{
  "opencollection": "1.0.0",
  "info": {
    "name": "Microsoft Graph Admin Admin.admin auditLogs.signIn API",
    "version": "1.0.0"
  },
  "items": [
    {
      "info": {
        "name": "auditLogs.signIn",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Microsoft Graph List signIns",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns",
            "params": [
              {
                "name": "$top",
                "value": "50",
                "type": "query",
                "description": "Show only the first n items"
              },
              {
                "name": "$skip",
                "value": "",
                "type": "query",
                "description": "Skip the first n items"
              },
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              },
              {
                "name": "$count",
                "value": "",
                "type": "query",
                "description": "Include count of items"
              },
              {
                "name": "$orderby",
                "value": "",
                "type": "query",
                "description": "Order items by property values"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "Retrieve the Microsoft Entra user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.  The maximum and default page size is 1,000 objects and by default, the most recent sign-ins are returned first. Only sign-in events that occurred within the Microsoft Entra ID default retention period are available."
        },
        {
          "info": {
            "name": "Microsoft Graph Create new navigation property to signIns for auditLogs",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Microsoft Graph Create new navigation property to signIns for auditLogs"
        },
        {
          "info": {
            "name": "Microsoft Graph Get signIn",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/:signIn-id",
            "params": [
              {
                "name": "signIn-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of signIn"
              },
              {
                "name": "$select",
                "value": "",
                "type": "query",
                "description": "Select properties to be returned"
              },
              {
                "name": "$expand",
                "value": "",
                "type": "query",
                "description": "Expand related entities"
              }
            ]
          },
          "docs": "Retrieve a specific Microsoft Entra user sign-in event for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs."
        },
        {
          "info": {
            "name": "Microsoft Graph Update the navigation property signIns in auditLogs",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/:signIn-id",
            "params": [
              {
                "name": "signIn-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of signIn"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Microsoft Graph Update the navigation property signIns in auditLogs"
        },
        {
          "info": {
            "name": "Microsoft Graph Delete navigation property signIns for auditLogs",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/:signIn-id",
            "headers": [
              {
                "name": "If-Match",
                "value": ""
              }
            ],
            "params": [
              {
                "name": "signIn-id",
                "value": "",
                "type": "path",
                "description": "The unique identifier of signIn"
              }
            ]
          },
          "docs": "Microsoft Graph Delete navigation property signIns for auditLogs"
        },
        {
          "info": {
            "name": "Microsoft Graph Get the number of the resource",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/$count",
            "params": [
              {
                "name": "$search",
                "value": "",
                "type": "query",
                "description": "Search items by search phrases"
              },
              {
                "name": "$filter",
                "value": "",
                "type": "query",
                "description": "Filter items by property values"
              }
            ]
          },
          "docs": "Microsoft Graph Get the number of the resource"
        },
        {
          "info": {
            "name": "Microsoft Graph Invoke action confirmCompromised",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/confirmCompromised",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Mark an event in the Microsoft Entra sign-in logs as risky. Events marked as risky by an admin are immediately flagged as high risk in Microsoft Entra ID Protection, overriding previous risk states. Admins can confirm that events flagged as risky by Microsoft Entra ID Protection are in fact risky. For details about investigating Identity Protection risks, see How to investigate risk."
        },
        {
          "info": {
            "name": "Microsoft Graph Invoke action confirmSafe",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/confirmSafe",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Mark an event in Microsoft Entra sign-in logs as safe. Admins can either mark the events flagged as risky by Microsoft Entra ID Protection as safe, or they can mark unflagged events as safe. For details about investigating Identity Protection risks, see How to investigate risk."
        },
        {
          "info": {
            "name": "Microsoft Graph Invoke action dismiss",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://graph.microsoft.com/v1.0/auditLogs/signIns/dismiss",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Mark an event in Microsoft Entra sign-in logs as dismissed. For details about investigating Identity Protection risks, see How to investigate risk."
        }
      ]
    }
  ],
  "bundled": true
}