apis.yml

name: Microsoft Defender
description: Collection of Microsoft Defender security APIs for threat protection, endpoint security, and security operations.
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: high
  source:
  - plans
  - authentication
  generated: '2026-07-22'
  method: derived
image: https://www.microsoft.com/favicon.ico
created: '2024-01-15'
modified: '2026-05-19'
specificationVersion: '0.18'
url: https://raw.githubusercontent.com/api-evangelist/microsoft-defender/refs/heads/main/apis.yml
apis:
- name: Microsoft Defender for Cloud Apps API
  description: >-
    Cloud Access Security Broker (CASB) API for discovering, investigating, and governing cloud apps.
  image: https://www.microsoft.com/favicon.ico
  humanUrl: https://learn.microsoft.com/en-us/defender-cloud-apps/
  baseUrl: https://portal.cloudappsecurity.com/api
  tags:
  - CASB
  - Cloud Security
  - Data Protection
  - Shadow IT
  properties:
  - type: Documentation
    url: https://learn.microsoft.com/en-us/defender-cloud-apps/api-introduction
  - type: Authentication
    url: https://learn.microsoft.com/en-us/defender-cloud-apps/api-authentication
  - type: Activities API
    url: https://learn.microsoft.com/en-us/defender-cloud-apps/api-activities
  - type: Alerts API
    url: https://learn.microsoft.com/en-us/defender-cloud-apps/api-alerts
  - type: Entities API
    url: https://learn.microsoft.com/en-us/defender-cloud-apps/api-entities
  - type: Cloud Discovery API
    url: https://learn.microsoft.com/en-us/defender-cloud-apps/api-discovery
- name: Microsoft Defender Threat Intelligence API
  description: Access threat intelligence data, indicators of compromise (IOCs), and threat analytics.
  image: https://www.microsoft.com/favicon.ico
  humanUrl: https://learn.microsoft.com/en-us/defender/threat-intelligence/
  baseUrl: https://graph.microsoft.com/v1.0/security/threatIntelligence
  tags:
  - IOC
  - Security Intelligence
  - Threat Analytics
  - Threat Intelligence
  properties:
  - type: Documentation
    url: >-
      https://learn.microsoft.com/en-us/graph/api/resources/security-threatintelligence-overview
  - type: APIReference
    url: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview
  - type: Authentication
    url: https://learn.microsoft.com/en-us/graph/auth/
- name: Microsoft Defender for Office 365 API
  description: >-
    API for email and collaboration protection including anti-phishing, anti-malware, and safe attachments.
  image: https://www.microsoft.com/favicon.ico
  humanUrl: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/
  baseUrl: https://graph.microsoft.com/v1.0/security
  tags:
  - Collaboration Security
  - Email Security
  - Phishing Protection
  - Safe Attachments
  properties:
  - type: Documentation
    url: >-
      https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/defender-for-office-365
  - type: Threat Protection
    url: >-
      https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer
  - type: Safe Links
    url: https://learn.microsoft.com/en-us/defender-office-365/safe-links-about
  - type: Safe Attachments
    url: https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about
  - type: Service Description
    url: >-
      https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description
- name: Microsoft Defender XDR API
  description: >-
    Unified extended detection and response API for automating workflows based on shared incident and
    advanced hunting tables across Microsoft security products.
  image: https://www.microsoft.com/favicon.ico
  humanUrl: https://learn.microsoft.com/en-us/defender-xdr/api-overview
  baseUrl: https://api.security.microsoft.com/api
  tags:
  - Advanced Hunting
  - Event Streaming
  - Incidents
  - Threat Protection
  - XDR
  properties:
  - type: Documentation
    url: https://learn.microsoft.com/en-us/defender-xdr/api-overview
  - type: APIReference
    url: https://learn.microsoft.com/en-us/defender-xdr/api-supported
  - type: Authentication
    url: https://learn.microsoft.com/en-us/defender-xdr/api-access
  - type: Incidents API
    url: https://learn.microsoft.com/en-us/defender-xdr/api-incident
  - type: Advanced Hunting API
    url: https://learn.microsoft.com/en-us/defender-xdr/api-advanced-hunting
  - type: Streaming API
    url: https://learn.microsoft.com/en-us/defender-xdr/streaming-api
  - type: Supported Event Types
    url: https://learn.microsoft.com/en-us/defender-xdr/supported-event-types
  - type: ErrorCodes
    url: https://learn.microsoft.com/en-us/defender-xdr/api-error-codes
- name: Microsoft Defender for Cloud REST API
  description: >-
    REST API for unified security management and advanced threat protection across hybrid cloud workloads
    in Azure, other clouds, and on-premises.
  image: https://www.microsoft.com/favicon.ico
  humanUrl: >-
    https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction
  baseUrl: https://management.azure.com
  tags:
  - Azure Security
  - Cloud Security
  - CSPM
  - Security Posture
  - Workload Protection
  properties:
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/defenderforcloud/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/defender-for-cloud/get-started
  - type: Pricing
    url: https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/
  - type: ReleaseNotes
    url: https://learn.microsoft.com/en-us/azure/defender-for-cloud/release-notes
- name: Microsoft Defender for Identity API
  description: >-
    API for identity-based attack detection and investigation across on-premises Active Directory and
    hybrid environments, with sensor management via Microsoft Graph.
