [ "CIPP > Core" ], "description": "Lists CIPP platform audit logs with filtering by severity, date range, tenant, and user. Supports listing available log categories, fetching a single entry, and server-side pagination via manualPagination/nextLink. Pass Search to filter rows by a case-insensitive substring of the log Message. Pass summaryOnly=true (or countsOnly=true) to get per-API and per-severity counts across the requested range with the heavy LogData dropped, instead of the full rows.", "parameters": [ { "name": "API", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "BaselineRunId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "countsOnly", "in": "query", "description": "summaryOnly/countsOnly: return per-API and per-severity counts for the matching rows across the requested date range, dropping the (often huge) LogData payloads entirely. Ignores pagination.", "required": false, "schema": { "type": "boolean" } }, { "name": "DateFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Days", "in": "query", "description": "Days=N widens a filtered query to the last N calendar days (in the instance timezone), so the scoped drawers still show a run that finished last night. Ignored when dates are given.", "required": false, "schema": { "type": "integer" } }, { "name": "EndDate", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Filter", "in": "query", "description": "When true, the Severity/User/Tenant/API/StartDate/EndDate query filters are applied; otherwise the current day is returned unfiltered.", "required": false, "schema": { "type": "boolean" } }, { "name": "ListLogs", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "logentryid", "in": "query", "description": "Return single log entry by RowKey. RowKeys are either legacy GUIDs or the inverted-ticks format Write-LogMessage writes; both use only hex digits and hyphens.", "required": false, "schema": { "type": "string" } }, { "name": "manualPagination", "in": "query", "description": "Return one page per request plus a continuation token in Metadata.nextLink, which the frontend passes back as nextLink to fetch the next page. Pages walk the requested date range newest-day-first and, within a day, in RowKey order (newest-first for entries written with the inverted-ticks RowKey scheme).", "required": false, "schema": { "type": "string" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { "name": "PageSize", "in": "query", "description": "Rows to return per page, clamped between 50 and 5000. Defaults to 2000.", "required": false, "schema": { "type": "integer" } }, { "name": "ScheduledTaskId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Search", "in": "query", "description": "Free-text search over the log Message (case-insensitive literal substring). Applied client-side per partition alongside the other row filters, and independent of the Filter flag.", "required": false, "schema": { "type": "string" } }, { "name": "Severity", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "StandardTemplateId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "StartDate", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "summaryOnly", "in": "query", "description": "summaryOnly/countsOnly: return per-API and per-severity counts for the matching rows across the requested date range, dropping the (often huge) LogData payloads entirely. Ignores pagination.", "required": false, "schema": { "type": "boolean" } }, { "name": "Tenant", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "User", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "API": { "x-cipp-field-source": "backend" }, "AppId": { "x-cipp-field-source": "backend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "DateFilter": { "x-cipp-field-source": "backend" }, "DateTime": { "x-cipp-field-source": "backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "IP": { "x-cipp-field-source": "backend" }, "JSON": { "x-cipp-field-source": "storage" }, "LogData": { "x-cipp-field-source": "backend" }, "Message": { "x-cipp-field-source": "backend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage,backend" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage,backend" }, "Severity": { "x-cipp-field-source": "backend" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "Standard": { "x-cipp-field-source": "backend" }, "StandardInfo": { "x-cipp-field-source": "backend" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "backend" }, "TenantID": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" }, "User": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Logs.Read", "x-cipp-any-tenant": true } }, "/api/ListMailboxCAS": { "get": { "summary": "ListMailboxCAS", "operationId": "ListMailboxCAS", "tags": [ "Email-Exchange > Reports" ], "description": "Lists Client Access Settings (CAS) for Exchange Online mailboxes, showing which protocols are enabled (OWA, IMAP, POP, MAPI, EWS, ActiveSync).", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "ActiveSyncEnabled": { "x-cipp-field-source": "backend,frontend" }, "DisplayName": { "x-cipp-field-source": "backend,frontend" }, "ECPEnabled": { "x-cipp-field-source": "backend,frontend" }, "EwsEnabled": { "x-cipp-field-source": "backend,frontend" }, "Guid": { "x-cipp-field-source": "backend" }, "ImapEnabled": { "x-cipp-field-source": "backend,frontend" }, "MAPIEnabled": { "x-cipp-field-source": "backend,frontend" }, "OWAEnabled": { "x-cipp-field-source": "backend,frontend" }, "PopEnabled": { "x-cipp-field-source": "backend,frontend" }, "PrimarySmtpAddress": { "x-cipp-field-source": "backend,frontend" }, "SmtpClientAuthenticationDisabled": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailboxes": { "get": { "summary": "ListMailboxes", "operationId": "ListMailboxes", "tags": [ "Email-Exchange > Administration" ], "description": "Lists Exchange Online mailboxes for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. When manualPagination is also set, one page is returned per request as { Results, Metadata } with a continuation token in Metadata.nextLink.", "parameters": [ { "name": "manualPagination", "in": "query", "description": "Return one page per request as { Results, Metadata } with a continuation token in Metadata.nextLink; cached reads only.", "required": false, "schema": { "type": "string" } }, { "name": "Minimal", "in": "query", "description": "Picker mode: address autocompletes only need the address + name, so skip the heavy field set, the per-mailbox computed properties, and the extra Get-OrganizationConfig call.", "required": false, "schema": { "type": "boolean" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { "name": "PageSize", "in": "query", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "AdditionalEmailAddresses": { "x-cipp-field-source": "backend" }, "ArchiveEnabled": { "x-cipp-field-source": "backend" }, "ArchiveGuid": { "x-cipp-field-source": "backend" }, "AutoExpandingArchive": { "x-cipp-field-source": "backend" }, "AutoExpandingArchiveScope": { "x-cipp-field-source": "backend" }, "ComplianceTagHoldApplied": { "x-cipp-field-source": "backend" }, "DeliverToMailboxAndForward": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend" }, "ExchangeGuid": { "x-cipp-field-source": "backend" }, "ExternalDirectoryObjectId": { "x-cipp-field-source": "backend" }, "ForwardingSmtpAddress": { "x-cipp-field-source": "backend" }, "HiddenFromAddressListsEnabled": { "x-cipp-field-source": "backend" }, "Id": { "x-cipp-field-source": "backend" }, "InPlaceHolds": { "x-cipp-field-source": "backend" }, "InternalForwardingAddress": { "x-cipp-field-source": "backend" }, "IsDirSynced": { "x-cipp-field-source": "backend" }, "LicensedForLitigationHold": { "x-cipp-field-source": "backend" }, "LitigationHoldDate": { "x-cipp-field-source": "backend" }, "LitigationHoldDuration": { "x-cipp-field-source": "backend" }, "LitigationHoldEnabled": { "x-cipp-field-source": "backend" }, "MessageCopyForSendOnBehalfEnabled": { "x-cipp-field-source": "backend" }, "MessageCopyForSentAsEnabled": { "x-cipp-field-source": "backend" }, "primarySmtpAddress": { "x-cipp-field-source": "backend" }, "recipientType": { "x-cipp-field-source": "backend" }, "recipientTypeDetails": { "x-cipp-field-source": "backend" }, "RetentionHoldEnabled": { "x-cipp-field-source": "backend" }, "RetentionPolicy": { "x-cipp-field-source": "backend" }, "UPN": { "x-cipp-field-source": "backend" }, "WhenSoftDeleted": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailboxForwarding": { "get": { "summary": "ListMailboxForwarding", "operationId": "ListMailboxForwarding", "tags": [ "Email-Exchange > Reports" ], "description": "Lists mailbox forwarding rules and configurations for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "DeliverToMailboxAndForward": { "x-cipp-field-source": "backend" }, "DisplayName": { "x-cipp-field-source": "backend" }, "ForwardingSmtpAddress": { "x-cipp-field-source": "backend" }, "ForwardingType": { "x-cipp-field-source": "backend" }, "ForwardTo": { "x-cipp-field-source": "backend" }, "InternalForwardingAddress": { "x-cipp-field-source": "backend" }, "PrimarySmtpAddress": { "x-cipp-field-source": "backend" }, "RecipientTypeDetails": { "x-cipp-field-source": "backend" }, "UPN": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailboxMobileDevices": { "get": { "summary": "ListMailboxMobileDevices", "operationId": "ListMailboxMobileDevices", "tags": [ "Email-Exchange > Administration" ], "description": "Lists mobile devices associated with a specific Exchange Online mailbox.", "parameters": [ { "name": "Mailbox", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "clientType": { "x-cipp-field-source": "backend" }, "clientVersion": { "x-cipp-field-source": "backend" }, "deviceAccessState": { "x-cipp-field-source": "backend" }, "deviceFriendlyName": { "x-cipp-field-source": "backend" }, "deviceID": { "x-cipp-field-source": "backend" }, "deviceModel": { "x-cipp-field-source": "backend" }, "deviceOS": { "x-cipp-field-source": "backend" }, "deviceType": { "x-cipp-field-source": "backend" }, "firstSync": { "x-cipp-field-source": "backend" }, "Guid": { "x-cipp-field-source": "backend" }, "lastSuccessSync": { "x-cipp-field-source": "backend" }, "lastSyncAttempt": { "x-cipp-field-source": "backend" }, "status": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListmailboxPermissions": { "get": { "summary": "ListmailboxPermissions", "operationId": "ListmailboxPermissions", "tags": [ "Email-Exchange > Administration" ], "description": "Lists mailbox permissions (Full Access, Send As, Send on Behalf) for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "ByUser", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "User", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } }, { "name": "userId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Permissions": { "x-cipp-field-source": "backend" }, "User": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailboxRestores": { "get": { "summary": "ListMailboxRestores", "operationId": "ListMailboxRestores", "tags": [ "Email-Exchange > Tools" ], "description": "Lists mailbox restore requests and their status for Exchange Online, with optional statistics for a specific restore operation.", "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IncludeReport", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "Statistics", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Name": { "x-cipp-field-source": "frontend" }, "Status": { "x-cipp-field-source": "frontend" }, "TargetMailbox": { "x-cipp-field-source": "frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailboxRules": { "get": { "summary": "ListMailboxRules", "operationId": "ListMailboxRules", "tags": [ "Email-Exchange > Administration" ], "description": "Lists inbox rules configured on mailboxes in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Enabled": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "From": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Priority": { "x-cipp-field-source": "frontend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Rules": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UserPrincipalName": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailFlowReports": { "get": { "summary": "ListMailFlowReports", "operationId": "ListMailFlowReports", "tags": [ "Email-Exchange > Reports" ], "description": "Returns Exchange Online mail flow reports: disposition counts by day (Get-MailFlowStatusReport)\nand top sender/recipient summaries (Get-MailTrafficSummaryReport). Both support up to 90 days.", "parameters": [ { "name": "category", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "days", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "reportType", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "MailFlowStatus", "TrafficSummary" ] } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Count": { "x-cipp-field-source": "backend" }, "Date": { "x-cipp-field-source": "backend" }, "Direction": { "x-cipp-field-source": "backend" }, "EventType": { "x-cipp-field-source": "backend" }, "Extra": { "x-cipp-field-source": "backend" }, "Name": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMailQuarantine": { "get": { "summary": "ListMailQuarantine", "operationId": "ListMailQuarantine", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists quarantined email messages in Exchange Online Protection for a tenant.", "parameters": [ { "name": "EntityType", "in": "query", "description": "Entity type: Email (default), SharePointOnline (files) or Teams (Teams messages)", "required": false, "schema": { "type": "string" } }, { "name": "manualPagination", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "nextLink", "in": "query", "description": "Manual pagination: return one page per request. The frontend chains requests via Metadata.nextLink, which for this endpoint is the next Get-QuarantineMessage page number.", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Expires": { "x-cipp-field-source": "frontend" }, "Metadata": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "PolicyType": { "x-cipp-field-source": "frontend" }, "QuarantineMessage": { "type": "string", "x-cipp-field-source": "storage" }, "ReceivedTime": { "x-cipp-field-source": "frontend" }, "RecipientAddress": { "x-cipp-field-source": "frontend" }, "ReleasedUser": { "x-cipp-field-source": "frontend" }, "ReleaseStatus": { "x-cipp-field-source": "frontend" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "SenderAddress": { "x-cipp-field-source": "frontend" }, "Subject": { "x-cipp-field-source": "frontend" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Type": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListMailQuarantineMessage": { "get": { "summary": "ListMailQuarantineMessage", "operationId": "ListMailQuarantineMessage", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Exports and retrieves the raw EML content of a specific quarantined email message by its Identity.", "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListMailQuarantineMessageDetails": { "get": { "summary": "ListMailQuarantineMessageDetails", "operationId": "ListMailQuarantineMessageDetails", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Retrieves Defender analyzed email details (threats, delivery, authentication, URLs, attachments)\nfor a quarantined message via the Graph beta security/collaboration/analyzedEmails API.\nFalls back to parsing the message headers (Authentication-Results and X-Forefront-Antispam-Report)\nfor tenants without Defender for Office 365 Plan 2.", "parameters": [ { "name": "Identity", "in": "query", "description": "Only the quarantine Identity is trusted from the caller. NetworkMessageId, RecipientAddress and ReceivedTime are derived server-side from the quarantine message itself (see below) so this endpoint cannot be used to pull Defender analyzedEmail data for arbitrary, non-quarantined messages in the tenant.", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "authenticationDetails": { "type": "object", "x-cipp-field-source": "graph,backend" }, "bulkComplaintLevel": { "type": "string", "x-cipp-field-source": "graph,backend" }, "compositeAuthentication": { "x-cipp-field-source": "backend" }, "directionality": { "type": "object", "x-cipp-field-source": "graph,backend" }, "displayName": { "x-cipp-field-source": "backend" }, "dkim": { "x-cipp-field-source": "backend" }, "dmarc": { "x-cipp-field-source": "backend" }, "internetMessageId": { "type": "string", "x-cipp-field-source": "graph,backend" }, "ipv4": { "x-cipp-field-source": "backend" }, "language": { "type": "string", "x-cipp-field-source": "graph,backend" }, "location": { "x-cipp-field-source": "backend" }, "recipientEmailAddress": { "type": "string", "x-cipp-field-source": "graph,backend" }, "returnPath": { "type": "string", "x-cipp-field-source": "graph,backend" }, "senderDetail": { "type": "object", "x-cipp-field-source": "graph,backend" }, "senderPolicyFramework": { "x-cipp-field-source": "backend" }, "spamConfidenceLevel": { "type": "string", "x-cipp-field-source": "graph,backend" }, "threatTypes": { "type": "array", "x-cipp-field-source": "graph,backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListMailQuarantineMessageHeader": { "get": { "summary": "ListMailQuarantineMessageHeader", "operationId": "ListMailQuarantineMessageHeader", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Retrieves the message headers of a specific quarantined email message by its Identity.", "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListMalwareFilters": { "get": { "summary": "ListMalwareFilters", "operationId": "ListMalwareFilters", "tags": [ "Email-Exchange > Reports" ], "description": "Lists malware filter policies and their associated rules configured in Exchange Online Protection.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "EnableExternalSenderAdminNotifications": { "x-cipp-field-source": "frontend" }, "EnableFileFilter": { "x-cipp-field-source": "frontend" }, "EnableInternalSenderAdminNotifications": { "x-cipp-field-source": "frontend" }, "ExternalSenderAdminAddress": { "x-cipp-field-source": "frontend" }, "FileTypeAction": { "x-cipp-field-source": "frontend" }, "FileTypes": { "x-cipp-field-source": "frontend" }, "InternalSenderAdminAddress": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "Priority": { "x-cipp-field-source": "backend,frontend" }, "QuarantineTag": { "x-cipp-field-source": "frontend" }, "RecipientDomainIs": { "x-cipp-field-source": "backend,frontend" }, "RuleName": { "x-cipp-field-source": "backend,frontend" }, "State": { "x-cipp-field-source": "backend,frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" }, "ZapEnabled": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListMDEOnboarding": { "get": { "summary": "ListMDEOnboarding", "operationId": "ListMDEOnboarding", "tags": [ "Security > Defender" ], "description": "Lists Microsoft Defender for Endpoint onboarding status for devices in a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance. Automatically uses the reporting database when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "androidEnabled": { "x-cipp-field-source": "frontend" }, "androidMobileApplicationManagementEnabled": { "x-cipp-field-source": "frontend" }, "CacheTimestamp": { "x-cipp-field-source": "frontend" }, "iosEnabled": { "x-cipp-field-source": "frontend" }, "iosMobileApplicationManagementEnabled": { "x-cipp-field-source": "frontend" }, "lastHeartbeatDateTime": { "x-cipp-field-source": "frontend" }, "macEnabled": { "x-cipp-field-source": "frontend" }, "microsoftDefenderForEndpointAttachEnabled": { "x-cipp-field-source": "frontend" }, "partnerState": { "type": "object", "x-cipp-field-source": "graph,backend,frontend" }, "partnerUnresponsivenessThresholdInDays": { "x-cipp-field-source": "frontend" }, "Tenant": { "x-cipp-field-source": "backend,frontend" }, "windowsEnabled": { "x-cipp-field-source": "frontend" }, "windowsMobileApplicationManagementEnabled": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.Defender.Read" } }, "/api/ListMessageCenterMessages": { "get": { "summary": "ListMessageCenterMessages", "operationId": "ListMessageCenterMessages", "tags": [ "Tenant > Reports" ], "description": "Lists Microsoft 365 message center messages for a tenant: the change notices, announcements of new and retiring features, planned changes and action-required posts Microsoft publishes, with category, severity, services, tags and action-required-by dates. For AllTenants each message is returned once with the tenants it was posted to (Tenants, TenantCount). Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "actionRequiredByDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "attachmentsArchive": { "type": "string", "x-cipp-field-source": "graph-entity" }, "body": { "type": "object", "x-cipp-field-source": "graph-entity" }, "category": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "details": { "type": "array", "x-cipp-field-source": "graph-entity" }, "endDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hasAttachments": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isMajorChange": { "type": "boolean", "x-cipp-field-source": "graph-entity,frontend" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "services": { "type": "array", "x-cipp-field-source": "graph-entity,frontend" }, "severity": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "startDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Tenant": { "x-cipp-field-source": "frontend" }, "title": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "viewPoint": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListMessageTrace": { "post": { "summary": "ListMessageTrace", "operationId": "ListMessageTrace", "tags": [ "Email-Exchange > Tools" ], "description": "Traces email delivery in Exchange Online via the Graph message trace API\n(/beta/admin/exchange/tracing/messageTraces), searchable by sender, recipient, subject,\nstatus, IP, message ID and date range. Graph works over GDAP/app-only where the legacy\nreporting endpoints do not. Requires the \"Transport Data Platform\" service principal\n(8bd644d1-64a1-4d4b-ae52-2e0cbf64e373) in the tenant; it is provisioned on demand. Until\nthat SP activates (which can take hours), or where the Graph permission is not yet\nconsented, the request falls back to Get-MessageTraceV2 so results are returned immediately.