openapi: 3.1.0
info:
  title: Microsoft Graph Identity Applications API
  description: The Microsoft Graph Identity API provides a unified programmability model for managing Azure Active Directory (Microsoft Entra ID) resources including users, groups, applications, and service principals. This specification covers the core identity and access management endpoints available through the Microsoft Graph v1.0 REST API.
  version: 1.0.0
  contact:
    name: Microsoft Graph Support
    url: https://developer.microsoft.com/en-us/graph
    email: graphdev@microsoft.com
  license:
    name: Microsoft API License
    url: https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use
  x-api-id: microsoft-graph-identity
  x-audience: external-public
servers:
- url: https://graph.microsoft.com/v1.0
  description: Microsoft Graph v1.0 production endpoint
- url: https://graph.microsoft.com/beta
  description: Microsoft Graph beta endpoint (preview features)
security:
- oauth2:
  - User.Read
  - User.ReadWrite.All
  - Directory.Read.All
  - Directory.ReadWrite.All
tags:
- name: Applications
  description: Manage application registrations in Azure Active Directory. An application object is the global representation of an application across all tenants, defining the app identity, access configuration, and capabilities.
  externalDocs:
    url: https://learn.microsoft.com/en-us/graph/api/resources/application?view=graph-rest-1.0
paths:
  /applications:
    get:
      operationId: listApplications
      summary: List Applications
      description: Get the list of application registrations in the organization. By default, returns a limited set of properties. Use $select to request additional properties.
      tags:
      - Applications
      parameters:
      - $ref: '#/components/parameters/top'
      - $ref: '#/components/parameters/skip'
      - $ref: '#/components/parameters/search'
      - $ref: '#/components/parameters/filter'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/orderby'
      - $ref: '#/components/parameters/select'
      - $ref: '#/components/parameters/consistencyLevel'
      responses:
        '200':
          description: A collection of application objects.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@odata.context':
                    type: string
                  '@odata.nextLink':
                    type: string
                    format: uri
                  '@odata.count':
                    type: integer
                  value:
                    type: array
                    items:
                      $ref: '#/components/schemas/Application'
              examples:
                Listapplications200Example:
                  summary: Default listApplications 200 response
                  x-microcks-default: true
                  value:
                    '@odata.context': example_value
                    '@odata.nextLink': https://www.example.com
                    '@odata.count': 10
                    value:
                    - appId: '500123'
                      displayName: example_value
                      description: A sample description.
                      createdDateTime: '2026-01-15T10:30:00Z'
                      identifierUris:
                      - {}
                      keyCredentials:
                      - {}
                      passwordCredentials:
                      - {}
                      appRoles:
                      - {}
                      requiredResourceAccess:
                      - {}
                      signInAudience: AzureADMyOrg
                      tags:
                      - {}
                      publisherDomain: example_value
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      security:
      - oauth2:
        - Application.Read.All
        - Directory.Read.All
      externalDocs:
        url: https://learn.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createApplication
      summary: Create Application
      description: Create a new application registration. The request body must contain the displayName property at minimum.
      tags:
      - Applications
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationCreate'
            examples:
              CreateapplicationRequestExample:
                summary: Default createApplication request
                x-microcks-default: true
                value:
                  displayName: example_value
                  description: A sample description.
                  signInAudience: AzureADMyOrg
                  identifierUris:
                  - example_value
                  web:
                    homePageUrl: https://www.example.com
                    logoutUrl: https://www.example.com
                    redirectUris:
                    - {}
                    implicitGrantSettings:
                      enableAccessTokenIssuance: true
                      enableIdTokenIssuance: true
                  spa:
                    redirectUris:
                    - {}
                  publicClient:
                    redirectUris:
                    - {}
                  api:
                    acceptMappedClaims: example_value
                    knownClientApplications:
                    - {}
                    oauth2PermissionScopes:
                    - {}
                    preAuthorizedApplications:
                    - {}
                    requestedAccessTokenVersion: 1
                  appRoles:
                  - allowedMemberTypes: {}
                    description: A sample description.
