{
  "opencollection": "1.0.0",
  "info": {
    "name": "Microsoft Graph Admin Admin.admin Audit Logs Sign Ins API",
    "version": "1.0.0"
  },
  "items": [
    {
      "info": {
        "name": "Audit Logs Sign Ins",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Microsoft Graph List signIns",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns",
            "params": [
              {
                "name": "$top",
                "value": "50",
                "type": "query",
                "description": "Show only the first n items"
              },
              {
                "name": "$skip",
                "value": "",
                "type": "query",
                "description": "Skip the first n items"
              },
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              },
              {
                "name": "$count",
                "value": "",
                "type": "query",
                "description": "Include count of items"
              },
              {
                "name": "$orderby",
                "value": "",
                "type": "query",
                "description": "Order items by property values"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "Retrieve the Microsoft Entra user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.  The maximum and default page size is 1,000 objects and by default, the most recent sign-ins are returned first. Only sign-in events that occurred within the Microsoft Entra ID default retention period are available."
        },
        {
          "info": {
            "name": "Microsoft Graph Create Sign Ins",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Performs POST operation on /auditLogs/signIns"
        },
        {
          "info": {
            "name": "Microsoft Graph Get signIn",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/:signIn-id",
            "params": [
              {
                "name": "signIn-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of signIn"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs."
        },
        {
          "info": {
            "name": "Microsoft Graph Update Sign Ins",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/:signIn-id",
            "params": [
              {
                "name": "signIn-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of signIn"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Performs PATCH operation on /auditLogs/signIns/{signIn-id}"
        },
        {
          "info": {
            "name": "Microsoft Graph Delete Sign Ins",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/:signIn-id",
            "headers": [
              {
                "name": "If-Match",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "signIn-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of signIn"
              }
            ]
          },
          "docs": "Performs DELETE operation on /auditLogs/signIns/{signIn-id}"
        },
        {
          "info": {
            "name": "Microsoft Graph Get the number of the resource",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/$count",
            "params": [
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              }
            ]
          },
          "docs": "Performs GET operation on /auditLogs/signIns/$count"
        },
        {
          "info": {
            "name": "Microsoft Graph Create Confirm Compromised",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/confirmCompromised",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Mark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection are in fact risky. For details about investigating Identity Protection risks, see How to investigate risk."
        },
        {
          "info": {
            "name": "Microsoft Graph Create Confirm Safe",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/confirmSafe",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Mark an event in Microsoft Entra sign-in logs as safe. Admins can either mark the events flagged as risky by Microsoft Entra ID Protection as safe, or they can mark unflagged events as safe. For details about investigating Identity Protection risks, see How to investigate risk."
        },
        {
          "info": {
            "name": "Microsoft Graph Create Dismiss",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/dismiss",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Mark an event in Microsoft Entra sign-in logs as dismissed. For details about investigating Identity Protection risks, see How to investigate risk."
        }
      ]
    }
  ],
  "bundled": true
}