  image: https://www.microsoft.com/favicon.ico
  humanUrl: https://learn.microsoft.com/en-us/defender-for-identity/
  baseUrl: https://graph.microsoft.com/v1.0/security/identities
  tags:
  - Active Directory
  - Identity Security
  - Identity Threat Detection
  - Sensor Management
  properties:
  - type: Documentation
    url: https://learn.microsoft.com/en-us/defender-for-identity/
  - type: Overview
    url: https://learn.microsoft.com/en-us/defender-for-identity/what-is
  - type: Architecture
    url: https://learn.microsoft.com/en-us/defender-for-identity/architecture
  - type: Graph Security API
    url: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview
- aid: microsoft-defender:microsoft-defender-alerts-api
  name: Microsoft Defender Alerts API
  description: >-
    Manage security alerts generated by Microsoft Defender for Endpoint. Alerts represent detected threats,
    suspicious activities, and security events on endpoints.
  tags:
  - Alerts
  properties:
  - type: OpenAPI
    url: openapi/microsoft-defender-alerts-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/apis-intro
  - type: JSONSchema
    url: json-schema/microsoft-defender-alert-schema.json
  - type: JSONLD
    url: json-ld/microsoft-defender-context.jsonld
  - type: Authentication
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp
  - type: Pricing
    url: >-
      https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint-pricing
  - type: APIReference
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list
  - type: ReleaseNotes
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/api-release-notes
  - type: Management APIs
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/management-apis
  - type: Alerts API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-alerts
  - type: Vulnerabilities API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities
  - type: Security Recommendations API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-security-recommendations
  - type: Documentation
    url: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview
  - type: SDKs
    url: https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
  - type: Code Samples
    url: >-
      https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview#common-use-cases
- aid: microsoft-defender:microsoft-defender-machines-api
  name: Microsoft Defender Machines API
  description: >-
    Manage devices (machines) that have communicated with Microsoft Defender for Endpoint. Retrieve device
    information, health status, risk scores, and exposure levels.
  tags:
  - Machines
  properties:
  - type: OpenAPI
    url: openapi/microsoft-defender-machines-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/apis-intro
  - type: JSONSchema
    url: json-schema/microsoft-defender-alert-schema.json
  - type: JSONLD
    url: json-ld/microsoft-defender-context.jsonld
  - type: Authentication
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp
  - type: Pricing
    url: >-
      https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint-pricing
  - type: APIReference
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list
  - type: ReleaseNotes
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/api-release-notes
  - type: Management APIs
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/management-apis
  - type: Alerts API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-alerts
  - type: Vulnerabilities API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities
  - type: Security Recommendations API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-security-recommendations
  - type: Documentation
    url: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview
  - type: SDKs
    url: https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
  - type: Code Samples
    url: >-
      https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview#common-use-cases
- aid: microsoft-defender:microsoft-defender-vulnerabilities-api
  name: Microsoft Defender Vulnerabilities API
  description: >-
    Retrieve vulnerability information from Microsoft Defender Vulnerability Management. Access CVE data,
    severity scores, exploit information, and exposure metrics.
  tags:
  - Vulnerabilities
  properties:
  - type: OpenAPI
    url: openapi/microsoft-defender-vulnerabilities-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/apis-intro
  - type: JSONSchema
    url: json-schema/microsoft-defender-alert-schema.json
  - type: JSONLD
    url: json-ld/microsoft-defender-context.jsonld
  - type: Authentication
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-create-app-webapp
  - type: Pricing
    url: >-
      https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint-pricing
  - type: APIReference
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-list
  - type: ReleaseNotes
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/api-release-notes
  - type: Management APIs
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/management-apis
  - type: Alerts API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-alerts
  - type: Vulnerabilities API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities
  - type: Security Recommendations API
    url: https://learn.microsoft.com/en-us/defender-endpoint/api/get-security-recommendations
  - type: Documentation
    url: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview
  - type: SDKs
    url: https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
  - type: Code Samples
    url: >-
      https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview#common-use-cases
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com
common:
  - type: AgenticAccess
    url: agentic-access/microsoft-defender-agentic-access.yml
  - type: VulnerabilityDisclosure
    url: security/microsoft-defender-vulnerability-disclosure.yml
  - type: DomainSecurity
    url: security/microsoft-defender-domain-security.yml
  - type: Authentication
    url: authentication/microsoft-defender-authentication.yml
  - type: OAuthScopes
    url: scopes/microsoft-defender-scopes.yml
  - type: GitHubOrganization
    url: https://github.com/MicrosoftDocs
  - type: Portal
    url: https://security.microsoft.com
  - type: Documentation Hub
    url: https://learn.microsoft.com/en-us/microsoft-365/security/
  - type: StatusPage
    url: https://status.azure.com/
  - type: TermsOfService
    url: https://www.microsoft.com/en-us/legal/terms-of-use
  - type: PrivacyPolicy
    url: https://privacy.microsoft.com/en-us/privacystatement
  - type: Developer Changelog
    url: https://developer.microsoft.com/en-us/changelog
  - type: Security Blog
    url: https://www.microsoft.com/en-us/security/blog/
  - type: Microsoft Graph Explorer
    url: https://developer.microsoft.com/en-us/graph/graph-explorer
  - type: Authentication Overview
    url: https://learn.microsoft.com/en-us/graph/auth/
  - type: Security Pricing Overview
    url: https://www.microsoft.com/en-us/security/pricing-overview