                    displayName: example_value
                    id: abc123
                    isEnabled: true
                    value: example_value
                  requiredResourceAccess:
                  - resourceAppId: '500123'
                    resourceAccess: {}
                  tags:
                  - example_value
      responses:
        '201':
          description: The created application object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
              examples:
                Createapplication201Example:
                  summary: Default createApplication 201 response
                  x-microcks-default: true
                  value:
                    appId: '500123'
                    displayName: example_value
                    description: A sample description.
                    createdDateTime: '2026-01-15T10:30:00Z'
                    identifierUris:
                    - https://www.example.com
                    keyCredentials:
                    - customKeyIdentifier: example_value
                      displayName: example_value
                      endDateTime: '2026-01-15T10:30:00Z'
                      key: example_value
                      keyId: '500123'
                      startDateTime: '2026-01-15T10:30:00Z'
                      type: example_value
                      usage: Sign
                    passwordCredentials:
                    - customKeyIdentifier: example_value
                      displayName: example_value
                      endDateTime: '2026-01-15T10:30:00Z'
                      hint: example_value
                      keyId: '500123'
                      secretText: example_value
                      startDateTime: '2026-01-15T10:30:00Z'
                    api:
                      acceptMappedClaims: example_value
                      knownClientApplications:
                      - {}
                      oauth2PermissionScopes:
                      - {}
                      preAuthorizedApplications:
                      - {}
                      requestedAccessTokenVersion: 1
                    appRoles:
                    - allowedMemberTypes: {}
                      description: A sample description.
                      displayName: example_value
                      id: abc123
                      isEnabled: true
                      value: example_value
                    requiredResourceAccess:
                    - resourceAppId: '500123'
                      resourceAccess: {}
                    signInAudience: AzureADMyOrg
                    spa:
                      redirectUris:
                      - {}
                    web:
                      homePageUrl: https://www.example.com
                      logoutUrl: https://www.example.com
                      redirectUris:
                      - {}
                      implicitGrantSettings:
                        enableAccessTokenIssuance: true
                        enableIdTokenIssuance: true
                    publicClient:
                      redirectUris:
                      - {}
                    tags:
                    - example_value
                    publisherDomain: example_value
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      security:
      - oauth2:
        - Application.ReadWrite.All
        - Directory.ReadWrite.All
      externalDocs:
        url: https://learn.microsoft.com/en-us/graph/api/application-post-applications?view=graph-rest-1.0
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /applications/{application-id}:
    get:
      operationId: getApplication
      summary: Get Application
      description: Get the properties and relationships of an application object.
      tags:
      - Applications
      parameters:
      - $ref: '#/components/parameters/applicationId'
      - $ref: '#/components/parameters/select'
      - $ref: '#/components/parameters/expand'
      responses:
        '200':
          description: The requested application object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
              examples:
                Getapplication200Example:
                  summary: Default getApplication 200 response
                  x-microcks-default: true
                  value:
                    appId: '500123'
                    displayName: example_value
                    description: A sample description.
                    createdDateTime: '2026-01-15T10:30:00Z'
                    identifierUris:
                    - https://www.example.com
                    keyCredentials:
                    - customKeyIdentifier: example_value
                      displayName: example_value
                      endDateTime: '2026-01-15T10:30:00Z'
                      key: example_value
                      keyId: '500123'
                      startDateTime: '2026-01-15T10:30:00Z'
                      type: example_value
                      usage: Sign
                    passwordCredentials:
                    - customKeyIdentifier: example_value
                      displayName: example_value
                      endDateTime: '2026-01-15T10:30:00Z'
                      hint: example_value
                      keyId: '500123'
                      secretText: example_value
                      startDateTime: '2026-01-15T10:30:00Z'
                    api:
                      acceptMappedClaims: example_value
                      knownClientApplications:
                      - {}
                      oauth2PermissionScopes:
                      - {}
                      preAuthorizedApplications:
                      - {}
                      requestedAccessTokenVersion: 1
                    appRoles:
                    - allowedMemberTypes: {}
                      description: A sample description.