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "days": { "type": "number", "description": "Parse the shared search inputs." }, "endDate": { "type": "integer" }, "fromIP": { "type": "string" }, "ID": { "type": "string" }, "messageId": { "type": "string" }, "messageTraceId": { "type": "string" }, "recipient": { "$ref": "#/components/schemas/LabelValue" }, "sender": { "type": "string" }, "startDate": { "type": "integer" }, "status": { "type": "string" }, "subject": { "type": "string" }, "subjectFilterType": { "$ref": "#/components/schemas/LabelValue" }, "tenantFilter": { "type": "string" }, "toIP": { "type": "string" }, "traceDetail": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Received": { "x-cipp-field-source": "frontend" }, "RecipientAddress": { "x-cipp-field-source": "frontend" }, "SenderAddress": { "x-cipp-field-source": "frontend" }, "Size": { "x-cipp-field-source": "frontend" }, "Status": { "x-cipp-field-source": "frontend" }, "Subject": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListMFAUsers": { "get": { "summary": "ListMFAUsers", "operationId": "ListMFAUsers", "tags": [ "Identity > Reports" ], "description": "Lists users and their MFA registration status for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants. When manualPagination is also set, one page is returned per request as { Results, Metadata } with a continuation token in Metadata.nextLink.", "parameters": [ { "name": "manualPagination", "in": "query", "description": "Return one page per request as { Results, Metadata } with a continuation token in Metadata.nextLink; cached reads only.", "required": false, "schema": { "type": "string" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { "name": "PageSize", "in": "query", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AccountEnabled": { "x-cipp-field-source": "storage,frontend" }, "CAPolicies": { "x-cipp-field-source": "frontend" }, "CoveredByCA": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "CoveredBySD": { "x-cipp-field-source": "storage,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "IsAdmin": { "x-cipp-field-source": "frontend" }, "isLicensed": { "x-cipp-field-source": "frontend" }, "MFAMethods": { "x-cipp-field-source": "frontend" }, "MFARegistration": { "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "PerUser": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UPN": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "UserType": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListNamedLocations": { "get": { "summary": "ListNamedLocations", "operationId": "ListNamedLocations", "tags": [ "Tenant > Conditional" ], "description": "Lists Conditional Access named locations (IP ranges and country-based locations) configured in a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "includeUnknownCountriesAndRegions": { "x-cipp-field-source": "frontend" }, "isTrusted": { "x-cipp-field-source": "frontend" }, "modifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "rangeOrLocation": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.Read" } }, "/api/ListNewUserDefaults": { "get": { "summary": "ListNewUserDefaults", "operationId": "ListNewUserDefaults", "tags": [ "Identity > Administration > Users" ], "description": "Lists default templates for new user creation, including default domain, usage location, and license assignments.", "parameters": [ { "name": "ID", "in": "query", "description": "If a specific ID is requested, filter to that template", "required": false, "schema": { "type": "string" } }, { "name": "includeAllTenants", "in": "query", "description": "Get the includeAllTenants flag from query or body parameters (defaults to true)", "required": false, "schema": { "type": "boolean" } }, { "name": "TenantFilter", "in": "query", "description": "Get the TenantFilter from query parameters", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "templateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read", "x-cipp-any-tenant": true } }, "/api/ListNotificationConfig": { "get": { "summary": "ListNotificationConfig", "operationId": "ListNotificationConfig", "tags": [ "CIPP > Settings" ], "description": "Retrieves the CIPP notification configuration, including alert channels, severity filters, and notification targets.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AffectedUser": { "x-cipp-field-source": "storage" }, "AlertText": { "x-cipp-field-source": "storage" }, "AlertTitle": { "x-cipp-field-source": "storage" }, "Data": { "type": "string", "x-cipp-field-source": "storage" }, "email": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "includeTenantId": { "x-cipp-field-source": "storage" }, "onePerTenant": { "type": "boolean", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "PSAConsolidationKey": { "x-cipp-field-source": "storage" }, "PsaTicketId": { "x-cipp-field-source": "storage" }, "PsaTicketPriority": { "x-cipp-field-source": "storage" }, "Reference": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "schedule": { "x-cipp-field-source": "storage" }, "sendtoIntegration": { "type": "boolean", "x-cipp-field-source": "storage" }, "Severity": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "storage" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Title": { "x-cipp-field-source": "storage" }, "type": { "x-cipp-field-source": "storage" }, "UseStandardizedSchema": { "type": "boolean", "x-cipp-field-source": "storage" }, "webhook": { "x-cipp-field-source": "storage" }, "webhookAuthHeaderName": { "x-cipp-field-source": "storage" }, "webhookAuthHeaders": { "x-cipp-field-source": "storage" }, "webhookAuthHeaderValue": { "x-cipp-field-source": "storage" }, "webhookAuthPassword": { "x-cipp-field-source": "storage" }, "webhookAuthToken": { "x-cipp-field-source": "storage" }, "webhookAuthType": { "x-cipp-field-source": "storage" }, "webhookAuthUsername": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AppSettings.Read" } }, "/api/ListOAuthApps": { "get": { "summary": "ListOAuthApps", "operationId": "ListOAuthApps", "tags": [ "Tenant > Reports" ], "description": "Lists OAuth application consent grants and permissions for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "ApplicationID": { "x-cipp-field-source": "backend,frontend" }, "Name": { "x-cipp-field-source": "backend,frontend" }, "ObjectID": { "x-cipp-field-source": "backend,frontend" }, "Scope": { "x-cipp-field-source": "backend,frontend" }, "StartTime": { "x-cipp-field-source": "backend,frontend" }, "Tenant": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Application.Read" } }, "/api/ListObjectHistory": { "get": { "summary": "In progress concept - Rvd\nReturns a transformed timeline of audit events for any tenant object over a configurable period.", "operationId": "ListObjectHistory", "tags": [ "Identity > Reports" ], "description": "Aggregates change history from Graph directoryAudits and (for Exchange objects) the Unified Audit Log.\nReturns a normalised timeline array with parsed property changes, actor details, and source metadata.\nSupports users, groups, applications, service principals, devices, administrative units,\nconditional access policies, shared mailboxes, distribution lists, and mail contacts.", "parameters": [ { "name": "days", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "objectId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "objectType", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "activityFromUtc": { "x-cipp-field-source": "backend" }, "days": { "x-cipp-field-source": "backend" }, "objectId": { "x-cipp-field-source": "backend" }, "objectType": { "x-cipp-field-source": "backend" }, "resolvedAs": { "x-cipp-field-source": "backend" }, "resolvedDisplayName": { "x-cipp-field-source": "backend" }, "resolvedObject": { "x-cipp-field-source": "backend" }, "sources": { "x-cipp-field-source": "backend" }, "timeline": { "x-cipp-field-source": "backend" }, "totalEvents": { "x-cipp-field-source": "backend" }, "warnings": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.AuditLog.Read" } }, "/api/ListOffboardingProgress": { "get": { "summary": "Get the live progress of an offboarding or BEC remediation job", "operationId": "ListOffboardingProgress", "tags": [ "Identity > Administration > Users" ], "description": "Returns the progress rows of an offboarding job started from the wizard, or of a background BEC\nremediation (ExecBECRemediate with Async): one row per user with its overall status and the\nstatus and message of every step. Same rows as ListAsyncDeployment.\nThis is a read-only GET, so it carries a read role; an offboarding operator (who holds the\nbroader user write role) can still follow and re-run their jobs.", "parameters": [ { "name": "DeploymentId", "in": "query", "description": "The DeploymentId handed back by ExecOffboardUser (also stored on each offboarding task) or ExecBECRemediate", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read", "x-cipp-any-tenant": true } }, "/api/ListOffboardTenants": { "post": { "summary": "ListOffboardTenants", "operationId": "ListOffboardTenants", "tags": [ "Tenant > Administration > Tenant" ], "description": "Lists tenants available for offboarding, including tenants in error state.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } }, "/api/ListOoO": { "get": { "summary": "ListOoO", "operationId": "ListOoO", "tags": [ "Email-Exchange > Administration" ], "description": "Retrieves Out of Office (automatic reply) settings for a specific Exchange Online user.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userid", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListOrg": { "get": { "summary": "ListOrg", "operationId": "ListOrg", "tags": [ "Tenant > Administration > Tenant" ], "description": "Retrieves the Entra ID organization profile for a tenant, including display name, addresses, and tenant metadata.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "certificateConnectorSetting": { "type": "object", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "countryLetterCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultUsageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "directorySizeQuota": { "type": "object", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isMultipleDataLocationsForServicesEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "marketingNotificationEmails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mobileDeviceManagementAuthority": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesLastPasswordSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "partnerTenantType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "privacyProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityComplianceNotificationMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityComplianceNotificationPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "street": { "type": "string", "x-cipp-field-source": "graph-entity" }, "technicalNotificationMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "tenantType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedDomains": { "type": "array", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListPartnerRelationships": { "get": { "summary": "ListPartnerRelationships", "operationId": "ListPartnerRelationships", "tags": [ "Tenant > Administration > Tenant" ], "description": "Lists cross-tenant access policy partner configurations for a tenant, showing delegated admin and collaboration settings.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read" } }, "/api/ListPartnerTenantInfo": { "get": { "summary": "ListPartnerTenantInfo", "operationId": "ListPartnerTenantInfo", "tags": [ "CIPP > Core" ], "description": "Reports whether the CIPP host tenant is a Microsoft Partner tenant, so the frontend can\ndecide whether partner-only flows (GDAP onboarding, reseller invites, GDAP permission\nchecks) apply to this instance.\n\nMarked AnyTenant deliberately. This answers a question about the CIPP instance, not\nabout a tenant the caller wants to act on, and Get-CippPartnerTenantInfo pins the lookup\nto $env:TenantID. Without the flag, Test-CIPPAccess falls back to $env:TenantID as the\ntenant filter and denies any custom role that blocks the partner tenant, which silently\ngreys out partner-only UI for roles that are otherwise fully permitted.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListPendingWebhooks": { "get": { "summary": "ListPendingWebhooks", "operationId": "ListPendingWebhooks", "tags": [ "Tenant > Administration > Alerts" ], "description": "Lists pending incoming webhook events that have not yet been processed by CIPP.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.Read" } }, "/api/ListPerUserMFA": { "get": { "summary": "ListPerUserMFA", "operationId": "ListPerUserMFA", "tags": [ "Identity > Administration > Users" ], "description": "Lists per-user MFA state (enabled, enforced, disabled) for users in a tenant via the legacy MFA management API.", "parameters": [ { "name": "allUsers", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListPIMRoles": { "get": { "summary": "List Entra directory roles grouped with their PIM assignment breakdown.", "operationId": "ListPIMRoles", "tags": [ "Identity > Administration > Roles" ], "description": "Returns one row per role (per tenant when AllTenants is selected) with the role's definition details, how many principals hold it permanently, eligibly or with a time-bound active assignment, the role's PIM policy summary, a slim Members list and the full assignment rows for drill-in. Roles nobody holds are included for a single tenant so the result is also the role catalogue. Supports UseReportDB=true to read a single tenant from the reporting database cache (sync with ExecCIPPDBCache Name=RolesAndAssignments); AllTenants always reads the cache. Powers the Roles & PIM page; ListRoles keeps its original per-definition shape and ListRoleAssignments stays one flat row per assignment.", "parameters": [ { "name": "principalId", "in": "query", "description": "Restrict to the roles one principal (object id) holds.", "required": false, "schema": { "type": "string" } }, { "name": "roleTemplateId", "in": "query", "description": "Restrict to one role template id, e.g. from an alert link.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. AllTenants always reads the cache.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "ActiveCount": { "x-cipp-field-source": "frontend" }, "AssignmentType": { "x-cipp-field-source": "frontend" }, "EligibleCount": { "x-cipp-field-source": "frontend" }, "EndDateTime": { "x-cipp-field-source": "frontend" }, "IsPrivilegedRole": { "x-cipp-field-source": "frontend" }, "Members": { "x-cipp-field-source": "frontend" }, "MemberType": { "x-cipp-field-source": "frontend" }, "PermanentCount": { "x-cipp-field-source": "frontend" }, "PolicySummary": { "x-cipp-field-source": "frontend" }, "PrincipalDisplayName": { "x-cipp-field-source": "frontend" }, "PrincipalType": { "x-cipp-field-source": "frontend" }, "PrincipalUserPrincipalName": { "x-cipp-field-source": "frontend" }, "RoleDisplayName": { "x-cipp-field-source": "frontend" }, "Scope": { "x-cipp-field-source": "frontend" }, "Tenant": { "x-cipp-field-source": "frontend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read" } }, "/api/ListPIMRoleSettingsTemplates": { "get": { "summary": "List PIM role settings templates.", "operationId": "ListPIMRoleSettingsTemplates", "tags": [ "Identity > Administration > Roles" ], "description": "Lists saved Privileged Identity Management role settings templates. A template names a set of roles and the activation, eligibility, assignment, approval and notification rules to enforce on them; the PIMRoleSettings standard deploys a template to tenants.", "parameters": [ { "name": "GUID", "in": "query", "description": "Return only the template with this GUID.", "required": false, "schema": { "type": "string" } }, { "name": "id", "in": "query", "description": "Return only the template with this GUID.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "meetsSecureFloor": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "roleCount": { "x-cipp-field-source": "frontend" }, "roleScope": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "settings.activationMaxDuration": { "x-cipp-field-source": "frontend" }, "settings.activationRequires": { "x-cipp-field-source": "frontend" }, "settings.activationRequiresApproval": { "x-cipp-field-source": "frontend" }, "settings.activeAssignmentMaxDuration": { "x-cipp-field-source": "frontend" }, "settings.eligibilityMaxDuration": { "x-cipp-field-source": "frontend" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "templateName": { "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage,frontend" }, "updatedDate": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read", "x-cipp-any-tenant": true } }, "/api/ListPotentialApps": { "post": { "summary": "ListPotentialApps", "operationId": "ListPotentialApps", "tags": [ "Endpoint > Applications" ], "description": "Searches application repositories (WinGet, Chocolatey) for available applications matching a search string.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "SearchString": { "type": "string" }, "type": { "type": "string", "x-cipp-observed-values": [ "Choco", "WinGet" ] } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "applicationName": { "x-cipp-field-source": "backend" }, "packagename": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.Read" } }, "/api/ListPushSubscriptions": { "get": { "summary": "ListPushSubscriptions", "operationId": "ListPushSubscriptions", "tags": [ "CIPP > Settings" ], "description": "Lists the signed-in user's registered push notification devices and the instance's VAPID public key.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListQuarantinePolicy": { "get": { "summary": "ListQuarantinePolicy", "operationId": "ListQuarantinePolicy", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists quarantine policies configured in Exchange Online Protection, controlling end-user access to quarantined messages.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AllowSender": { "x-cipp-field-source": "frontend" }, "BlockSender": { "x-cipp-field-source": "frontend" }, "Builtin": { "x-cipp-field-source": "backend" }, "Delete": { "x-cipp-field-source": "frontend" }, "IncludeMessagesFromBlockedSenderAddress": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "Preview": { "x-cipp-field-source": "frontend" }, "QuarantineNotification": { "x-cipp-field-source": "backend,frontend" }, "ReleaseActionPreference": { "x-cipp-field-source": "backend,frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListReportBuilderTemplates": { "get": { "summary": "ListReportBuilderTemplates", "operationId": "ListReportBuilderTemplates", "tags": [ "Tools > Report-Builder" ], "description": "Lists saved Report Builder templates that define custom report configurations with data blocks and formatting.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "CustomCount": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "Name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "Sections": { "x-cipp-field-source": "frontend" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "TestCount": { "x-cipp-field-source": "frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.ReportBuilder.Read" } }, "/api/ListResellerRelationshipLink": { "get": { "summary": "ListResellerRelationshipLink", "operationId": "ListResellerRelationshipLink", "tags": [ "Tenant > Administration > Tenant" ], "description": "Retrieves the indirect reseller relationship invitation link from Partner Center for onboarding new customer tenants.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Relationship.Read", "x-cipp-any-tenant": true } }, "/api/ListRestrictedUsers": { "get": { "summary": "ListRestrictedUsers", "operationId": "ListRestrictedUsers", "tags": [ "Email-Exchange > Administration" ], "description": "Lists users from the restricted senders list in Exchange Online.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "BlockType": { "x-cipp-field-source": "backend,frontend" }, "ChangedDatetime": { "x-cipp-field-source": "backend,frontend" }, "CreatedDatetime": { "x-cipp-field-source": "backend,frontend" }, "ExternalCount": { "x-cipp-field-source": "backend,frontend" }, "InternalCount": { "x-cipp-field-source": "backend,frontend" }, "Reason": { "x-cipp-field-source": "backend" }, "SenderAddress": { "x-cipp-field-source": "backend,frontend" }, "TemporaryBlock": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListRetentionCompliancePolicy": { "get": { "summary": "ListRetentionCompliancePolicy", "operationId": "ListRetentionCompliancePolicy", "tags": [ "Security > Compliance-Retention" ], "description": "Lists retention compliance policies and their associated rules from the Security & Compliance Center.