                      displayName: example_value
                      id: abc123
                      isEnabled: true
                      value: example_value
                    requiredResourceAccess:
                    - resourceAppId: '500123'
                      resourceAccess: {}
                    signInAudience: AzureADMyOrg
                    spa:
                      redirectUris:
                      - {}
                    web:
                      homePageUrl: https://www.example.com
                      logoutUrl: https://www.example.com
                      redirectUris:
                      - {}
                      implicitGrantSettings:
                        enableAccessTokenIssuance: true
                        enableIdTokenIssuance: true
                    publicClient:
                      redirectUris:
                      - {}
                    tags:
                    - example_value
                    publisherDomain: example_value
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - oauth2:
        - Application.Read.All
        - Directory.Read.All
      externalDocs:
        url: https://learn.microsoft.com/en-us/graph/api/application-get?view=graph-rest-1.0
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    patch:
      operationId: updateApplication
      summary: Update Application
      description: Update the properties of an application object.
      tags:
      - Applications
      parameters:
      - $ref: '#/components/parameters/applicationId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationUpdate'
            examples:
              UpdateapplicationRequestExample:
                summary: Default updateApplication request
                x-microcks-default: true
                value:
                  displayName: example_value
                  description: A sample description.
                  signInAudience: example_value
                  identifierUris:
                  - example_value
                  web:
                    homePageUrl: https://www.example.com
                    logoutUrl: https://www.example.com
                    redirectUris:
                    - {}
                    implicitGrantSettings:
                      enableAccessTokenIssuance: true
                      enableIdTokenIssuance: true
                  spa:
                    redirectUris:
                    - {}
                  publicClient:
                    redirectUris:
                    - {}
                  api:
                    acceptMappedClaims: example_value
                    knownClientApplications:
                    - {}
                    oauth2PermissionScopes:
                    - {}
                    preAuthorizedApplications:
                    - {}
                    requestedAccessTokenVersion: 1
                  appRoles:
                  - allowedMemberTypes: {}
                    description: A sample description.
                    displayName: example_value
                    id: abc123
                    isEnabled: true
                    value: example_value
                  requiredResourceAccess:
                  - resourceAppId: '500123'
                    resourceAccess: {}
                  tags:
                  - example_value
      responses:
        '204':
          description: Application updated successfully. No content returned.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - oauth2:
        - Application.ReadWrite.All
        - Directory.ReadWrite.All
      externalDocs:
        url: https://learn.microsoft.com/en-us/graph/api/application-update?view=graph-rest-1.0
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteApplication
      summary: Delete Application
      description: Delete an application object. Permanently deletes the application registration and its associated service principal.
      tags:
      - Applications
      parameters:
      - $ref: '#/components/parameters/applicationId'
      responses:
        '204':
          description: Application deleted successfully. No content returned.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
      security:
      - oauth2:
        - Application.ReadWrite.All
        - Directory.ReadWrite.All
      externalDocs:
        url: https://learn.microsoft.com/en-us/graph/api/application-delete?view=graph-rest-1.0
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Forbidden:
      description: Forbidden. The caller does not have sufficient permissions.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    TooManyRequests:
      description: Too many requests. The client has been throttled.
      headers:
        Retry-After:
          description: Number of seconds to wait before retrying.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    NotFound:
      description: Not found. The specified resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    Unauthorized:
      description: Unauthorized. Authentication is required or the provided token is invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
    BadRequest:
      description: Bad request. The request body or parameters are invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ODataError'
  schemas:
    KeyCredential:
      type: object
      description: Contains a key credential (certificate) associated with an application or service principal.
      properties:
        customKeyIdentifier:
          type:
          - string
          - 'null'
          description: Custom key identifier.
          example: example_value
        displayName:
          type:
          - string
          - 'null'
          example: example_value
        endDateTime:
          type: string
          format: date-time
          description: The date and time at which the credential expires.
          example: '2026-01-15T10:30:00Z'
        key:
          type:
          - string
          - 'null'
          format: byte
          description: The certificate raw data in byte array converted to Base64 string.
          example: example_value
        keyId:
          type: string
          format: uuid
          example: '500123'
        startDateTime:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
        type:
          type: string
          description: The type of key credential (e.g., AsymmetricX509Cert).
          example: example_value
        usage:
          type: string
          description: Describes the purpose of the key. Valid values are Verify and Sign.
          enum:
          - Sign
          - Verify
          example: Sign
    Application:
      type: object
      description: Represents an application registration in Azure AD. An application object is the global definition of an application, specifying how tokens are issued, the resources the application needs to access, and the actions it can perform.
      allOf:
      - $ref: '#/components/schemas/DirectoryObject'
      properties:
        appId:
          type: string
          format: uuid
          description: The unique identifier assigned by Azure AD when the app is registered. Also known as the client ID.
          readOnly: true
          example: '500123'
        displayName:
          type: string
          description: The display name for the application.
          example: example_value
        description:
          type:
          - string
          - 'null'
          description: A free text field to describe the application.
          example: A sample description.
        createdDateTime:
          type: string
          format: date-time
          description: The date and time the application was registered.
          readOnly: true
          example: '2026-01-15T10:30:00Z'
        identifierUris:
          type: array
          items:
            type: string
            format: uri
          description: URIs that identify the application within its Azure AD tenant. Also known as App ID URIs.
          example: []
        keyCredentials:
          type: array
          items:
            $ref: '#/components/schemas/KeyCredential'
          description: The collection of key credentials (certificates) associated with the application.
          example: []
        passwordCredentials:
          type: array
          items:
            $ref: '#/components/schemas/PasswordCredential'
          description: The collection of password credentials (client secrets) associated with the application.
          example: []
        api:
          $ref: '#/components/schemas/ApiApplication'
        appRoles:
          type: array
          items:
            $ref: '#/components/schemas/AppRole'
          description: The collection of roles defined for the application.
          example: []
        requiredResourceAccess:
          type: array
          items:
            $ref: '#/components/schemas/RequiredResourceAccess'
          description: Specifies the resources that the application needs access to.
          example: []
        signInAudience:
          type: string
          description: Specifies the Microsoft accounts supported for the current application.
          enum:
          - AzureADMyOrg
          - AzureADMultipleOrgs
          - AzureADandPersonalMicrosoftAccount
          - PersonalMicrosoftAccount
          example: AzureADMyOrg
        spa:
          $ref: '#/components/schemas/SpaApplication'
        web:
          $ref: '#/components/schemas/WebApplication'
        publicClient:
          $ref: '#/components/schemas/PublicClientApplication'
        tags:
          type: array
          items:
            type: string
          description: Custom strings that can be used to categorize the application.
          example: []
        publisherDomain:
          type: string
          description: The verified publisher domain for the application.
          readOnly: true
          example: example_value
    DirectoryObject:
      type: object
      description: Represents an Azure Active Directory directory object. This is the base type for most directory resources.
      properties:
        '@odata.type':
          type: string
          description: The OData type of the directory object.
          example: example_value
        id:
          type: string
          format: uuid
          description: The unique identifier for the object. Globally unique across all directory objects.
          readOnly: true
          example: abc123
        deletedDateTime:
          type: string
          format: date-time
          description: Date and time when this object was deleted.
          readOnly: true
          example: '2026-01-15T10:30:00Z'
    PasswordCredential:
      type: object
      description: Contains a password credential (client secret) associated with an application or service principal.
      properties:
        customKeyIdentifier:
          type:
          - string
          - 'null'
          format: byte
          example: example_value
        displayName:
          type:
          - string
          - 'null'
          example: example_value
        endDateTime:
          type: string
          format: date-time
          description: The date and time at which the password expires.
          example: '2026-01-15T10:30:00Z'
        hint:
          type:
          - string
          - 'null'
          description: Contains the first three characters of the password.
          readOnly: true
          example: example_value
        keyId:
          type: string
          format: uuid
          example: '500123'
        secretText:
          type:
          - string
          - 'null'
          description: The client secret value. Only returned on creation; not retrievable afterward.
          readOnly: true
          example: example_value
        startDateTime:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
    AppRole:
      type: object
      description: Represents an application role that can be assigned to users, groups, or service principals.
      properties:
        allowedMemberTypes:
          type: array
          items:
            type: string
            enum:
            - User
            - Application
          description: Specifies whether this app role can be assigned to users and groups or to applications.
          example: []
        description:
          type: string
          example: A sample description.
        displayName:
          type: string
          example: example_value
        id:
          type: string
          format: uuid
          example: abc123
        isEnabled:
          type: boolean
          example: true
        value:
          type: string
          description: The value to include in the roles claim in access tokens.
          example: example_value
    PermissionScope:
      type: object
      description: Represents a delegated permission (OAuth2 scope).