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AssociatedRules": { "x-cipp-field-source": "backend" }, "CreatedBy": { "x-cipp-field-source": "frontend" }, "Enabled": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "RestrictiveRetention": { "x-cipp-field-source": "frontend" }, "RetentionAction": { "x-cipp-field-source": "backend,frontend" }, "RetentionDuration": { "x-cipp-field-source": "backend,frontend" }, "RuleCount": { "x-cipp-field-source": "backend,frontend" }, "ScopedLocations": { "x-cipp-field-source": "backend,frontend" }, "WhenChangedUTC": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.Read" } }, "/api/ListRetentionCompliancePolicyTemplates": { "get": { "summary": "ListRetentionCompliancePolicyTemplates", "operationId": "ListRetentionCompliancePolicyTemplates", "tags": [ "Security > Compliance-Retention" ], "description": "Lists saved retention compliance policy templates for deploying standardized retention configurations.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "comments": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "Enabled": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RestrictiveRetention": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.Read", "x-cipp-any-tenant": true } }, "/api/ListRoleAssignments": { "get": { "summary": "List Entra directory role assignments with their PIM assignment type.", "operationId": "ListRoleAssignments", "tags": [ "Identity > Administration > Roles" ], "description": "Returns one row per principal, role and scope showing whether the assignment is Permanent (active with no end date), Active (time-bound), ActivatedFromEligible or Eligible, whether it is held directly or through a role-assignable group, the scope (directory or administrative unit), the principal type, the role's description and built-in flag, and the role's PIM policy summary. For a single tenant roles that nobody holds are included as Unassigned rows so the result is also the role catalogue. A single tenant is read live from Graph (Entra ID P2 tenants via PIM, others via unified RBAC where every assignment is permanent); AllTenants is served from the reporting cache.", "parameters": [ { "name": "includeUnassigned", "in": "query", "description": "Single tenant: also list roles that nobody holds (AssignmentType 'Unassigned'), so the result is the full role catalogue. Default true; set to false for assignments only.", "required": false, "schema": { "type": "string" } }, { "name": "permanentOnly", "in": "query", "description": "Only return permanent (active, no end date) assignments.", "required": false, "schema": { "type": "boolean" } }, { "name": "principalId", "in": "query", "description": "Restrict to one principal (object id), e.g. for the user view page.", "required": false, "schema": { "type": "string" } }, { "name": "roleTemplateId", "in": "query", "description": "Restrict to one role template id.", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read" } }, "/api/ListRoles": { "get": { "summary": "ListRoles", "operationId": "ListRoles", "tags": [ "Identity > Administration > Roles" ], "description": "Lists a tenant's Entra ID role definitions along with the active members of each, via the unified RBAC API. Unlike the legacy /directoryRoles endpoint this includes every built-in and custom role definition, even ones with no assignments.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Description": { "x-cipp-field-source": "backend" }, "DisplayName": { "x-cipp-field-source": "backend" }, "Id": { "x-cipp-field-source": "backend" }, "isBuiltIn": { "x-cipp-field-source": "backend" }, "isEnabled": { "x-cipp-field-source": "backend" }, "MemberCount": { "x-cipp-field-source": "backend" }, "Members": { "x-cipp-field-source": "backend" }, "roleTemplateId": { "x-cipp-field-source": "backend" }, "SID": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.Read" } }, "/api/ListRoomLists": { "get": { "summary": "ListRoomLists", "operationId": "ListRoomLists", "tags": [ "Email-Exchange > Resources" ], "description": "Lists room list distribution groups and their members in Exchange Online.", "parameters": [ { "name": "groupID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "members", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "owners", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Alias": { "x-cipp-field-source": "backend" }, "allowExternal": { "x-cipp-field-source": "backend" }, "Description": { "x-cipp-field-source": "backend" }, "DisplayName": { "x-cipp-field-source": "backend,frontend" }, "groupInfo": { "x-cipp-field-source": "backend" }, "Guid": { "x-cipp-field-source": "backend" }, "Id": { "x-cipp-field-source": "backend" }, "Identity": { "x-cipp-field-source": "backend,frontend" }, "members": { "x-cipp-field-source": "backend" }, "Notes": { "x-cipp-field-source": "backend,frontend" }, "owners": { "x-cipp-field-source": "backend" }, "Phone": { "x-cipp-field-source": "backend,frontend" }, "PrimarySmtpAddress": { "x-cipp-field-source": "backend,frontend" }, "primDomain": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Room.Read" } }, "/api/ListRooms": { "get": { "summary": "ListRooms", "operationId": "ListRooms", "tags": [ "Email-Exchange > Resources" ], "description": "Lists room mailboxes (meeting rooms) in Exchange Online for a tenant, with optional detailed view by room ID.", "parameters": [ { "name": "roomId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "accountDisabled": { "x-cipp-field-source": "backend" }, "AddOrganizerToSubject": { "x-cipp-field-source": "backend" }, "AllowConflicts": { "x-cipp-field-source": "backend" }, "AllowRecurringMeetings": { "x-cipp-field-source": "backend" }, "audioDeviceName": { "x-cipp-field-source": "backend" }, "AutomateProcessing": { "x-cipp-field-source": "backend" }, "bookingType": { "x-cipp-field-source": "backend" }, "BookingWindowInDays": { "x-cipp-field-source": "backend" }, "building": { "x-cipp-field-source": "backend,frontend" }, "capacity": { "x-cipp-field-source": "backend,frontend" }, "city": { "x-cipp-field-source": "backend,frontend" }, "countryOrRegion": { "x-cipp-field-source": "backend,frontend" }, "DefaultCalendarPermission": { "x-cipp-field-source": "backend" }, "DeleteComments": { "x-cipp-field-source": "backend" }, "DeleteSubject": { "x-cipp-field-source": "backend" }, "displayDeviceName": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend,frontend" }, "EnforceCapacity": { "x-cipp-field-source": "backend" }, "floor": { "x-cipp-field-source": "backend,frontend" }, "floorLabel": { "x-cipp-field-source": "backend" }, "ForwardRequestsToDelegates": { "x-cipp-field-source": "backend" }, "hiddenFromAddressListsEnabled": { "x-cipp-field-source": "backend,frontend" }, "id": { "x-cipp-field-source": "backend" }, "isDirSynced": { "x-cipp-field-source": "backend" }, "isWheelChairAccessible": { "x-cipp-field-source": "backend" }, "mail": { "x-cipp-field-source": "backend,frontend" }, "mailNickname": { "x-cipp-field-source": "backend" }, "MaximumDurationInMinutes": { "x-cipp-field-source": "backend" }, "mtrEnabled": { "x-cipp-field-source": "backend" }, "phone": { "x-cipp-field-source": "backend" }, "postalCode": { "x-cipp-field-source": "backend" }, "ProcessExternalMeetingMessages": { "x-cipp-field-source": "backend" }, "RemoveCanceledMeetings": { "x-cipp-field-source": "backend" }, "RemoveOldMeetingMessages": { "x-cipp-field-source": "backend" }, "RemovePrivateProperty": { "x-cipp-field-source": "backend" }, "resourceDelegates": { "x-cipp-field-source": "backend" }, "ScheduleOnlyDuringWorkHours": { "x-cipp-field-source": "backend" }, "spaceType": { "x-cipp-field-source": "backend" }, "state": { "x-cipp-field-source": "backend,frontend" }, "street": { "x-cipp-field-source": "backend" }, "tags": { "x-cipp-field-source": "backend" }, "videoDeviceName": { "x-cipp-field-source": "backend" }, "WorkDays": { "x-cipp-field-source": "backend" }, "WorkHoursEndTime": { "x-cipp-field-source": "backend" }, "WorkHoursStartTime": { "x-cipp-field-source": "backend" }, "WorkingHoursTimeZone": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Room.Read" } }, "/api/ListSafeAttachmentsFilters": { "get": { "summary": "ListSafeAttachmentsFilters", "operationId": "ListSafeAttachmentsFilters", "tags": [ "Email-Exchange > Reports" ], "description": "Lists Safe Attachments policies and their associated rules configured in Microsoft Defender for Office 365.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Action": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "Priority": { "x-cipp-field-source": "backend,frontend" }, "QuarantineTag": { "x-cipp-field-source": "frontend" }, "RecipientDomainIs": { "x-cipp-field-source": "backend,frontend" }, "Redirect": { "x-cipp-field-source": "frontend" }, "RedirectAddress": { "x-cipp-field-source": "frontend" }, "RuleName": { "x-cipp-field-source": "backend,frontend" }, "State": { "x-cipp-field-source": "backend,frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListSafeLinksPolicy": { "get": { "summary": "ListSafeLinksPolicy", "operationId": "ListSafeLinksPolicy", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function is used to list the Safe Links policies in the tenant, including unmatched rules and policies.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "AllowClickThrough": { "x-cipp-field-source": "frontend" }, "ConfigurationStatus": { "x-cipp-field-source": "frontend" }, "DeliverMessageAfterScan": { "x-cipp-field-source": "frontend" }, "Description": { "x-cipp-field-source": "frontend" }, "DisableUrlRewrite": { "x-cipp-field-source": "frontend" }, "DoNotRewriteUrls": { "x-cipp-field-source": "frontend" }, "EnableForInternalSenders": { "x-cipp-field-source": "frontend" }, "EnableOrganizationBranding": { "x-cipp-field-source": "frontend" }, "EnableSafeLinksForEmail": { "x-cipp-field-source": "frontend" }, "EnableSafeLinksForOffice": { "x-cipp-field-source": "frontend" }, "EnableSafeLinksForTeams": { "x-cipp-field-source": "frontend" }, "ExceptIfRecipientDomainIs": { "x-cipp-field-source": "frontend" }, "ExceptIfSentTo": { "x-cipp-field-source": "frontend" }, "ExceptIfSentToMemberOf": { "x-cipp-field-source": "frontend" }, "IsValid": { "x-cipp-field-source": "frontend" }, "PolicyName": { "x-cipp-field-source": "frontend" }, "Priority": { "x-cipp-field-source": "frontend" }, "RecipientDomainIs": { "x-cipp-field-source": "frontend" }, "ScanUrls": { "x-cipp-field-source": "frontend" }, "SentTo": { "x-cipp-field-source": "frontend" }, "SentToMemberOf": { "x-cipp-field-source": "frontend" }, "State": { "x-cipp-field-source": "frontend" }, "TrackClicks": { "x-cipp-field-source": "frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SafeLinksPolicy.Read" } }, "/api/ListSafeLinksPolicyDetails": { "get": { "summary": "ListSafeLinksPolicyDetails", "operationId": "ListSafeLinksPolicyDetails", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function retrieves details for a specific Safe Links policy and rule.", "parameters": [ { "name": "PolicyName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RuleName", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListSafeLinksPolicyTemplateDetails": { "get": { "summary": "ListSafeLinksPolicyTemplateDetails", "operationId": "ListSafeLinksPolicyTemplateDetails", "tags": [ "Security > Safe-Links-Policy" ], "description": "This function retrieves details for a specific Safe Links policy template.", "parameters": [ { "name": "ID", "in": "query", "description": "Get the template ID from query parameters", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.Read", "x-cipp-any-tenant": true } }, "/api/ListSafeLinksPolicyTemplates": { "get": { "summary": "ListSafeLinksPolicyTemplates", "operationId": "ListSafeLinksPolicyTemplates", "tags": [ "Security > Safe-Links-Policy" ], "description": "Lists saved Safe Links policy templates for deploying standardized Safe Links configurations.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateDescription": { "x-cipp-field-source": "frontend" }, "TemplateName": { "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.Read", "x-cipp-any-tenant": true } }, "/api/ListScheduledItemDetails": { "get": { "summary": "ListScheduledItemDetails", "operationId": "ListScheduledItemDetails", "tags": [ "CIPP > Scheduler" ], "description": "Retrieves detailed information about a specific scheduled task by its RowKey, including execution results and task parameters.", "parameters": [ { "name": "RowKey", "in": "query", "description": "Get parameters from the request", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Scheduler.Read", "x-cipp-any-tenant": true } }, "/api/ListScheduledItems": { "get": { "summary": "ListScheduledItems", "operationId": "ListScheduledItems", "tags": [ "CIPP > Scheduler" ], "description": "Lists scheduled tasks in CIPP, filterable by tenant or task ID. Returns task name, command, schedule, and last execution status.", "parameters": [ { "name": "Id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Name", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SearchTitle", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ShowHidden", "in": "query", "description": "Interact with query parameters or the body of the request. Include tasks CIPP hides from the normal task list (internal/system-scheduled work).", "required": false, "schema": { "type": "boolean" } }, { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AdditionalProperties": { "type": "string", "x-cipp-field-source": "storage" }, "AlertComment": { "type": "string", "x-cipp-field-source": "storage" }, "Command": { "type": "string", "x-cipp-field-source": "storage" }, "CustomSubject": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "excludedTenantGroups": { "type": "string", "x-cipp-field-source": "storage" }, "excludedTenants": { "type": "string", "x-cipp-field-source": "storage" }, "ExecutedTime": { "x-cipp-field-source": "storage" }, "Hidden": { "type": "boolean", "x-cipp-field-source": "storage" }, "label": { "x-cipp-field-source": "backend" }, "Name": { "type": "string", "x-cipp-field-source": "storage" }, "Parameters": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "PostExecution": { "type": "string", "x-cipp-field-source": "storage" }, "PsaTicketId": { "type": "string", "x-cipp-field-source": "storage" }, "PsaTicketPriority": { "type": "string", "x-cipp-field-source": "storage" }, "PsaTicketStrategy": { "type": "string", "x-cipp-field-source": "storage" }, "Recurrence": { "type": "string", "x-cipp-field-source": "storage" }, "Reference": { "type": "string", "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "ScheduledTime": { "type": "string", "x-cipp-field-source": "storage" }, "SyncType": { "x-cipp-field-source": "storage" }, "TaskState": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Trigger": { "type": "string", "x-cipp-field-source": "storage" }, "type": { "x-cipp-field-source": "backend" }, "value": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Scheduler.Read", "x-cipp-any-tenant": true } }, "/api/ListSecureScoreReport": { "get": { "summary": "ListSecureScoreReport", "operationId": "ListSecureScoreReport", "tags": [ "Tenant > Reports" ], "description": "Returns the latest Microsoft Secure Score per tenant from the CIPP reporting database, with no\nlive Graph calls. Reads the nightly cache and projects to the score fields only, so the large\ncontrolScores breakdown on each cached record is never materialized.\n\nQuery parameters:\n - tenantFilter: A tenant domain, or 'AllTenants' for every tenant the caller can see.\n - includeHistory: When 'true', each tenant also carries a History array of the retained\n daily scores (date / score / percentage) for trend display.", "parameters": [ { "name": "includeHistory", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "tenantFilter", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Reports.Read", "x-cipp-any-tenant": true } }, "/api/ListSensitiveInfoType": { "get": { "summary": "ListSensitiveInfoType", "operationId": "ListSensitiveInfoType", "tags": [ "Security > Compliance-SIT" ], "description": "Lists sensitive information types (SITs) configured in the Security & Compliance Center, optionally including built-in types.", "parameters": [ { "name": "IncludeBuiltIn", "in": "query", "description": "Include Microsoft's built-in sensitive information types alongside the tenant's custom ones.", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Description": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "Publisher": { "x-cipp-field-source": "frontend" }, "Recommended": { "x-cipp-field-source": "frontend" }, "RulePackVersion": { "x-cipp-field-source": "frontend" }, "State": { "x-cipp-field-source": "frontend" }, "Type": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.Read" } }, "/api/ListSensitiveInfoTypeRulePackage": { "get": { "summary": "ListSensitiveInfoTypeRulePackage", "operationId": "ListSensitiveInfoTypeRulePackage", "tags": [ "Security > Compliance-SIT" ], "description": "Returns the rule pack behind a custom Sensitive Information Type - the parsed rule configuration\n(entities with confidence/proximity and their resolved regex/keyword/fingerprint detection) plus\nthe raw ClassificationRuleCollection XML - so the UI can show what a SIT actually detects.", "parameters": [ { "name": "RulePackId", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.Read" } }, "/api/ListSensitiveInfoTypeTemplates": { "get": { "summary": "ListSensitiveInfoTypeTemplates", "operationId": "ListSensitiveInfoTypeTemplates", "tags": [ "Security > Compliance-SIT" ], "description": "Lists saved sensitive information type templates for deploying custom SIT configurations.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "comments": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "Description": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.Read", "x-cipp-any-tenant": true } }, "/api/ListSensitivityLabel": { "get": { "summary": "ListSensitivityLabel", "operationId": "ListSensitivityLabel", "tags": [ "Security > Compliance-SensitivityLabel" ], "description": "Lists sensitivity labels and label policies configured in the Security & Compliance Center for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Color": { "x-cipp-field-source": "backend,frontend" }, "ContentMarkingHeaderEnabled": { "x-cipp-field-source": "frontend" }, "ContentMarkingWatermarkEnabled": { "x-cipp-field-source": "frontend" }, "ContentType": { "x-cipp-field-source": "frontend" }, "Disabled": { "x-cipp-field-source": "frontend" }, "DisplayName": { "x-cipp-field-source": "frontend" }, "EncryptionEnabled": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "Priority": { "x-cipp-field-source": "frontend" }, "PublishedInPolicies": { "x-cipp-field-source": "backend" }, "SiteAndGroupProtectionEnabled": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.Read" } }, "/api/ListSensitivityLabelTemplates": { "get": { "summary": "ListSensitivityLabelTemplates", "operationId": "ListSensitivityLabelTemplates", "tags": [ "Security > Compliance-SensitivityLabel" ], "description": "Lists saved sensitivity label templates for deploying standardized label configurations.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Comment": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "ContentType": { "x-cipp-field-source": "frontend" }, "DisplayName": { "x-cipp-field-source": "frontend" }, "EncryptionEnabled": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "Name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.Read", "x-cipp-any-tenant": true } }, "/api/ListServiceHealth": { "get": { "summary": "ListServiceHealth", "operationId": "ListServiceHealth", "tags": [ "Tenant > Reports" ], "description": "Lists active Microsoft 365 service health issues and advisories for a tenant or all tenants.", "parameters": [ { "name": "defaultDomainName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "displayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "defaultDomainName": { "x-cipp-field-source": "backend" }, "desc": { "x-cipp-field-source": "backend" }, "issueId": { "x-cipp-field-source": "backend" }, "service": { "type": "string", "x-cipp-field-source": "graph,backend" }, "TenantName": { "x-cipp-field-source": "backend" }, "type": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListServiceHealthIssues": { "get": { "summary": "ListServiceHealthIssues", "operationId": "ListServiceHealthIssues", "tags": [ "Tenant > Reports" ], "description": "Lists Microsoft 365 service health issues for a tenant: the incidents and advisories Microsoft has posted about service outages, degradations and their status, impact, affected services and timeline. For AllTenants each issue is returned once with the tenants it affects (Tenants, TenantCount). Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "classification": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "details": { "type": "array", "x-cipp-field-source": "graph-entity" }, "endDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "feature": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "featureGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "impactDescription": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isResolved": { "type": "boolean", "x-cipp-field-source": "graph-entity,frontend" }, "lastModifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "origin": { "type": "object", "x-cipp-field-source": "graph-entity" }, "posts": { "type": "array", "x-cipp-field-source": "graph-entity" }, "service": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "startDateTime": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "title": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListServiceHealthOverviews": { "get": { "summary": "ListServiceHealthOverviews", "operationId": "ListServiceHealthOverviews", "tags": [ "Tenant > Reports" ], "description": "Lists the Microsoft 365 service health overview for a tenant: the current health status of each cloud service (Exchange Online, SharePoint Online, Microsoft Teams, Entra ID, Intune and others), for example serviceOperational, serviceDegradation or serviceInterruption. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "service": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "Tenant": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListShadowAI": { "get": { "summary": "ListShadowAI", "operationId": "ListShadowAI", "tags": [ "Tenant > AI" ], "description": "Compiles a Shadow AI overview for a tenant by matching CACHED data from the CIPP reporting\ndatabase (DetectedApps, ServicePrincipals, OAuth2PermissionGrants) against the curated AI\ncatalog (Config/ShadowAI.json). No live Graph enumeration is performed - refresh the data by\nsyncing those caches (ExecCIPPDBCache). The only live call is a bounded, best-effort 7-day\nsign-in lookup for the matched AI applications.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.AI.Read" } }, "/api/ListSharedMailboxAccountEnabled": { "get": { "summary": "ListSharedMailboxAccountEnabled", "operationId": "ListSharedMailboxAccountEnabled", "tags": [ "Email-Exchange > Reports" ], "description": "Lists shared mailboxes that have direct sign-in enabled (account not disabled), which is a security concern.\nSupports UseReportDB=true to read cached data from the reporting database (required for AllTenants).", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph,backend,frontend" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph,backend,frontend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph,backend,frontend" }, "givenName": { "type": "string", "x-cipp-field-source": "graph,backend" }, "id": { "type": "string", "x-cipp-field-source": "graph,backend" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph,backend,frontend" }, "surname": { "type": "string", "x-cipp-field-source": "graph,backend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "UserPrincipalName": { "type": "string", "x-cipp-field-source": "graph,backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListSharedMailboxStatistics": { "get": { "summary": "ListSharedMailboxStatistics", "operationId": "ListSharedMailboxStatistics", "tags": [ "Email-Exchange > Administration" ], "description": "Lists shared mailboxes and their usage statistics for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListSharepointAdminUrl": { "get": { "summary": "ListSharepointAdminUrl", "operationId": "ListSharepointAdminUrl", "tags": [ "Teams-Sharepoint" ], "description": "Retrieves the SharePoint Admin Center URL for a tenant and redirects to it. Pass ReturnUrl to\nget the URL back as JSON instead of being redirected.\n\nThe URL cannot be derived from the tenant name - it has to be resolved through Graph - so the\nresult is cached on the tenant, which lets ListTenants hand out a direct link from then on.", "parameters": [ { "name": "ReturnUrl", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "302": { "description": "Found" }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListSharePointExternalUsers": { "get": { "summary": "ListSharePointExternalUsers", "operationId": "ListSharePointExternalUsers", "tags": [ "Teams-Sharepoint" ], "description": "Lists external/guest users known to SharePoint from two sources: the tenant external\nusers store (populated when a guest first redeems a share) and a sweep of every site's\nuser list (which also catches guests who were granted membership but never signed in).\nEvery entry is classified against Entra: 'Entra B2B' (live Entra guest), 'Orphaned B2B'\n(the Entra guest was deleted but SharePoint still references them) or 'SharePoint-only'\n(legacy email-authenticated guest that never had an Entra object).", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSharePointPermissions": { "get": { "summary": "ListSharePointPermissions", "operationId": "ListSharePointPermissions", "tags": [ "Teams-Sharepoint" ], "description": "Compiles the SharePoint permissions report for a tenant from CACHED data in the CIPP\nreporting database (SharePointPermissions). No live enumeration is performed - refresh the\ndata by syncing that cache (ExecCIPPDBCache). Returns the scan summary, the oversharing\nsignals worth acting on, chart datasets and the individual permission assignments.\n\nSignals reported:\n- Broad claims: grants to Everyone, Everyone except external users, or All Users. A library\n carrying one of these is reachable by the whole tenant regardless of who was meant to\n have it, which is the classic oversharing footgun.\n- External grants: permissions held by guest or external identities.\n- Direct Full Control: Full Control held by something other than a SharePoint group, i.e.\n granted to a user or directory group rather than through the site's Owners group.\n- Unique permission libraries: libraries that no longer inherit from their site, so site\n level permission changes no longer reach them.\n\nLimited Access assignments (isSystemManaged) are excluded from every signal - SharePoint\ncreates them itself so a user can traverse to an item, and they grant nothing on their own.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSharepointQuota": { "get": { "summary": "ListSharepointQuota", "operationId": "ListSharepointQuota", "tags": [ "Teams-Sharepoint" ], "description": "Retrieves SharePoint Online storage quota usage for a tenant, showing used and total storage.", "parameters": [ { "name": "live", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Dashboard": { "x-cipp-field-source": "backend" }, "GeoLocations": { "x-cipp-field-source": "backend" }, "GeoUsedStorageMB": { "x-cipp-field-source": "backend" }, "Percentage": { "x-cipp-field-source": "backend" }, "TenantStorageMB": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Admin.Read" } }, "/api/ListSharepointSettings": { "get": { "summary": "ListSharepointSettings", "operationId": "ListSharepointSettings", "tags": [ "Teams-Sharepoint" ], "description": "Retrieves SharePoint Online tenant-level settings and configuration.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "allowedDomainGuidsForSyncApp": { "type": "array", "x-cipp-field-source": "graph-entity" }, "availableManagedPathsForSiteCreation": { "type": "array", "x-cipp-field-source": "graph-entity" }, "deletedUserPersonalSiteRetentionPeriodInDays": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "excludedFileExtensionsForSyncApp": { "type": "array", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "idleSessionSignOut": { "type": "object", "x-cipp-field-source": "graph-entity" }, "imageTaggingOption": { "type": "object", "x-cipp-field-source": "graph-entity" }, "isCommentingOnSitePagesEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFileActivityNotificationEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isLegacyAuthProtocolsEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isLoopEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isMacSyncAppEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isRequireAcceptingUserToMatchInvitedUserEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResharingByExternalUsersEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSharePointMobileNotificationEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSharePointNewsfeedEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSiteCreationEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSiteCreationUIEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSitePagesCreationEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSitesStorageLimitAutomatic": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isSyncButtonHiddenOnPersonalSite": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isUnmanagedSyncAppForTenantRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "personalSiteDefaultStorageLimitInMB": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "sharingAllowedDomainList": { "type": "array", "x-cipp-field-source": "graph-entity" }, "sharingBlockedDomainList": { "type": "array", "x-cipp-field-source": "graph-entity" }, "sharingCapability": { "type": "object", "x-cipp-field-source": "graph-entity" }, "sharingDomainRestrictionMode": { "type": "object", "x-cipp-field-source": "graph-entity" }, "siteCreationDefaultManagedPath": { "type": "string", "x-cipp-field-source": "graph-entity" }, "siteCreationDefaultStorageLimitInMB": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "tenantDefaultTimezone": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Admin.Read" } }, "/api/ListSharePointSharing": { "get": { "summary": "ListSharePointSharing", "operationId": "ListSharePointSharing", "tags": [ "Teams-Sharepoint" ], "description": "Compiles the SharePoint & OneDrive sharing report for a tenant from CACHED data in the\nCIPP reporting database (SharePointSharingLinks, SharePointSiteUsage, OneDriveUsage).\nNo live Graph enumeration is performed - refresh the data by syncing those caches\n(ExecCIPPDBCache). Returns environment/file/storage summaries per workload, sharing link\ncounts by classification, chart datasets and the individual sharing link rows.\n\nAlso rolls up the sharing sprawl signals held in the same rows: anonymous links that allow\nediting, anonymous links with no expiry, folder-level external shares (one share exposes\neverything below it), and the busiest libraries and external recipients.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSharePointTemplates": { "get": { "summary": "ListSharePointTemplates", "operationId": "ListSharePointTemplates", "tags": [ "Teams-Sharepoint" ], "description": "Lists saved SharePoint provisioning templates (site templates and their document libraries).", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "Error": { "x-cipp-field-source": "backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "LibraryCount": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "SiteTemplateCount": { "x-cipp-field-source": "frontend" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateId": { "x-cipp-field-source": "backend" }, "TemplateName": { "x-cipp-field-source": "storage,backend,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "UpdatedBy": { "x-cipp-field-source": "storage,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Admin.Read", "x-cipp-any-tenant": true } }, "/api/ListSignIns": { "get": { "summary": "ListSignIns", "operationId": "ListSignIns", "tags": [ "Identity > Reports" ], "description": "Lists recent sign-in log entries for a tenant, filterable by various criteria. Supports AllTenants queries.\n\nDeprecated: use ListGraphRequest with Endpoint=auditLogs/signIns instead, which supports $filter, $top,\n$orderby, and manualPagination with nextLink continuation. This endpoint returns at most one page of\nresults and will be removed in a future release.", "parameters": [ { "name": "Days", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "failedLogonsOnly", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "FailureThreshold", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Filter", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "additionalDetails": { "x-cipp-field-source": "backend" }, "agent": { "type": "object", "x-cipp-field-source": "graph-entity" }, "appDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appliedConditionalAccessPolicies": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appliedEventListeners": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appOwnerTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appTokenProtectionStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "authenticationAppDeviceDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "authenticationAppPolicyEvaluationDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationContextClassReferences": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationMethodsUsed": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationProcessingDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationProtocol": { "type": "object", "x-cipp-field-source": "graph-entity" }, "authenticationRequirement": { "type": "string", "x-cipp-field-source": "graph-entity" }, "authenticationRequirementPolicies": { "type": "array", "x-cipp-field-source": "graph-entity" }, "autonomousSystemNumber": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "azureResourceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "clientAppUsed": { "type": "string", "x-cipp-field-source": "graph-entity" }, "clientCredentialType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "clientSessionId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "conditionalAccessAudiences": { "type": "array", "x-cipp-field-source": "graph-entity" }, "conditionalAccessStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "correlationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "crossTenantAccessType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceDetail": { "type": "object", "x-cipp-field-source": "graph-entity" }, "errorCode": { "x-cipp-field-source": "backend" }, "federatedCredentialId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "flaggedForReview": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "globalSecureAccessIpAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "homeTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "homeTenantName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "incomingTokenType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "ipAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ipAddressFromResourceProvider": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isInteractive": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isTenantRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isThroughGlobalSecureAccess": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "location": { "type": "object", "x-cipp-field-source": "graph-entity" }, "locationcipp": { "x-cipp-field-source": "backend" }, "managedServiceIdentity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mfaDetail": { "type": "object", "x-cipp-field-source": "graph-entity" }, "networkLocationDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "originalRequestId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "originalTransferMethod": { "type": "object", "x-cipp-field-source": "graph-entity" }, "privateLinkDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "processingTimeInMilliseconds": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "resourceDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceOwnerTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceServicePrincipalId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "riskDetail": { "type": "object", "x-cipp-field-source": "graph-entity" }, "riskEventTypes_v2": { "type": "array", "x-cipp-field-source": "graph-entity" }, "riskLevelAggregated": { "type": "object", "x-cipp-field-source": "graph-entity" }, "riskLevelDuringSignIn": { "type": "object", "x-cipp-field-source": "graph-entity" }, "riskState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "servicePrincipalCredentialKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalCredentialThumbprint": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sessionId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sessionLifetimePolicies": { "type": "array", "x-cipp-field-source": "graph-entity" }, "signInEventTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "signInIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "signInIdentifierType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInTokenProtectionStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tokenIssuerName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tokenIssuerType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tokenProtectionStatusDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "uniqueTokenIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userAgent": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.AuditLog.Read" } }, "/api/ListSiteActivity": { "get": { "summary": "ListSiteActivity", "operationId": "ListSiteActivity", "tags": [ "Teams-Sharepoint" ], "description": "Lists cached site activity rows from the CIPP reporting database for SharePoint and Teams sites.\nSupports tenantFilter and optional Type filter (SharePoint or TeamsSite).", "parameters": [ { "name": "siteId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "description": "Optional site-type filter: 'SharePoint' or 'TeamsSite'. Omit to return both.", "required": false, "schema": { "type": "string", "enum": [ "SharePoint", "TeamsSite" ] } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteBrowser": { "get": { "summary": "ListSiteBrowser", "operationId": "ListSiteBrowser", "tags": [ "Teams-Sharepoint" ], "description": "SharePoint site browser listing (sites only — not OneDrive).\nRoot: Get-CIPPSPOAdminListData (SPO.Tenant/RenderAdminListData, Active sites catalog) —\nStorageUsed / NumOfFiles / TemplateName in one paged call.\nGraph getAllSites joins only for Graph site.id (drill-in).\nWith SiteId/SiteUrl: root document/page libraries (Graph lists + SPO StorageMetrics).", "parameters": [ { "name": "SiteId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteBrowserLibraryCopy": { "get": { "summary": "ListSiteBrowserLibraryCopy", "operationId": "ListSiteBrowserLibraryCopy", "tags": [ "Teams-Sharepoint" ], "description": "Returns sanitized aggregate status for a SharePoint library copy operation (OperationId).", "parameters": [ { "name": "OperationId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteBrowserPermissions": { "get": { "summary": "ListSiteBrowserPermissions", "operationId": "ListSiteBrowserPermissions", "tags": [ "Teams-Sharepoint" ], "description": "Extensive permission inventory for a SharePoint site or library for the site browser.\nCollects SPO site admins, associated Owners/Members/Visitors (with members), all site\ngroups (with members), web/library role assignments, and Graph site permissions\n(Sites.Selected / app-only grants). Partial failures are returned in Errors so the UI\ncan still show what was collected. SiteUrl is required; ListId targets a library.\nSharing links / Graph drive permissions are intentionally out of scope (handled elsewhere).", "parameters": [ { "name": "ListId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteLibraries": { "get": { "summary": "ListSiteLibraries", "operationId": "ListSiteLibraries", "tags": [ "Teams-Sharepoint" ], "description": "Lists the visible document libraries of a SharePoint site via the Graph API. The site can\nbe addressed by SiteId or by SiteUrl (hostname:path addressing). Returns the SharePoint\nlist GUID as Id so the result can be used directly against the SharePoint REST API.", "parameters": [ { "name": "SiteId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteMembers": { "get": { "summary": "ListSiteMembers", "operationId": "ListSiteMembers", "tags": [ "Teams-Sharepoint" ], "description": "Lists the actual membership of a SharePoint site: the users in the site's associated\nOwners/Members/Visitors role groups via the SharePoint REST API with certificate\nauthentication, plus site collection admins. On group-connected (Team) sites the role\ngroups contain the backing M365 group as a claim; those are expanded through Graph so\nthe real people are returned. Falls back to the site's hidden User Information List\nvia Graph when the SharePoint REST API is unavailable (e.g. the tenant does not have\nthe SharePoint application permission consented yet).", "parameters": [ { "name": "Filter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSitePermissions": { "get": { "summary": "ListSitePermissions", "operationId": "ListSitePermissions", "tags": [ "Teams-Sharepoint" ], "description": "Lists the permissions of a SharePoint scope via the SharePoint REST API with certificate\nauthentication: the inheritance state plus every role assignment, flattened to one row per\nprincipal and permission level. Supplying ListId targets a document library; omitting it\ntargets the site root web. Limited Access assignments are returned but flagged as system\nmanaged - SharePoint creates them automatically so a user can traverse to an item they were\ngiven access to, and removing them by hand breaks that navigation.", "parameters": [ { "name": "ListId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteProperties": { "get": { "summary": "ListSiteProperties", "operationId": "ListSiteProperties", "tags": [ "Teams-Sharepoint" ], "description": "Returns a single site's admin-level properties (sharing, lifecycle and version policy)\nvia the SharePoint admin CSOM API, with enum values translated to friendly names so\nthe Edit Site form can consume and round-trip them.", "parameters": [ { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteRecycleBin": { "get": { "summary": "ListSiteRecycleBin", "operationId": "ListSiteRecycleBin", "tags": [ "Teams-Sharepoint" ], "description": "Lists the contents of a SharePoint site's recycle bin (first and second stage) via the\nSharePoint REST API with certificate authentication.", "parameters": [ { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.SiteRecycleBin.Read" } }, "/api/ListSiteRecycleBinSummary": { "get": { "summary": "ListSiteRecycleBinSummary", "operationId": "ListSiteRecycleBinSummary", "tags": [ "Teams-Sharepoint" ], "description": "Aggregate recycle bin sizes for a site (counts + bytes by stage). Never returns\nitem titles, leaf names, or paths — storage-report privacy ceiling.", "parameters": [ { "name": "MaxItems", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.SiteRecycleBin.Read" } }, "/api/ListSiteRoleDefinitions": { "get": { "summary": "ListSiteRoleDefinitions", "operationId": "ListSiteRoleDefinitions", "tags": [ "Teams-Sharepoint" ], "description": "Lists the permission levels defined on a SharePoint site via the SharePoint REST API with\ncertificate authentication. Reading them from the site rather than assuming the five\nbuilt-ins means custom permission levels are offered too. Hidden levels and Limited Access\n(RoleTypeKind 1, managed by SharePoint itself) are excluded by default because they must\nnot be handed out manually; pass IncludeUnassignable to get the full list.", "parameters": [ { "name": "IncludeUnassignable", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSites": { "get": { "summary": "ListSites", "operationId": "ListSites", "tags": [ "Teams-Sharepoint" ], "description": "Lists SharePoint sites or OneDrive usage for a tenant. Requires a Type parameter (SharePointSiteUsage or OneDriveUsageAccount). SharePoint live data uses SPO admin RLD plus Graph enrichment; OneDrive live data uses Graph usage reports. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "description": "Required. Which usage set to list: SharePointSiteUsage or OneDriveUsageAccount.", "required": false, "schema": { "type": "string", "enum": [ "OneDriveUsageAccount", "SharePointSiteUsage" ] } }, { "name": "URLOnly", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "AutoMapUrl": { "x-cipp-field-source": "backend" }, "createdDateTime": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend" }, "fileCount": { "x-cipp-field-source": "backend" }, "lastActivityDate": { "x-cipp-field-source": "backend" }, "ownerDisplayName": { "x-cipp-field-source": "backend" }, "ownerPrincipalName": { "x-cipp-field-source": "backend" }, "reportRefreshDate": { "x-cipp-field-source": "backend" }, "rootWebTemplate": { "x-cipp-field-source": "backend" }, "siteId": { "x-cipp-field-source": "backend" }, "storageAllocatedInBytes": { "x-cipp-field-source": "backend" }, "storageAllocatedInGigabytes": { "x-cipp-field-source": "backend" }, "storageUsedInBytes": { "x-cipp-field-source": "backend" }, "storageUsedInGigabytes": { "x-cipp-field-source": "backend" }, "webId": { "x-cipp-field-source": "backend" }, "webUrl": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteStorageComposition": { "get": { "summary": "ListSiteStorageComposition", "operationId": "ListSiteStorageComposition", "tags": [ "Teams-Sharepoint" ], "description": "Site-level storage composition at library ceiling: tip / previous-version estimate /\nrecycle estimate from root web StorageMetrics + site StorageUsed. No file names.", "parameters": [ { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSiteUserAccess": { "get": { "summary": "ListSiteUserAccess", "operationId": "ListSiteUserAccess", "tags": [ "Teams-Sharepoint" ], "description": "Explains how one user can reach a SharePoint site or document library: every route that\ngrants them access, and the permission level each route carries. This is the effective\naccess answer that the permission lists cannot give on their own, because those show who\nholds a grant rather than who the grant resolves to.\n\nRoutes checked, live:\n- Site collection administrator (full control over everything in the site)\n- A permission granted straight to the user\n- Membership of a SharePoint group that holds a permission, including the Owners,\n Members and Visitors groups\n- Membership of an Entra security group or Microsoft 365 group that holds a permission,\n resolved through transitiveMemberOf so nested groups count\n- A tenant-wide claim (Everyone, Everyone except external users, All Users), which every\n internal user matches\n- Sharing links and direct item shares the user received, read from the\n SharePointSharingLinks cache rather than live\n\nWhen a library is given and it still inherits, its permissions are the site's, so the\nsite is evaluated and the result says so.\n\nLimited Access is reported but flagged, because on its own it grants no ability to open\nor list anything - SharePoint adds it so a user can traverse to an item they were given\naccess to further down.", "parameters": [ { "name": "ListId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "SiteUrl", "in": "query", "required": true, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UserPrincipalName", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListSnoozedAlerts": { "get": { "summary": "ListSnoozedAlerts", "operationId": "ListSnoozedAlerts", "tags": [ "CIPP > Core" ], "description": "Lists alerts that have been snoozed (temporarily suppressed), filterable by cmdlet name. Returns the snooze duration, whether it runs until the item resolves, whether the item stays visible on the dashboard, and who set it.", "parameters": [ { "name": "CmdletName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CmdletName": { "x-cipp-field-source": "backend,frontend" }, "ContentHash": { "type": "string", "x-cipp-field-source": "storage,backend" }, "ContentPreview": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "IsExpired": { "x-cipp-field-source": "backend" }, "KeepVisible": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage,backend" }, "RemainingDays": { "x-cipp-field-source": "backend,frontend" }, "RowKey": { "x-cipp-field-source": "storage,backend" }, "SnoozedAt": { "type": "string", "x-cipp-field-source": "storage,backend" }, "SnoozedBy": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "SnoozeKey": { "type": "string", "x-cipp-field-source": "storage" }, "SnoozeReason": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "SnoozeUntil": { "type": "string", "x-cipp-field-source": "storage,backend" }, "Status": { "x-cipp-field-source": "backend,frontend" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UntilResolved": { "type": "string", "x-cipp-field-source": "storage,backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.AlertSnooze.Read", "x-cipp-any-tenant": true } }, "/api/ListSpamfilter": { "get": { "summary": "ListSpamfilter", "operationId": "ListSpamfilter", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists hosted content filter (anti-spam) policies and their rule states in Exchange Online Protection.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "BulkSpamAction": { "x-cipp-field-source": "frontend" }, "HighConfidenceSpamAction": { "x-cipp-field-source": "frontend" }, "IsDefault": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "PhishSpamAction": { "x-cipp-field-source": "frontend" }, "rulePrio": { "x-cipp-field-source": "backend,frontend" }, "ruleState": { "x-cipp-field-source": "backend,frontend" }, "WhenChanged": { "x-cipp-field-source": "frontend" }, "WhenCreated": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListSpamFilterTemplates": { "get": { "summary": "ListSpamFilterTemplates", "operationId": "ListSpamFilterTemplates", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists saved spam filter policy templates for Exchange Online Protection.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "BulkSpamAction": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,frontend" }, "HighConfidenceSpamAction": { "x-cipp-field-source": "frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "name": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "PhishSpamAction": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read", "x-cipp-any-tenant": true } }, "/api/ListSPOVersionCleanup": { "get": { "summary": "ListSPOVersionCleanup", "operationId": "ListSPOVersionCleanup", "tags": [ "Teams-Sharepoint" ], "description": "Reports the file version history cleanup status for a SharePoint site, given its SiteUrl. Shows whether a trim job is configured or running and what it has reclaimed.", "parameters": [ { "name": "SiteUrl", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListStandards": { "get": { "summary": "ListStandards", "operationId": "ListStandards", "tags": [ "Tenant > Standards" ], "description": "Lists configured tenant standards (compliance policies) and their settings, with optional consolidated view.", "parameters": [ { "name": "ShowConsolidated", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "appliedAt": { "x-cipp-field-source": "backend" }, "appliedBy": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend" }, "standards": { "x-cipp-field-source": "backend" }, "StandardsExport": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read" } }, "/api/ListStandardsCompare": { "get": { "summary": "ListStandardsCompare", "operationId": "ListStandardsCompare", "tags": [ "Tenant > Standards" ], "description": "Compares current tenant configuration against applied standards, showing compliance status and drift for each standard.", "parameters": [ { "name": "templateId", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CurrentValue": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExpectedValue": { "type": "string", "x-cipp-field-source": "storage" }, "LicenseAvailable": { "type": "boolean", "x-cipp-field-source": "storage" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "TemplateId": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Value": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read" } }, "/api/ListStandardsCurrentState": { "get": { "summary": "ListStandardsCurrentState", "operationId": "ListStandardsCurrentState", "tags": [ "Tenant > Standards" ], "description": "Lists the current remediation state of standards applied to a specific tenant, including last check results.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Compliant": { "x-cipp-field-source": "backend" }, "CurrentValue": { "type": "string", "x-cipp-field-source": "storage,backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "ExpectedValue": { "type": "string", "x-cipp-field-source": "storage,backend" }, "LastRefresh": { "x-cipp-field-source": "backend" }, "LicenseAvailable": { "type": "boolean", "x-cipp-field-source": "storage,backend" }, "PartitionKey": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "StandardName": { "x-cipp-field-source": "backend" }, "TemplateId": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Value": { "x-cipp-field-source": "storage,backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read" } }, "/api/listStandardTemplates": { "get": { "summary": "listStandardTemplates", "operationId": "listStandardTemplates", "tags": [ "Tenant > Standards" ], "description": "Lists saved standards templates that define sets of standards to apply to tenants.", "parameters": [ { "name": "id", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "displayName": { "x-cipp-field-source": "backend" }, "excludedTenants": { "x-cipp-field-source": "frontend" }, "GUID": { "x-cipp-field-source": "backend" }, "name": { "x-cipp-field-source": "backend" }, "runManually": { "x-cipp-field-source": "frontend" }, "source": { "x-cipp-field-source": "frontend" }, "standards": { "x-cipp-field-source": "frontend" }, "templateName": { "x-cipp-field-source": "frontend" }, "templates": { "x-cipp-field-source": "backend" }, "tenantFilter": { "x-cipp-field-source": "frontend" }, "type": { "x-cipp-field-source": "frontend" }, "updatedAt": { "x-cipp-field-source": "frontend" }, "updatedBy": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read", "x-cipp-any-tenant": true } }, "/api/ListStorageCleanupScan": { "get": { "summary": "ListStorageCleanupScan", "operationId": "ListStorageCleanupScan", "tags": [ "Teams-Sharepoint" ], "description": "Reads the hold-only StorageCleanupScan CIPPDB cache and rebuilds the scans map expected by\nthe storage report cleanup opportunity helpers. No live enumeration — refresh via\nExecCIPPDBCache Name=StorageCleanupScan. Report-private; not used by other List APIs.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "cleanupSynced": { "x-cipp-field-source": "backend" }, "lastDataRefresh": { "x-cipp-field-source": "backend" }, "librariesScanned": { "x-cipp-field-source": "backend" }, "scans": { "x-cipp-field-source": "backend" }, "sitesScanned": { "x-cipp-field-source": "backend" }, "sitesSkipped": { "x-cipp-field-source": "backend" }, "sitesWithRecycle": { "x-cipp-field-source": "backend" }, "summary": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Sharepoint.Site.Read" } }, "/api/ListTeams": { "get": { "summary": "ListTeams", "operationId": "ListTeams", "tags": [ "Teams-Sharepoint" ], "description": "Lists Microsoft Teams teams for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "type", "in": "query", "required": false, "schema": { "type": "string", "x-cipp-observed-values": [ "List", "Team" ] } }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "ChannelInfo": { "x-cipp-field-source": "backend" }, "description": { "x-cipp-field-source": "frontend" }, "displayName": { "x-cipp-field-source": "frontend" }, "id": { "x-cipp-field-source": "frontend" }, "InstalledApps": { "x-cipp-field-source": "backend" }, "mailNickname": { "x-cipp-field-source": "frontend" }, "Members": { "x-cipp-field-source": "backend" }, "Name": { "x-cipp-field-source": "backend" }, "Owners": { "x-cipp-field-source": "backend" }, "TeamInfo": { "x-cipp-field-source": "backend" }, "visibility": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Group.Read" } }, "/api/ListTeamsActivity": { "get": { "summary": "ListTeamsActivity", "operationId": "ListTeamsActivity", "tags": [ "Teams-Sharepoint" ], "description": "Lists Microsoft Teams user activity reports for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "CallCount": { "x-cipp-field-source": "backend,frontend" }, "LastActive": { "x-cipp-field-source": "backend,frontend" }, "MeetingCount": { "x-cipp-field-source": "backend,frontend" }, "TeamsChat": { "x-cipp-field-source": "backend,frontend" }, "UPN": { "x-cipp-field-source": "backend,frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Activity.Read" } }, "/api/ListTeamsLisLocation": { "get": { "summary": "ListTeamsLisLocation", "operationId": "ListTeamsLisLocation", "tags": [ "Teams-Sharepoint" ], "description": "Lists Teams emergency calling Location Information Service (LIS) locations configured for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "City": { "x-cipp-field-source": "backend" }, "CityAlias": { "x-cipp-field-source": "backend" }, "CivicAddressId": { "x-cipp-field-source": "backend" }, "CompanyName": { "x-cipp-field-source": "backend" }, "CompanyTaxId": { "x-cipp-field-source": "backend" }, "Confidence": { "x-cipp-field-source": "backend" }, "CountryOrRegion": { "x-cipp-field-source": "backend" }, "CountyOrDistrict": { "x-cipp-field-source": "backend" }, "Description": { "x-cipp-field-source": "backend" }, "Elin": { "x-cipp-field-source": "backend" }, "HouseNumber": { "x-cipp-field-source": "backend" }, "HouseNumberSuffix": { "x-cipp-field-source": "backend" }, "IsDefault": { "x-cipp-field-source": "backend" }, "Latitude": { "x-cipp-field-source": "backend" }, "Location": { "x-cipp-field-source": "backend" }, "LocationId": { "x-cipp-field-source": "backend" }, "Longitude": { "x-cipp-field-source": "backend" }, "NumberOfTelephoneNumbers": { "x-cipp-field-source": "backend" }, "NumberOfVoiceUsers": { "x-cipp-field-source": "backend" }, "PartnerId": { "x-cipp-field-source": "backend" }, "PostalCode": { "x-cipp-field-source": "backend" }, "PostDirectional": { "x-cipp-field-source": "backend" }, "PreDirectional": { "x-cipp-field-source": "backend" }, "StateOrProvince": { "x-cipp-field-source": "backend" }, "StreetName": { "x-cipp-field-source": "backend" }, "StreetSuffix": { "x-cipp-field-source": "backend" }, "TenantId": { "x-cipp-field-source": "backend" }, "ValidationStatus": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Voice.Read" } }, "/api/ListTeamsVoice": { "get": { "summary": "ListTeamsVoice", "operationId": "ListTeamsVoice", "tags": [ "Teams-Sharepoint" ], "description": "Lists Microsoft Teams voice and PSTN usage for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "AcquiredCapabilities": { "x-cipp-field-source": "frontend" }, "AcquisitionDate": { "x-cipp-field-source": "frontend" }, "ActivationState": { "x-cipp-field-source": "frontend" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "AssignedTo": { "x-cipp-field-source": "backend" }, "AssignedTo.userPrincipalName": { "x-cipp-field-source": "frontend" }, "AssignmentStatus": { "x-cipp-field-source": "frontend" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "EmergencyLocation": { "x-cipp-field-source": "backend,frontend" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "IsoCountryCode": { "x-cipp-field-source": "frontend" }, "IsOperatorConnect": { "x-cipp-field-source": "frontend" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "NumberType": { "x-cipp-field-source": "frontend" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "PlaceName": { "x-cipp-field-source": "frontend" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "TelephoneNumber": { "x-cipp-field-source": "frontend" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Teams.Voice.Read" } }, "/api/ListTenantAlignment": { "get": { "summary": "ListTenantAlignment", "operationId": "ListTenantAlignment", "tags": [ "Tenant > Standards" ], "description": "Lists tenant alignment data showing how well tenants conform to their assigned standards templates.\n\nPass summary=true for the estate roll-up only: per-tenant averages collapsed into score\nbuckets, the overall average, the lowest-scoring tenants and the pending-deviation totals.\nThe row list is one entry per tenant per standard, so an estate-wide caller that only\nrenders those aggregates would otherwise pull tenants x standards rows to compute a\nhandful of numbers.", "parameters": [ { "name": "granular", "in": "query", "required": false, "schema": { "type": "boolean" } }, { "name": "summary", "in": "query", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "alignmentScore": { "x-cipp-field-source": "backend" }, "combinedAlignmentScore": { "x-cipp-field-source": "backend" }, "complianceStatus": { "x-cipp-field-source": "backend" }, "compliant": { "x-cipp-field-source": "backend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "currentValue": { "x-cipp-field-source": "backend" }, "deniedDeviationsCount": { "x-cipp-field-source": "backend" }, "deviationStatus": { "x-cipp-field-source": "backend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "expectedValue": { "x-cipp-field-source": "backend" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "latestDataCollection": { "x-cipp-field-source": "backend" }, "licenseAvailable": { "x-cipp-field-source": "backend" }, "LicenseMissingPercentage": { "x-cipp-field-source": "backend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "pendingDeviationsCount": { "x-cipp-field-source": "backend" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "standardId": { "x-cipp-field-source": "backend" }, "standardName": { "x-cipp-field-source": "backend" }, "standardType": { "x-cipp-field-source": "backend" }, "templateId": { "x-cipp-field-source": "backend" }, "TemplateName": { "x-cipp-field-source": "storage,backend" }, "templateType": { "x-cipp-field-source": "backend" }, "tenantFilter": { "x-cipp-field-source": "backend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read" } }, "/api/ListTenantAllowBlockList": { "get": { "summary": "ListTenantAllowBlockList", "operationId": "ListTenantAllowBlockList", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists Tenant Allow/Block List entries (senders, URLs, file hashes, IPs) from Exchange Online Protection. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Exchange. Much faster, especially for AllTenants.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.", "properties": { "Action": { "x-cipp-field-source": "frontend" }, "ExpirationDate": { "x-cipp-field-source": "frontend" }, "LastModifiedDateTime": { "x-cipp-field-source": "frontend" }, "LastUsedDate": { "x-cipp-field-source": "frontend" }, "ListType": { "x-cipp-field-source": "frontend" }, "Notes": { "x-cipp-field-source": "frontend" }, "RemoveAfter": { "x-cipp-field-source": "frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "Value": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListTenantAllowBlockListTemplates": { "get": { "summary": "ListTenantAllowBlockListTemplates", "operationId": "ListTenantAllowBlockListTemplates", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists saved Tenant Allow/Block List templates for Exchange Online Protection.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ContentHash": { "x-cipp-field-source": "storage" }, "entries": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "listMethod": { "x-cipp-field-source": "frontend" }, "listType": { "x-cipp-field-source": "frontend" }, "NoExpiration": { "x-cipp-field-source": "frontend" }, "notes": { "x-cipp-field-source": "frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RemoveAfter": { "x-cipp-field-source": "frontend" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read", "x-cipp-any-tenant": true } }, "/api/ListTenantDetails": { "get": { "summary": "ListTenantDetails", "operationId": "ListTenantDetails", "tags": [ "Tenant > Administration > Tenant" ], "description": "Retrieves detailed organization information for a tenant, including addresses, assigned plans, sync status, and custom properties.