      properties:
        adminConsentDescription:
          type: string
          example: example_value
        adminConsentDisplayName:
          type: string
          example: example_value
        id:
          type: string
          format: uuid
          example: abc123
        isEnabled:
          type: boolean
          example: true
        type:
          type: string
          enum:
          - User
          - Admin
          example: User
        userConsentDescription:
          type: string
          example: example_value
        userConsentDisplayName:
          type: string
          example: example_value
        value:
          type: string
          description: The value to include in the scp claim in access tokens.
          example: example_value
    ODataError:
      type: object
      description: OData error response from Microsoft Graph.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Error code.
            message:
              type: string
              description: Error message.
            innerError:
              type: object
              properties:
                date:
                  type: string
                  format: date-time
                request-id:
                  type: string
                  format: uuid
                client-request-id:
                  type: string
                  format: uuid
          example: example_value
    ApplicationCreate:
      type: object
      description: Properties required when creating a new application registration.
      required:
      - displayName
      properties:
        displayName:
          type: string
          description: The display name for the application.
          example: example_value
        description:
          type: string
          example: A sample description.
        signInAudience:
          type: string
          enum:
          - AzureADMyOrg
          - AzureADMultipleOrgs
          - AzureADandPersonalMicrosoftAccount
          - PersonalMicrosoftAccount
          example: AzureADMyOrg
        identifierUris:
          type: array
          items:
            type: string
          example: []
        web:
          $ref: '#/components/schemas/WebApplication'
        spa:
          $ref: '#/components/schemas/SpaApplication'
        publicClient:
          $ref: '#/components/schemas/PublicClientApplication'
        api:
          $ref: '#/components/schemas/ApiApplication'
        appRoles:
          type: array
          items:
            $ref: '#/components/schemas/AppRole'
          example: []
        requiredResourceAccess:
          type: array
          items:
            $ref: '#/components/schemas/RequiredResourceAccess'
          example: []
        tags:
          type: array
          items:
            type: string
          example: []
    ApiApplication:
      type: object
      description: Configuration for an application that exposes a web API.
      properties:
        acceptMappedClaims:
          type:
          - boolean
          - 'null'
          description: If true, allows an application to use claims mapping without specifying a custom signing key.
          example: example_value
        knownClientApplications:
          type: array
          items:
            type: string
            format: uuid
          description: Used for bundling consent. Lists client app IDs that are considered known clients of this API.
          example: []
        oauth2PermissionScopes:
          type: array
          items:
            $ref: '#/components/schemas/PermissionScope'
          description: The definition of the delegated permissions exposed by the web API.
          example: []
        preAuthorizedApplications:
          type: array
          items:
            type: object
            properties:
              appId:
                type: string
                format: uuid
              delegatedPermissionIds:
                type: array
                items:
                  type: string
                  format: uuid
          description: Lists applications that are pre-authorized with specified delegated permissions.
          example: []
        requestedAccessTokenVersion:
          type:
          - integer
          - 'null'
          description: The access token version expected by this resource. Possible values are 1 or 2.
          enum:
          - 1
          - 2
          example: 1
    ApplicationUpdate:
      type: object
      description: Properties that can be updated on an existing application.
      properties:
        displayName:
          type: string
          example: example_value
        description:
          type: string
          example: A sample description.
        signInAudience:
          type: string
          example: example_value
        identifierUris:
          type: array
          items:
            type: string
          example: []
        web:
          $ref: '#/components/schemas/WebApplication'
        spa:
          $ref: '#/components/schemas/SpaApplication'
        publicClient:
          $ref: '#/components/schemas/PublicClientApplication'
        api:
          $ref: '#/components/schemas/ApiApplication'
        appRoles:
          type: array
          items:
            $ref: '#/components/schemas/AppRole'
          example: []
        requiredResourceAccess:
          type: array
          items:
            $ref: '#/components/schemas/RequiredResourceAccess'
          example: []
        tags:
          type: array
          items:
            type: string
          example: []
    PublicClientApplication:
      type: object
      description: Configuration for a public client (mobile/desktop) application.
      properties:
        redirectUris:
          type: array
          items:
            type: string
            format: uri
          description: Redirect URIs for the public client application.
          example: []
    RequiredResourceAccess:
      type: object
      description: Specifies the set of OAuth 2.0 permission scopes and app roles that an application requires access to.