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "assignedPlans": { "type": "array", "x-cipp-field-source": "graph,backend" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph,backend" }, "city": { "type": "string", "x-cipp-field-source": "graph,backend" }, "country": { "type": "string", "x-cipp-field-source": "graph,backend" }, "countryLetterCode": { "type": "string", "x-cipp-field-source": "graph,backend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph,backend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph,backend" }, "id": { "type": "string", "x-cipp-field-source": "graph,backend" }, "onPremisesLastPasswordSyncDateTime": { "type": "string", "x-cipp-field-source": "graph,backend" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph,backend" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph,backend" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph,backend" }, "state": { "type": "string", "x-cipp-field-source": "graph,backend" }, "street": { "type": "string", "x-cipp-field-source": "graph,backend" }, "technicalNotificationMails": { "type": "array", "x-cipp-field-source": "graph,backend" }, "tenantType": { "type": "string", "x-cipp-field-source": "graph,backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read" } }, "/api/ListTenantDrift": { "get": { "summary": "ListTenantDrift", "operationId": "ListTenantDrift", "tags": [ "Tenant > Standards" ], "description": "Lists configuration drift for tenants, comparing current state against the desired state defined by applied standards.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.Read", "x-cipp-reads-via": [ "Get-CIPPDrift" ] } }, "/api/ListTenantGroups": { "get": { "summary": "Entrypoint for listing tenant groups", "operationId": "ListTenantGroups", "tags": [ "CIPP > Settings" ], "description": "Lists tenant groups (logical groupings of managed tenants) and optionally includes usage data.", "parameters": [ { "name": "groupId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "includeUsage", "in": "query", "description": "Include, per group, the standards templates and scheduled tasks that reference it.", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListTenantOnboarding": { "get": { "summary": "ListTenantOnboarding", "operationId": "ListTenantOnboarding", "tags": [ "Tenant > Administration > Tenant" ], "description": "Lists tenant onboarding requests and their step-by-step progress, including GDAP relationship setup.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CustomerId": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Exception": { "type": "string", "x-cipp-field-source": "storage" }, "Logs": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "OnboardingSteps": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Relationship": { "type": "string", "x-cipp-field-source": "storage" }, "Relationship.customer.displayName": { "x-cipp-field-source": "frontend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "StandardsExcludeAllTenants": { "x-cipp-field-source": "storage" }, "Status": { "x-cipp-field-source": "storage,frontend" }, "TenantGroups": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage,frontend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.Read" } }, "/api/ListTenants": { "get": { "summary": "ListTenants", "operationId": "ListTenants", "tags": [ "Tenant > Administration > Tenant" ], "description": "Lists all managed tenants accessible to the current user, with support for cache clearing and tenant filtering. This is the primary endpoint for tenant enumeration. Pass Search for a fuzzy, case-insensitive substring lookup across displayName, defaultDomainName, initialDomainName and customerId when the exact domain is unknown.", "parameters": [ { "name": "AllTenantSelector", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IncludeOffboardingDefaults", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Mode", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Search", "in": "query", "description": "Fuzzy tenant lookup: case-insensitive substring match over displayName, defaultDomainName, initialDomainName and customerId. Arbitrary verified domains are not indexed by Get-Tenants and cannot be matched here. Supports '*' wildcards. Use this when you don't know the exact domain.", "required": false, "schema": { "type": "string" } }, { "name": "TenantFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "TriggerRefresh", "in": "query", "description": "Re-reads the tenant given in tenantFilter, or queues a refresh of all tenants when omitted. Returns a Results message instead of the tenant list.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true }, "post": { "summary": "ListTenants", "operationId": "ListTenantsPost", "tags": [ "Tenant > Administration > Tenant" ], "description": "Lists all managed tenants accessible to the current user, with support for cache clearing and tenant filtering. This is the primary endpoint for tenant enumeration. Pass Search for a fuzzy, case-insensitive substring lookup across displayName, defaultDomainName, initialDomainName and customerId when the exact domain is unknown.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ClearCache": { "type": "boolean", "description": "Clear Cache" }, "TenantsOnly": { "type": "string" } } } } } }, "parameters": [ { "name": "AllTenantSelector", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IncludeOffboardingDefaults", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Mode", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Search", "in": "query", "description": "Fuzzy tenant lookup: case-insensitive substring match over displayName, defaultDomainName, initialDomainName and customerId. Arbitrary verified domains are not indexed by Get-Tenants and cannot be matched here. Supports '*' wildcards. Use this when you don't know the exact domain.", "required": false, "schema": { "type": "string" } }, { "name": "TenantFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "TriggerRefresh", "in": "query", "description": "Re-reads the tenant given in tenantFilter, or queues a refresh of all tenants when omitted. Returns a Results message instead of the tenant list.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.Read", "x-cipp-any-tenant": true } }, "/api/ListTestReports": { "get": { "summary": "Lists all available test reports from JSON files and database", "operationId": "ListTestReports", "tags": [ "Tenant > Tests" ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "CreatedAt": { "x-cipp-field-source": "storage" }, "CustomTests": { "type": "string", "x-cipp-field-source": "storage" }, "description": { "type": "string", "x-cipp-field-source": "storage" }, "DevicesTests": { "type": "string", "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "IdentityTests": { "type": "string", "x-cipp-field-source": "storage" }, "name": { "type": "string", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedAt": { "type": "string", "x-cipp-field-source": "storage" }, "version": { "x-cipp-field-source": "storage" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Reports.Read", "x-cipp-any-tenant": true } }, "/api/ListTestResultsTenants": { "get": { "summary": "Lists CIPP test results for a given test across one, many, or all tenants.", "operationId": "ListTestResultsTenants", "tags": [ "Tenant > Tests" ], "description": "Cross-tenant overview of stored test results. Backed by Get-CIPPTestResultsTenants, which\nqueries the shared CippTestResults table server-side and enriches Custom rows with their\ndefinition. Results are filtered to the tenants the calling user is permitted to see via\nTest-CIPPAccess, so an all-tenants read still respects per-user tenant scoping.", "parameters": [ { "name": "category", "in": "query", "description": "Restrict to a single category (the framework/area name a test belongs to).", "required": false, "schema": { "type": "string" } }, { "name": "countsOnly", "in": "query", "description": "'true' to return only the aggregate counts with no rows. Implies includeCounts.", "required": false, "schema": { "type": "string" } }, { "name": "includeCounts", "in": "query", "description": "'true' to also return aggregate counts (per status, high-risk failures, distinct tenants).", "required": false, "schema": { "type": "string" } }, { "name": "risk", "in": "query", "description": "Restrict to a single risk level: High, Medium or Low.", "required": false, "schema": { "type": "string" } }, { "name": "rowStatus", "in": "query", "description": "Return rows only for these statuses, while still counting every status the filters match.", "required": false, "schema": { "type": "string" } }, { "name": "status", "in": "query", "description": "Narrow the scan to these statuses: Passed, Failed, Investigate, Skipped, Informational and Unlicensed.", "required": false, "schema": { "type": "string" } }, { "name": "summaryOnly", "in": "query", "description": "'true' to project away the large ResultMarkdown/ResultDataJson blobs for a lighter read.", "required": false, "schema": { "type": "string" } }, { "name": "tenantFilter", "in": "query", "description": "One or more tenant domains to report on. Omit, or pass 'AllTenants', to query every tenant the caller may see. Accepts a string, a comma-delimited string, or an array.", "required": false, "schema": { "type": "string" } }, { "name": "testId", "in": "query", "description": "One or more test IDs (the result row's RowKey), e.g. 'CustomScript-'.", "required": false, "schema": { "type": "string" } }, { "name": "testType", "in": "query", "description": "Restrict to a single test type: Identity, Devices or Custom.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Reports.Read", "x-cipp-any-tenant": true } }, "/api/ListTests": { "get": { "summary": "Lists tests for a tenant, optionally filtered by report ID", "operationId": "ListTests", "tags": [ "Tenant > Tests" ], "parameters": [ { "name": "reportId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "summaryOnly", "in": "query", "description": "When true, return only the aggregated TestCounts (per-type pass/fail/etc totals) and skip the per-result markdown/metadata enrichment and the SecureScore/MFAState/License DB reads.", "required": false, "schema": { "type": "boolean" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "TenantFilter": { "x-cipp-field-source": "backend" }, "TestCounts": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Reports.Read" } }, "/api/ListTransportRules": { "get": { "summary": "ListTransportRules", "operationId": "ListTransportRules", "tags": [ "Email-Exchange > Transport" ], "description": "Lists mail flow (transport) rules configured in Exchange Online, with optional detailed view by rule ID.", "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "Comments": { "x-cipp-field-source": "frontend" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "Metadata": { "x-cipp-field-source": "backend" }, "Mode": { "x-cipp-field-source": "frontend" }, "Name": { "x-cipp-field-source": "frontend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "type": "string", "x-cipp-field-source": "storage" }, "RuleErrorAction": { "x-cipp-field-source": "frontend" }, "State": { "x-cipp-field-source": "frontend" }, "Tenant": { "type": "string", "x-cipp-field-source": "storage,frontend" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "TransportRule": { "type": "string", "x-cipp-field-source": "storage" }, "WhenChanged": { "x-cipp-field-source": "frontend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.Read" } }, "/api/ListTransportRulesTemplates": { "get": { "summary": "ListTransportRulesTemplates", "operationId": "ListTransportRulesTemplates", "tags": [ "Email-Exchange > Transport" ], "description": "Lists saved transport rule templates for Exchange Online mail flow rules.", "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "noJson", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "comments": { "x-cipp-field-source": "frontend" }, "ContentHash": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "GUID": { "x-cipp-field-source": "storage,backend,frontend" }, "JSON": { "x-cipp-field-source": "storage" }, "name": { "x-cipp-field-source": "backend,frontend" }, "Package": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Permissions": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "SHA": { "type": "string", "x-cipp-field-source": "storage" }, "Source": { "x-cipp-field-source": "storage" }, "SourcePath": { "x-cipp-field-source": "storage" }, "TemplateName": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "UpdatedBy": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.Read", "x-cipp-any-tenant": true } }, "/api/ListUserCounts": { "get": { "summary": "ListUserCounts", "operationId": "ListUserCounts", "tags": [ "Identity > Administration > Users" ], "description": "Returns summary counts of total users, licensed users, and global administrators for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListUserDevices": { "get": { "summary": "ListUserDevices", "operationId": "ListUserDevices", "tags": [ "Identity > Administration > Users" ], "description": "Lists Intune-managed devices registered to a specific user, including compliance status and endpoint protection details.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph,backend" }, "approximateLastSignInDateTime": { "x-cipp-field-source": "backend" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph,backend" }, "deviceOwnership": { "x-cipp-field-source": "backend" }, "displayName": { "type": "string", "x-cipp-field-source": "graph,backend" }, "enrollmentType": { "x-cipp-field-source": "backend" }, "EPMID": { "x-cipp-field-source": "backend" }, "ID": { "type": "string", "x-cipp-field-source": "graph,backend" }, "isCompliant": { "x-cipp-field-source": "backend" }, "managementType": { "x-cipp-field-source": "backend" }, "manufacturer": { "x-cipp-field-source": "backend" }, "model": { "x-cipp-field-source": "backend" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph,backend" }, "operatingSystem": { "x-cipp-field-source": "backend" }, "operatingSystemVersion": { "x-cipp-field-source": "backend" }, "trustType": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListUserGroups": { "get": { "summary": "ListUserGroups", "operationId": "ListUserGroups", "tags": [ "Identity > Administration > Users" ], "description": "Lists Entra ID group memberships for a specific user.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userId", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.", "properties": { "calculatedGroupType": { "x-cipp-field-source": "backend" }, "DisplayName": { "type": "string", "x-cipp-field-source": "graph,backend" }, "groupType": { "x-cipp-field-source": "backend" }, "GroupTypes": { "x-cipp-field-source": "backend" }, "id": { "type": "string", "x-cipp-field-source": "graph,backend" }, "IsAssignableToRole": { "x-cipp-field-source": "backend" }, "Mail": { "type": "string", "x-cipp-field-source": "graph,backend" }, "MailEnabled": { "x-cipp-field-source": "backend" }, "OnPremisesSync": { "x-cipp-field-source": "backend" }, "SecurityGroup": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListUserMailboxDetails": { "get": { "summary": "ListUserMailboxDetails", "operationId": "ListUserMailboxDetails", "tags": [ "Identity > Administration > Users" ], "description": "Retrieves detailed Exchange Online mailbox properties for a specific user, including quotas, archive status, and protocols.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "userMail", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AdditionalEmailAddresses": { "x-cipp-field-source": "backend" }, "ArchiveGuid": { "x-cipp-field-source": "backend" }, "ComplianceTagHoldApplied": { "x-cipp-field-source": "backend" }, "Data": { "type": "string", "x-cipp-field-source": "storage" }, "DeliverToMailboxAndForward": { "x-cipp-field-source": "backend" }, "displayName": { "x-cipp-field-source": "backend" }, "ETag": { "x-cipp-field-source": "storage" }, "ExchangeGuid": { "x-cipp-field-source": "backend" }, "ExternalDirectoryObjectId": { "x-cipp-field-source": "backend" }, "ForwardingSmtpAddress": { "x-cipp-field-source": "backend" }, "HiddenFromAddressListsEnabled": { "x-cipp-field-source": "backend" }, "id": { "x-cipp-field-source": "backend" }, "InPlaceHolds": { "x-cipp-field-source": "backend" }, "InternalForwardingAddress": { "x-cipp-field-source": "backend" }, "IsDirSynced": { "x-cipp-field-source": "backend" }, "LicensedForLitigationHold": { "x-cipp-field-source": "backend" }, "LitigationHoldDate": { "x-cipp-field-source": "backend" }, "LitigationHoldDuration": { "x-cipp-field-source": "backend" }, "LitigationHoldEnabled": { "x-cipp-field-source": "backend" }, "MessageCopyForSendOnBehalfEnabled": { "x-cipp-field-source": "backend" }, "MessageCopyForSentAsEnabled": { "x-cipp-field-source": "backend" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "primarySmtpAddress": { "x-cipp-field-source": "backend" }, "recipientType": { "x-cipp-field-source": "backend" }, "recipientTypeDetails": { "x-cipp-field-source": "backend" }, "RetentionHoldEnabled": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Type": { "x-cipp-field-source": "storage" }, "UPN": { "x-cipp-field-source": "backend" }, "WhenSoftDeleted": { "x-cipp-field-source": "backend" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListUserMailboxRules": { "get": { "summary": "ListUserMailboxRules", "operationId": "ListUserMailboxRules", "tags": [ "Identity > Administration > Users" ], "description": "Lists inbox rules configured on a specific user's Exchange Online mailbox.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userEmail", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListUserOneDriveShortcuts": { "get": { "summary": "ListUserOneDriveShortcuts", "operationId": "ListUserOneDriveShortcuts", "tags": [ "Identity > Administration > Users" ], "description": "Lists OneDrive remoteItem shortcuts for a user from the drive root and the Shortcuts folder.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userId", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "userPrincipalName", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListUserPhoto": { "get": { "summary": "ListUserPhoto", "operationId": "ListUserPhoto", "tags": [ "Identity > Administration > Users" ], "description": "Retrieves the profile photo for a specific Entra ID user, returned as a base64-encoded image.", "parameters": [ { "name": "tenantFilter", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read", "x-cipp-any-tenant": true } }, "/api/ListUserReportedMessage": { "get": { "summary": "ListUserReportedMessage", "operationId": "ListUserReportedMessage", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Retrieves the raw EML content of a user reported message by its Internet Message ID. Tries the quarantine store first (Export-QuarantineMessage), then falls back to reading the message from the recipient's or reporter's mailbox via Graph.", "parameters": [ { "name": "InternetMessageId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "RecipientEmail", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ReporterEmail", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListUserReportedMessages": { "get": { "summary": "ListUserReportedMessages", "operationId": "ListUserReportedMessages", "tags": [ "Email-Exchange > Spamfilter" ], "description": "Lists user reported email threat submissions (Defender Submissions with source 'user') for a tenant.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "adminReview": { "type": "object", "x-cipp-field-source": "graph-entity" }, "attackSimulationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Category": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "clientSource": { "type": "object", "x-cipp-field-source": "graph-entity" }, "contentType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdBy": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "internetMessageId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Metadata": { "x-cipp-field-source": "backend" }, "originalCategory": { "type": "object", "x-cipp-field-source": "graph-entity" }, "receivedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "RecipientEmail": { "x-cipp-field-source": "frontend" }, "recipientEmailAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ReportedBy": { "x-cipp-field-source": "frontend" }, "ReportedDateTime": { "x-cipp-field-source": "frontend" }, "result": { "type": "object", "x-cipp-field-source": "graph-entity" }, "ResultCategory": { "x-cipp-field-source": "frontend" }, "Results": { "x-cipp-field-source": "backend" }, "Sender": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "senderIP": { "type": "string", "x-cipp-field-source": "graph-entity" }, "source": { "type": "object", "x-cipp-field-source": "graph-entity" }, "Status": { "type": "object", "x-cipp-field-source": "graph-entity,frontend" }, "Subject": { "type": "string", "x-cipp-field-source": "graph-entity,frontend" }, "Tenant": { "x-cipp-field-source": "frontend" }, "tenantAllowOrBlockListAction": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tenantId": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.Read" } }, "/api/ListUsers": { "get": { "summary": "ListUsers", "operationId": "ListUsers", "tags": [ "Identity > Administration > Users" ], "description": "Lists Entra ID users for a tenant with license and sign-in details, or retrieves a specific user by ID. Supports UseReportDB=true to serve cached users from the reporting database; AllTenants always uses the cache. When manualPagination is set on a cached read, one page is returned per request as { Results, Metadata } with a continuation token in Metadata.nextLink.", "parameters": [ { "name": "graphFilter", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "IncludeLogonDetails", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "manualPagination", "in": "query", "description": "Return one page per request as { Results, Metadata } with a continuation token in Metadata.nextLink; cached reads only.", "required": false, "schema": { "type": "string" } }, { "name": "nextLink", "in": "query", "description": "Continuation token from the previous page's Metadata.nextLink; opaque to callers.", "required": false, "schema": { "type": "string" } }, { "name": "PageSize", "in": "query", "required": false, "schema": { "type": "integer" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UseReportDB", "in": "query", "description": "Serve from the reporting database cache instead of live Graph. AllTenants always uses the cache.", "required": false, "schema": { "type": "boolean" } }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "aboutMe": { "type": "string", "x-cipp-field-source": "graph-entity" }, "accountEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "ageGroup": { "type": "string", "x-cipp-field-source": "graph-entity" }, "assignedLicenses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "assignedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authorizationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "birthday": { "type": "string", "x-cipp-field-source": "graph-entity" }, "businessPhones": { "type": "array", "x-cipp-field-source": "graph-entity" }, "city": { "type": "string", "x-cipp-field-source": "graph-entity" }, "cloudLicensing": { "type": "object", "x-cipp-field-source": "graph-entity" }, "cloudRealtimeCommunicationInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "companyName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "consentProvidedForMinor": { "type": "string", "x-cipp-field-source": "graph-entity" }, "country": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "creationType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "customSecurityAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "department": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deviceEnrollmentLimit": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "deviceKeys": { "type": "array", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeHireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeLeaveDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "employeeOrgData": { "type": "object", "x-cipp-field-source": "graph-entity" }, "employeeType": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserState": { "type": "string", "x-cipp-field-source": "graph-entity" }, "externalUserStateChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "faxNumber": { "type": "string", "x-cipp-field-source": "graph-entity" }, "givenName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "hireDate": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "identityGovernance": { "type": "object", "x-cipp-field-source": "graph-entity" }, "identityParentId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "imAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "infoCatalogs": { "type": "array", "x-cipp-field-source": "graph-entity" }, "interests": { "type": "array", "x-cipp-field-source": "graph-entity" }, "isLicenseReconciliationNeeded": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isManagementRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isResourceAccount": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "jobTitle": { "type": "string", "x-cipp-field-source": "graph-entity" }, "lastPasswordChangeDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "LastSigninApplication": { "x-cipp-field-source": "backend" }, "LastSigninDate": { "x-cipp-field-source": "backend" }, "LastSigninFailureReason": { "x-cipp-field-source": "backend" }, "LastSigninResult": { "x-cipp-field-source": "backend" }, "LastSigninStatus": { "x-cipp-field-source": "backend" }, "legalAgeGroupClassification": { "type": "string", "x-cipp-field-source": "graph-entity" }, "licenseAssignmentStates": { "type": "array", "x-cipp-field-source": "graph-entity" }, "mail": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mailboxSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mailNickname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mobilePhone": { "type": "string", "x-cipp-field-source": "graph-entity" }, "mySite": { "type": "string", "x-cipp-field-source": "graph-entity" }, "officeLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDistinguishedName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesDomainName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesExtensionAttributes": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesImmutableId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesLastSyncDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "onPremisesSamAccountName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSecurityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "onPremisesSipInfo": { "type": "object", "x-cipp-field-source": "graph-entity" }, "onPremisesSyncEnabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "onPremisesUserPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "otherMails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "passwordPolicies": { "type": "string", "x-cipp-field-source": "graph-entity" }, "passwordProfile": { "type": "object", "x-cipp-field-source": "graph-entity" }, "pastProjects": { "type": "array", "x-cipp-field-source": "graph-entity" }, "postalCode": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredDataLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredLanguage": { "type": "string", "x-cipp-field-source": "graph-entity" }, "preferredName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "print": { "type": "object", "x-cipp-field-source": "graph-entity" }, "provisionedPlans": { "type": "array", "x-cipp-field-source": "graph-entity" }, "proxyAddresses": { "type": "array", "x-cipp-field-source": "graph-entity" }, "refreshTokensValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "responsibilities": { "type": "array", "x-cipp-field-source": "graph-entity" }, "schools": { "type": "array", "x-cipp-field-source": "graph-entity" }, "securityIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceProvisioningErrors": { "type": "array", "x-cipp-field-source": "graph-entity" }, "showInAddressList": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "signInActivity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInSessionsValidFromDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "skills": { "type": "array", "x-cipp-field-source": "graph-entity" }, "state": { "type": "string", "x-cipp-field-source": "graph-entity" }, "streetAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "surname": { "type": "string", "x-cipp-field-source": "graph-entity" }, "usageLocation": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListUsersAndGroups": { "get": { "summary": "ListUsersAndGroups", "operationId": "ListUsersAndGroups", "tags": [ "Tenant > Administration > Tenant" ], "description": "Lists both users and groups for a tenant in a single batch call, returning ID and display name for selection/lookup purposes.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.Read" } }, "/api/ListUserSettings": { "get": { "summary": "ListUserSettings", "operationId": "ListUserSettings", "tags": [ "Identity > Administration > Users" ], "description": "Retrieves the current CIPP user's personal settings and preferences.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "currentTheme": { "x-cipp-field-source": "backend" }, "direction": { "x-cipp-field-source": "backend" }, "paletteMode": { "x-cipp-field-source": "backend" }, "pinNav": { "x-cipp-field-source": "backend" }, "showDevtools": { "x-cipp-field-source": "backend" } } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read", "x-cipp-any-tenant": true } }, "/api/ListUserSigninLogs": { "get": { "summary": "ListUserSigninLogs", "operationId": "ListUserSigninLogs", "tags": [ "Identity > Administration > Users" ], "description": "Lists recent sign-in log entries for a specific Entra ID user, ordered by most recent.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "top", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "agent": { "type": "object", "x-cipp-field-source": "graph-entity" }, "appDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appliedConditionalAccessPolicies": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appliedEventListeners": { "type": "array", "x-cipp-field-source": "graph-entity" }, "appOwnerTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "appTokenProtectionStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "authenticationAppDeviceDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "authenticationAppPolicyEvaluationDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationContextClassReferences": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationMethodsUsed": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationProcessingDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationProtocol": { "type": "object", "x-cipp-field-source": "graph-entity" }, "authenticationRequirement": { "type": "string", "x-cipp-field-source": "graph-entity" }, "authenticationRequirementPolicies": { "type": "array", "x-cipp-field-source": "graph-entity" }, "autonomousSystemNumber": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "azureResourceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "clientAppUsed": { "type": "string", "x-cipp-field-source": "graph-entity" }, "clientCredentialType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "clientSessionId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "conditionalAccessAudiences": { "type": "array", "x-cipp-field-source": "graph-entity" }, "conditionalAccessStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "correlationId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "crossTenantAccessType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "deviceDetail": { "type": "object", "x-cipp-field-source": "graph-entity" }, "federatedCredentialId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "flaggedForReview": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "globalSecureAccessIpAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "homeTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "homeTenantName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "incomingTokenType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "ipAddress": { "type": "string", "x-cipp-field-source": "graph-entity" }, "ipAddressFromResourceProvider": { "type": "string", "x-cipp-field-source": "graph-entity" }, "isInteractive": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isTenantRestricted": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isThroughGlobalSecureAccess": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "location": { "type": "object", "x-cipp-field-source": "graph-entity" }, "managedServiceIdentity": { "type": "object", "x-cipp-field-source": "graph-entity" }, "mfaDetail": { "type": "object", "x-cipp-field-source": "graph-entity" }, "networkLocationDetails": { "type": "array", "x-cipp-field-source": "graph-entity" }, "originalRequestId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "originalTransferMethod": { "type": "object", "x-cipp-field-source": "graph-entity" }, "privateLinkDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "processingTimeInMilliseconds": { "type": "integer", "x-cipp-field-source": "graph-entity" }, "resourceDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceOwnerTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceServicePrincipalId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "resourceTenantId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "riskDetail": { "type": "object", "x-cipp-field-source": "graph-entity" }, "riskEventTypes_v2": { "type": "array", "x-cipp-field-source": "graph-entity" }, "riskLevelAggregated": { "type": "object", "x-cipp-field-source": "graph-entity" }, "riskLevelDuringSignIn": { "type": "object", "x-cipp-field-source": "graph-entity" }, "riskState": { "type": "object", "x-cipp-field-source": "graph-entity" }, "servicePrincipalCredentialKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalCredentialThumbprint": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sessionId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "sessionLifetimePolicies": { "type": "array", "x-cipp-field-source": "graph-entity" }, "signInEventTypes": { "type": "array", "x-cipp-field-source": "graph-entity" }, "signInIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "signInIdentifierType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInTokenProtectionStatus": { "type": "object", "x-cipp-field-source": "graph-entity" }, "status": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tokenIssuerName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "tokenIssuerType": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tokenProtectionStatusDetails": { "type": "object", "x-cipp-field-source": "graph-entity" }, "uniqueTokenIdentifier": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userAgent": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userDisplayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userPrincipalName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "userType": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.Read" } }, "/api/ListUserTrustedBlockedSenders": { "get": { "summary": "ListUserTrustedBlockedSenders", "operationId": "ListUserTrustedBlockedSenders", "tags": [ "Identity > Administration > Users" ], "description": "Lists trusted and blocked sender entries configured for a specific user's Exchange Online mailbox junk email settings.", "parameters": [ { "$ref": "#/components/parameters/tenantFilter" }, { "name": "UserID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "userPrincipalName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.Read" } }, "/api/ListWebhookAlert": { "get": { "summary": "ListWebhookAlert", "operationId": "ListWebhookAlert", "tags": [ "Tenant > Administration > Alerts" ], "description": "Lists configured webhook alert rules that trigger on specific audit log events.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AffectedUser": { "x-cipp-field-source": "storage" }, "AlertText": { "x-cipp-field-source": "storage" }, "AlertTitle": { "x-cipp-field-source": "storage" }, "Data": { "type": "string", "x-cipp-field-source": "storage" }, "email": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "includeTenantId": { "x-cipp-field-source": "storage" }, "onePerTenant": { "type": "boolean", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "PSAConsolidationKey": { "x-cipp-field-source": "storage" }, "PsaTicketId": { "x-cipp-field-source": "storage" }, "PsaTicketPriority": { "x-cipp-field-source": "storage" }, "Reference": { "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "schedule": { "x-cipp-field-source": "storage" }, "sendtoIntegration": { "type": "boolean", "x-cipp-field-source": "storage" }, "Severity": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "storage" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Title": { "x-cipp-field-source": "storage" }, "type": { "x-cipp-field-source": "storage" }, "UseStandardizedSchema": { "type": "boolean", "x-cipp-field-source": "storage" }, "webhook": { "x-cipp-field-source": "storage" }, "webhookAuthHeaderName": { "x-cipp-field-source": "storage" }, "webhookAuthHeaders": { "x-cipp-field-source": "storage" }, "webhookAuthHeaderValue": { "x-cipp-field-source": "storage" }, "webhookAuthPassword": { "x-cipp-field-source": "storage" }, "webhookAuthToken": { "x-cipp-field-source": "storage" }, "webhookAuthType": { "x-cipp-field-source": "storage" }, "webhookAuthUsername": { "x-cipp-field-source": "storage" } } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.Read" } }, "/api/ListWorkerHealth": { "get": { "summary": "ListWorkerHealth", "operationId": "ListWorkerHealth", "tags": [ "CIPP > Settings" ], "description": "Retrieves health status and diagnostics for CIPP background worker processes. Requires SuperAdmin access.", "parameters": [ { "name": "Action", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "JobId", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "Limit", "in": "query", "required": false, "schema": { "type": "integer" } }, { "name": "MaxPoints", "in": "query", "required": false, "schema": { "type": "integer" } }, { "name": "Minutes", "in": "query", "required": false, "schema": { "type": "integer" } }, { "name": "PoolType", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Priority", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "RunName", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "Status", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.SuperAdmin.Read", "x-cipp-any-tenant": true } }, "/api/PatchUser": { "post": { "summary": "PatchUser", "operationId": "PatchUser", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "additionalProperties": true, "x-cipp-passthrough": true, "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted." } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/PublicMcpRegister": { "post": { "summary": "Anonymous RFC 7591 dynamic client registration endpoint for MCP clients.", "operationId": "PublicMcpRegister", "tags": [ "CIPP > MCP" ], "description": "Entra ID offers no registration endpoint, but MCP clients (Claude, ChatGPT, VS Code)\nattempt dynamic client registration as the first step of connecting with only a URL. This\nendpoint closes that gap without any token handling: it validates the requested redirect\nURIs against the known MCP client allowlist and answers with the EXISTING MCP resource app\nregistration's client ID as a public (PKCE) client. Nothing is created or modified in\nEntra, and no secret is ever issued — Entra still enforces redirect URIs at authorize time\nand issues all tokens, which EasyAuth validates as always. A client ID is public\ninformation by OAuth design, so handing it out anonymously discloses nothing sensitive;\nRBAC on the MCP endpoint itself is unchanged.\n\nClients find this endpoint via the registration_endpoint field of the authorization server\nmetadata document Craft serves from the CRAFT_PRM_AS app setting, which SaveToAzure in\nInvoke-ExecApiClient composes. The route name starts with 'Public' so it rides the existing\n/api/Public* EasyAuth exclusion.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "client_name": { "type": "string" }, "redirect_uris": { "type": "string" } } } } } }, "parameters": [ { "name": "client", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "addIns": { "type": "array", "x-cipp-field-source": "graph-entity" }, "api": { "type": "object", "x-cipp-field-source": "graph-entity" }, "appId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "applicationTemplateId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "AppName": { "x-cipp-field-source": "storage" }, "appRoles": { "type": "array", "x-cipp-field-source": "graph-entity" }, "authenticationBehaviors": { "type": "object", "x-cipp-field-source": "graph-entity" }, "certification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdByAppId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "defaultRedirectUri": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "disabledByMicrosoftStatus": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Enabled": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "groupMembershipClaims": { "type": "string", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "identifierUris": { "type": "array", "x-cipp-field-source": "graph-entity" }, "info": { "type": "object", "x-cipp-field-source": "graph-entity" }, "IPRange": { "x-cipp-field-source": "storage" }, "isDeviceOnlyAuthSupported": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isDisabled": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "isFallbackPublicClient": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "keyCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "logo": { "type": "string", "x-cipp-field-source": "graph-entity" }, "managerApplications": { "type": "array", "x-cipp-field-source": "graph-entity" }, "MCPAllowed": { "type": "boolean", "x-cipp-field-source": "storage" }, "nativeAuthenticationApisEnabled": { "type": "object", "x-cipp-field-source": "graph-entity" }, "notes": { "type": "string", "x-cipp-field-source": "graph-entity" }, "oauth2RequirePostResponse": { "type": "boolean", "x-cipp-field-source": "graph-entity" }, "optionalClaims": { "type": "object", "x-cipp-field-source": "graph-entity" }, "parentalControlSettings": { "type": "object", "x-cipp-field-source": "graph-entity" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "passwordCredentials": { "type": "array", "x-cipp-field-source": "graph-entity" }, "publicClient": { "type": "object", "x-cipp-field-source": "graph-entity" }, "publisherDomain": { "type": "string", "x-cipp-field-source": "graph-entity" }, "requestSignatureVerification": { "type": "object", "x-cipp-field-source": "graph-entity" }, "requiredResourceAccess": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Role": { "type": "string", "x-cipp-field-source": "storage" }, "RowKey": { "x-cipp-field-source": "storage" }, "samlMetadataUrl": { "type": "string", "x-cipp-field-source": "graph-entity" }, "serviceManagementReference": { "type": "string", "x-cipp-field-source": "graph-entity" }, "servicePrincipalLockConfiguration": { "type": "object", "x-cipp-field-source": "graph-entity" }, "signInAudience": { "type": "string", "x-cipp-field-source": "graph-entity" }, "spa": { "type": "object", "x-cipp-field-source": "graph-entity" }, "tags": { "type": "array", "x-cipp-field-source": "graph-entity" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "tokenEncryptionKeyId": { "type": "string", "x-cipp-field-source": "graph-entity" }, "uniqueName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "verifiedPublisher": { "type": "object", "x-cipp-field-source": "graph-entity" }, "web": { "type": "object", "x-cipp-field-source": "graph-entity" } } } } } }, "201": { "description": "Created" }, "204": { "description": "NoContent" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "405": { "description": "MethodNotAllowed" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Public", "x-cipp-any-tenant": true } }, "/api/PublicPhishingCheck": { "post": { "summary": "PublicPhishingCheck", "operationId": "PublicPhishingCheck", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "AlertMessage": { "type": "string" }, "Cloned": { "type": "string" }, "reason": { "type": "string" }, "score": { "type": "string" }, "source": { "type": "string" }, "TenantId": { "type": "string" }, "threshold": { "type": "string" }, "type": { "type": "string" }, "url": { "type": "string" }, "userDisplayName": { "type": "string" }, "userEmail": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Public" } }, "/api/PublicPing": { "get": { "summary": "PublicPing", "operationId": "PublicPing", "tags": [ "CIPP > Core" ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Public" } }, "/api/PublicWebhooks": { "post": { "summary": "PublicWebhooks", "operationId": "PublicWebhooks", "tags": [ "Tenant > Administration > Alerts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "validationCode": { "type": "string" }, "value": { "type": "string", "description": "Graph Subscriptions" } } } } } }, "parameters": [ { "name": "CIPPID", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string", "x-cipp-observed-values": [ "GraphSubscription", "PartnerCenter" ] } }, { "name": "validationCode", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ValidationToken", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Public" } }, "/api/RemoveAPDevice": { "post": { "summary": "RemoveAPDevice", "operationId": "RemoveAPDevice", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/RemoveApp": { "post": { "summary": "RemoveApp", "operationId": "RemoveApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite" } }, "/api/RemoveAppTemplate": { "post": { "summary": "RemoveAppTemplate", "operationId": "RemoveAppTemplate", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveAssignmentFilterTemplate": { "post": { "summary": "RemoveAssignmentFilterTemplate", "operationId": "RemoveAssignmentFilterTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveAutopilotConfig": { "post": { "summary": "RemoveAutopilotConfig", "operationId": "RemoveAutopilotConfig", "tags": [ "Endpoint > Autopilot" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "assignments": { "type": "string" }, "displayName": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "ID", "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Autopilot.ReadWrite" } }, "/api/RemoveBaseline": { "post": { "summary": "RemoveBaseline", "operationId": "RemoveBaseline", "tags": [ "Tenant > Standards" ], "description": "Deletes a baseline with its rollout state, delta rows, and resolved rows - the\nalignment view reflects the removal immediately.