      properties:
        resourceAppId:
          type: string
          format: uuid
          description: The unique identifier for the resource that the application requires access to (e.g., Microsoft Graph).
          example: '500123'
        resourceAccess:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                format: uuid
                description: Identifier of the permission scope or app role.
              type:
                type: string
                enum:
                - Scope
                - Role
                description: Whether this is a delegated permission (Scope) or application permission (Role).
          example: []
    WebApplication:
      type: object
      description: Configuration for a web application.
      properties:
        homePageUrl:
          type:
          - string
          - 'null'
          format: uri
          description: Home page or landing page of the application.
          example: https://www.example.com
        logoutUrl:
          type:
          - string
          - 'null'
          format: uri
          description: URL used by the authorization service to sign out a user.
          example: https://www.example.com
        redirectUris:
          type: array
          items:
            type: string
            format: uri
          description: URIs to which Azure AD will redirect after authentication.
          example: []
        implicitGrantSettings:
          type: object
          properties:
            enableAccessTokenIssuance:
              type: boolean
              description: Specifies whether web application can request an access token using OAuth 2.0 implicit flow.
            enableIdTokenIssuance:
              type: boolean
              description: Specifies whether web application can request an ID token using OAuth 2.0 implicit flow.
          example: example_value
    SpaApplication:
      type: object
      description: Configuration for a single-page application.
      properties:
        redirectUris:
          type: array
          items:
            type: string
            format: uri
          description: Redirect URIs for the single-page application using authorization code flow with PKCE.
          example: []
  parameters:
    select:
      name: $select
      in: query
      description: 'Selects specific properties to return. Comma-separated list of property names. Example: id,displayName,mail.'
      schema:
        type: string
    top:
      name: $top
      in: query
      description: Sets the page size of results. Maximum value depends on the API; defaults to 100 for most identity resources.
      schema:
        type: integer
        minimum: 1
        maximum: 999
    filter:
      name: $filter
      in: query
      description: Filters results using OData filter expressions. Supports eq, ne, not, in, startsWith, endsWith, and lambda operators.
      schema:
        type: string
    count:
      name: $count
      in: query
      description: Includes a count of the total number of items in a collection alongside the page of data values. Requires ConsistencyLevel header.
      schema:
        type: boolean
    search:
      name: $search
      in: query
      description: Search items by search phrases. Requires ConsistencyLevel header set to eventual. Supports searching displayName and description.
      schema:
        type: string
    consistencyLevel:
      name: ConsistencyLevel
      in: header
      description: Indicates the requested consistency level. Required for advanced queries using $search, $filter with certain functions, or $count. Set to eventual.
      schema:
        type: string
        enum:
        - eventual
    skip:
      name: $skip
      in: query
      description: Skips the specified number of items in the result set.
      schema:
        type: integer
        minimum: 0
    expand:
      name: $expand
      in: query
      description: Expands related entities inline. For example, expand members of a group or manager of a user.
      schema:
        type: string
    applicationId:
      name: application-id
      in: path
      required: true
      description: The unique identifier (object ID) of the application.
      schema:
        type: string
        format: uuid
    orderby:
      name: $orderby
      in: query
      description: 'Specifies the order of items returned. Use asc for ascending or desc for descending. Example: displayName asc.'
      schema:
        type: string
  securitySchemes:
    oauth2:
      type: oauth2
      description: Microsoft identity platform OAuth 2.0 authorization. Supports authorization code flow, client credentials flow, and on-behalf-of flow. All API calls require a valid access token obtained from the Microsoft identity platform.
      flows:
        authorizationCode:
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
          tokenUrl: https://login.microsoftonline.com/common/oauth2/v2.0/token
          scopes:
            User.Read: Sign in and read user profile
            User.Read.All: Read all users' full profiles
            User.ReadWrite.All: Read and write all users' full profiles
            Group.Read.All: Read all groups
            Group.ReadWrite.All: Read and write all groups
            GroupMember.Read.All: Read group memberships
            GroupMember.ReadWrite.All: Read and write group memberships
            Application.Read.All: Read all applications
            Application.ReadWrite.All: Read and write all applications
            Directory.Read.All: Read directory data
            Directory.ReadWrite.All: Read and write directory data
        clientCredentials:
          tokenUrl: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
          scopes:
            https://graph.microsoft.com/.default: Default scope for client credentials