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } }, "required": [ "ID" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Baselines.ReadWrite" } }, "/api/RemoveCAPolicy": { "post": { "summary": "RemoveCAPolicy", "operationId": "RemoveCAPolicy", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.", "properties": { "conditions": { "type": "object", "x-cipp-field-source": "graph-entity" }, "createdDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "deletedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "description": { "type": "string", "x-cipp-field-source": "graph-entity" }, "displayName": { "type": "string", "x-cipp-field-source": "graph-entity" }, "grantControls": { "type": "object", "x-cipp-field-source": "graph-entity" }, "id": { "type": "string", "x-cipp-field-source": "graph-entity" }, "modifiedDateTime": { "type": "string", "x-cipp-field-source": "graph-entity" }, "Results": { "x-cipp-field-source": "backend" }, "sessionControls": { "type": "object", "x-cipp-field-source": "graph-entity" }, "state": { "type": "object", "x-cipp-field-source": "graph-entity" }, "templateId": { "type": "string", "x-cipp-field-source": "graph-entity" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/RemoveCATemplate": { "post": { "summary": "RemoveCATemplate", "operationId": "RemoveCATemplate", "tags": [ "Tenant > Conditional" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.ConditionalAccess.ReadWrite" } }, "/api/RemoveCippQueue": { "post": { "summary": "RemoveCippQueue", "operationId": "RemoveCippQueue", "tags": [ "CIPP > Core" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Core.ReadWrite" } }, "/api/RemoveConnectionfilterTemplate": { "post": { "summary": "RemoveConnectionfilterTemplate", "operationId": "RemoveConnectionfilterTemplate", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.ConnectionFilter.ReadWrite" } }, "/api/RemoveContact": { "post": { "summary": "RemoveContact", "operationId": "RemoveContact", "tags": [ "Email-Exchange > Administration > Contacts" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "Mail": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } }, { "name": "Mail", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite" } }, "/api/RemoveContactTemplates": { "post": { "summary": "RemoveContactTemplates", "operationId": "RemoveContactTemplates", "tags": [ "Email-Exchange > Administration > Contacts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Contact.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveCustomScript": { "post": { "summary": "RemoveCustomScript", "operationId": "RemoveCustomScript", "tags": [ "Tools > Custom-Scripts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ScriptGuid": { "type": "string" } } } } } }, "parameters": [ { "name": "ScriptGuid", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Tests.ReadWrite" } }, "/api/RemoveDeletedObject": { "post": { "summary": "RemoveDeletedObject", "operationId": "RemoveDeletedObject", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "displayName": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "userPrincipalName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Directory.ReadWrite" } }, "/api/RemoveDlpCompliancePolicy": { "post": { "summary": "RemoveDlpCompliancePolicy", "operationId": "RemoveDlpCompliancePolicy", "tags": [ "Security > Compliance-DLP" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" } }, "/api/RemoveDlpCompliancePolicyTemplate": { "post": { "summary": "RemoveDlpCompliancePolicyTemplate", "operationId": "RemoveDlpCompliancePolicyTemplate", "tags": [ "Security > Compliance-DLP" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.DlpCompliancePolicy.ReadWrite" } }, "/api/RemoveExConnector": { "post": { "summary": "RemoveExConnector", "operationId": "RemoveExConnector", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string" }, "tenantFilter": { "type": "string" }, "Type": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "GUID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "Type", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.ReadWrite" } }, "/api/RemoveExConnectorTemplate": { "post": { "summary": "RemoveExConnectorTemplate", "operationId": "RemoveExConnectorTemplate", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Connector.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveGroupTemplate": { "post": { "summary": "RemoveGroupTemplate", "operationId": "RemoveGroupTemplate", "tags": [ "Identity > Administration > Groups" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Group.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveIntuneReusableSetting": { "post": { "summary": "RemoveIntuneReusableSetting", "operationId": "RemoveIntuneReusableSetting", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "DisplayName": { "type": "string" }, "ID": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "ID", "tenantFilter" ] } } } }, "parameters": [ { "name": "DisplayName", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/RemoveIntuneReusableSettingTemplate": { "post": { "summary": "RemoveIntuneReusableSettingTemplate", "operationId": "RemoveIntuneReusableSettingTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveIntuneScript": { "post": { "summary": "RemoveIntuneScript", "operationId": "RemoveIntuneScript", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "DisplayName": { "type": "string" }, "ID": { "type": "string" }, "ScriptType": { "type": "string", "enum": [ "Linux", "MacOS", "Remediation", "Windows" ] }, "TenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "TenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/RemoveIntuneTemplate": { "post": { "summary": "RemoveIntuneTemplate", "operationId": "RemoveIntuneTemplate", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/RemoveJITAdminTemplate": { "post": { "summary": "RemoveJITAdminTemplate", "operationId": "RemoveJITAdminTemplate", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/RemoveJITRoleTemplate": { "post": { "summary": "RemoveJITRoleTemplate", "operationId": "RemoveJITRoleTemplate", "tags": [ "Identity > Administration > Users" ], "description": "Deletes a JIT Role Template.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite" } }, "/api/RemovePIMRoleSettingsTemplate": { "post": { "summary": "Delete a PIM role settings template.", "operationId": "RemovePIMRoleSettingsTemplate", "tags": [ "Identity > Administration > Roles" ], "description": "Deletes a saved Privileged Identity Management role settings template by GUID. Tenants already configured from the template keep their settings.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "GUID": { "type": "string", "description": "GUID of the template to delete." }, "ID": { "type": "string", "description": "GUID of the template to delete." } } } } } }, "parameters": [ { "name": "ID", "in": "query", "description": "GUID of the template to delete.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.Role.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemovePolicy": { "post": { "summary": "RemovePolicy", "operationId": "RemovePolicy", "tags": [ "Endpoint > MEM" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "URLName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "URLName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.MEM.ReadWrite" } }, "/api/RemoveQuarantinePolicy": { "post": { "summary": "RemoveQuarantinePolicy", "operationId": "RemoveQuarantinePolicy", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "TenantFilter": { "type": "string" } }, "required": [ "TenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "Name", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Spamfilter.ReadWrite" } }, "/api/RemoveQueuedAlert": { "post": { "summary": "RemoveQueuedAlert", "operationId": "RemoveQueuedAlert", "tags": [ "Tenant > Administration > Alerts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "EventType": { "type": "string", "description": "Interact with the query or body of the request" }, "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "EventType", "in": "query", "description": "Interact with the query or body of the request", "required": false, "schema": { "type": "string" } }, { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite" } }, "/api/RemoveQueuedApp": { "post": { "summary": "RemoveQueuedApp", "operationId": "RemoveQueuedApp", "tags": [ "Endpoint > Applications" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Endpoint.Application.ReadWrite" } }, "/api/RemoveRetentionCompliancePolicy": { "post": { "summary": "RemoveRetentionCompliancePolicy", "operationId": "RemoveRetentionCompliancePolicy", "tags": [ "Security > Compliance-Retention" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ForceDeletion": { "type": "boolean" }, "Identity": { "type": "string" }, "Name": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.ReadWrite" } }, "/api/RemoveRetentionCompliancePolicyTemplate": { "post": { "summary": "RemoveRetentionCompliancePolicyTemplate", "operationId": "RemoveRetentionCompliancePolicyTemplate", "tags": [ "Security > Compliance-Retention" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.RetentionCompliancePolicy.ReadWrite" } }, "/api/RemoveSafeLinksPolicyTemplate": { "post": { "summary": "RemoveSafeLinksPolicyTemplate", "operationId": "RemoveSafeLinksPolicyTemplate", "tags": [ "Security > Safe-Links-Policy" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SafeLinks.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveScheduledItem": { "post": { "summary": "RemoveScheduledItem", "operationId": "RemoveScheduledItem", "tags": [ "CIPP > Scheduler" ], "description": "Removes a scheduled item from CIPP's scheduler.", "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" } } } } } }, "parameters": [ { "name": "id", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Scheduler.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveSensitiveInfoType": { "post": { "summary": "RemoveSensitiveInfoType", "operationId": "RemoveSensitiveInfoType", "tags": [ "Security > Compliance-SIT" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.ReadWrite" } }, "/api/RemoveSensitiveInfoTypeTemplate": { "post": { "summary": "RemoveSensitiveInfoTypeTemplate", "operationId": "RemoveSensitiveInfoTypeTemplate", "tags": [ "Security > Compliance-SIT" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitiveInfoType.ReadWrite" } }, "/api/RemoveSensitivityLabel": { "post": { "summary": "RemoveSensitivityLabel", "operationId": "RemoveSensitivityLabel", "tags": [ "Security > Compliance-SensitivityLabel" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Identity": { "type": "string" }, "Name": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "Identity", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.ReadWrite" } }, "/api/RemoveSensitivityLabelTemplate": { "post": { "summary": "RemoveSensitivityLabelTemplate", "operationId": "RemoveSensitivityLabelTemplate", "tags": [ "Security > Compliance-SensitivityLabel" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Security.SensitivityLabel.ReadWrite" } }, "/api/RemoveSpamfilter": { "post": { "summary": "RemoveSpamfilter", "operationId": "RemoveSpamfilter", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" } } } } } }, "parameters": [ { "name": "name", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Spamfilter.ReadWrite" } }, "/api/RemoveSpamfilterTemplate": { "post": { "summary": "RemoveSpamfilterTemplate", "operationId": "RemoveSpamfilterTemplate", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Spamfilter.ReadWrite" } }, "/api/RemoveStandard": { "post": { "summary": "RemoveStandard", "operationId": "RemoveStandard", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "ID", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.", "properties": { "Results": { "x-cipp-field-source": "backend" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/RemoveStandardTemplate": { "post": { "summary": "RemoveStandardTemplate", "operationId": "RemoveStandardTemplate", "tags": [ "Tenant > Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string", "description": "Interact with query parameters or the body of the request." } } } } } }, "parameters": [ { "name": "ID", "in": "query", "description": "Interact with query parameters or the body of the request.", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Standards.ReadWrite" } }, "/api/RemoveTenantAllowBlockList": { "post": { "summary": "RemoveTenantAllowBlockList", "operationId": "RemoveTenantAllowBlockList", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "Entries": { "type": "string" }, "ListType": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite" } }, "/api/RemoveTenantAllowBlockListTemplate": { "post": { "summary": "RemoveTenantAllowBlockListTemplate", "operationId": "RemoveTenantAllowBlockListTemplate", "tags": [ "Email-Exchange > Spamfilter" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.SpamFilter.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveTenantCapabilitiesCache": { "post": { "summary": "RemoveTenantCapabilitiesCache", "operationId": "RemoveTenantCapabilitiesCache", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "defaultDomainName": { "type": "string", "description": "Get the tenant identifier from the request body (POST) or query (legacy GET)." } }, "required": [ "defaultDomainName" ] } } } }, "parameters": [ { "name": "defaultDomainName", "in": "query", "description": "Get the tenant identifier from the request body (POST) or query (legacy GET).", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "JSON": { "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" } } } } } }, "400": { "description": "Bad request - missing required field or invalid input" }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveTransportRule": { "post": { "summary": "RemoveTransportRule", "operationId": "RemoveTransportRule", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "guid": { "type": "string" }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "guid", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.ReadWrite" } }, "/api/RemoveTransportRuleTemplate": { "post": { "summary": "RemoveTransportRuleTemplate", "operationId": "RemoveTransportRuleTemplate", "tags": [ "Email-Exchange > Transport" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.TransportRule.ReadWrite", "x-cipp-any-tenant": true } }, "/api/RemoveTrustedBlockedSender": { "post": { "summary": "RemoveTrustedBlockedSender", "operationId": "RemoveTrustedBlockedSender", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenantFilter": { "type": "string", "description": "Interact with the query or body of the request" }, "typeProperty": { "type": "string" }, "userPrincipalName": { "type": "string" }, "value": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Exchange.Mailbox.ReadWrite" } }, "/api/RemoveUser": { "post": { "summary": "RemoveUser", "operationId": "RemoveUser", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" }, "tenantFilter": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "userPrincipalName": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" }, { "name": "userPrincipalName", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/RemoveUserDefaultTemplate": { "post": { "summary": "RemoveUserDefaultTemplate", "operationId": "RemoveUserDefaultTemplate", "tags": [ "Identity > Administration > Users" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "ID": { "type": "string" } } } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StandardResults" } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "404": { "description": "Not found" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Identity.User.ReadWrite" } }, "/api/RemoveWebhookAlert": { "post": { "summary": "RemoveWebhookAlert", "operationId": "RemoveWebhookAlert", "tags": [ "Tenant > Administration > Alerts" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "parameters": [ { "name": "ID", "in": "query", "required": false, "schema": { "type": "string" } }, { "$ref": "#/components/parameters/tenantFilter" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.", "properties": { "AffectedUser": { "x-cipp-field-source": "storage" }, "AlertText": { "x-cipp-field-source": "storage" }, "AlertTitle": { "x-cipp-field-source": "storage" }, "Data": { "type": "string", "x-cipp-field-source": "storage" }, "email": { "x-cipp-field-source": "storage" }, "ETag": { "type": "string", "x-cipp-field-source": "storage" }, "includeTenantId": { "x-cipp-field-source": "storage" }, "onePerTenant": { "type": "boolean", "x-cipp-field-source": "storage" }, "PartitionKey": { "x-cipp-field-source": "storage" }, "PSAConsolidationKey": { "x-cipp-field-source": "storage" }, "PsaTicketId": { "x-cipp-field-source": "storage" }, "PsaTicketPriority": { "x-cipp-field-source": "storage" }, "Reference": { "x-cipp-field-source": "storage" }, "Results": { "x-cipp-field-source": "backend" }, "RowKey": { "x-cipp-field-source": "storage" }, "schedule": { "x-cipp-field-source": "storage" }, "sendtoIntegration": { "type": "boolean", "x-cipp-field-source": "storage" }, "Severity": { "type": "string", "x-cipp-field-source": "storage" }, "Tenant": { "x-cipp-field-source": "storage" }, "TenantId": { "x-cipp-field-source": "storage" }, "Timestamp": { "type": "string", "x-cipp-field-source": "storage" }, "Title": { "x-cipp-field-source": "storage" }, "type": { "x-cipp-field-source": "storage" }, "UseStandardizedSchema": { "type": "boolean", "x-cipp-field-source": "storage" }, "webhook": { "x-cipp-field-source": "storage" }, "webhookAuthHeaderName": { "x-cipp-field-source": "storage" }, "webhookAuthHeaders": { "x-cipp-field-source": "storage" }, "webhookAuthHeaderValue": { "x-cipp-field-source": "storage" }, "webhookAuthPassword": { "x-cipp-field-source": "storage" }, "webhookAuthToken": { "x-cipp-field-source": "storage" }, "webhookAuthType": { "x-cipp-field-source": "storage" }, "webhookAuthUsername": { "x-cipp-field-source": "storage" } } } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "CIPP.Alert.ReadWrite" } }, "/api/SetAuthMethod": { "post": { "summary": "SetAuthMethod", "operationId": "SetAuthMethod", "tags": [ "Tenant > Administration > Tenant" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "GroupIds": { "type": "string" }, "Id": { "type": "string" }, "state": { "type": "string", "description": "Interact with query parameters or the body of the request." }, "tenantFilter": { "type": "string" } }, "required": [ "tenantFilter" ] } } } }, "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides." } } } }, "401": { "description": "Unauthorized - invalid or missing bearer token" }, "403": { "description": "Forbidden - caller lacks the required RBAC role" }, "500": { "description": "Internal server error" } }, "security": [ { "bearerAuth": [] } ], "x-cipp-role": "Tenant.Administration.ReadWrite" } } } }