swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: Role based access control provides you a way to apply granular level policy administration down to individual resources or resource groups. These operations enable you to get deny assignments. A deny assignment describes the set of actions on resources that are denied for Azure Active Directory users.
  title: AuthorizationManagementClient
  version: 2018-07-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/authorization/resource-manager/Microsoft.Authorization/preview/2018-07-01-preview/authorization-DenyAssignmentGetCalls.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: authorization-authorization-DenyAssignmentGetCalls
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ApiVersionParameter:
    description: The API version to use for this operation.
    in: query
    name: api-version
    required: true
    type: string
  FilterParameter:
    description: The filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use $filter=denyAssignmentName eq '{name}' to search deny assignments by name at specified scope. Use $filter=principalId eq '{id}' to return all deny assignments at, above and below the scope for the specified principal. Use $filter=gdprExportPrincipalId eq '{id}' to return all deny assignments at, above and below the scope for the specified principal. This filter is different from the principalId filter as it returns not only those deny assignments that contain the specified principal is the Principals list but also those deny assignments that contain the specified principal is the ExcludePrincipals list. Additionally, when gdprExportPrincipalId filter is used, only the deny assignment name and description properties are returned.
    in: query
    name: $filter
    required: false
    type: string
    x-ms-parameter-location: method
  ResourceGroupNameParameter:
    description: The name of the resource group.
    in: path
    name: resourceGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  ResourceProviderNamespaceParameter:
    description: The namespace of the resource provider.
    in: path
    name: resourceProviderNamespace
    required: true
    type: string
    x-ms-parameter-location: method
  SubscriptionIdParameter:
    description: The ID of the target subscription.
    in: path
    name: subscriptionId
    required: true
    type: string
paths:
  "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/denyAssignments":
    get:
      description: Gets all deny assignments for the subscription.
      operationId: DenyAssignments_List
      parameters:
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/FilterParameter"
      responses:
        "200":
          description: OK - Returns an array of deny assignments.
          schema:
            $ref: "#/definitions/DenyAssignmentListResult"
      tags:
        - DenyAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-07-01-preview
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId
                    name: denyAssignmentId
                    properties:
                      denyAssignmentName: Deny assignment name
                      description: Deny assignment description
                      doNotApplyToChildScopes: false
                      excludePrincipals:
                        - id: principalId2
                          type: principalType2
                      isSystemProtected: true
                      permissions:
                        - actions:
                            - action
                          dataActions:
                            - action
                          notActions: []
                          notDataActions: []
                      principals:
                        - id: principalId1
                          type: principalType1
                      scope: /subscriptions/subId
                    type: Microsoft.Authorization/denyAssignments
      x-ms-odata: "#/definitions/DenyAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/denyAssignments":
    get:
      description: Gets deny assignments for a resource group.
      operationId: DenyAssignments_ListForResourceGroup
      parameters:
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/FilterParameter"
      responses:
        "200":
          description: OK - Returns an array of deny assignments.
          schema:
            $ref: "#/definitions/DenyAssignmentListResult"
      tags:
        - DenyAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-07-01-preview
            resourceGroupName: rgname
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId
                    name: denyAssignmentId
                    properties:
                      denyAssignmentName: Deny assignment name
                      description: Deny assignment description
                      doNotApplyToChildScopes: false
                      excludePrincipals:
                        - id: principalId2
                          type: principalType2
                      isSystemProtected: true
                      permissions:
                        - actions:
                            - action
                          dataActions:
                            - action
                          notActions: []
                          notDataActions: []
                      principals:
                        - id: principalId1
                          type: principalType1
                      scope: /subscriptions/subId/resourcegroups/rgname
                    type: Microsoft.Authorization/denyAssignments
      x-ms-odata: "#/definitions/DenyAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{parentResourcePath}/{resourceType}/{resourceName}/providers/Microsoft.Authorization/denyAssignments":
    get:
      description: Gets deny assignments for a resource.
      operationId: DenyAssignments_ListForResource
      parameters:
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/ResourceProviderNamespaceParameter"
        - description: The parent resource identity.
          in: path
          name: parentResourcePath
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The resource type of the resource.
          in: path
          name: resourceType
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The name of the resource to get deny assignments for.
          in: path
          name: resourceName
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/FilterParameter"
      responses:
        "200":
          description: OK - Returns an array of deny assignments.
          schema:
            $ref: "#/definitions/DenyAssignmentListResult"
      tags:
        - DenyAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-07-01-preview
            parentResourcePath: parentResourcePath
            resourceGroupName: rgname
            resourceName: resourceName
            resourceProviderNamespace: resourceProviderNamespace
            resourceType: resourceType
            subscriptionId: subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/resourcegroups/rgname/providers/resourceProviderNamespace/parentResourcePath/resourceType/resourceName/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId
                    name: denyAssignmentId
                    properties:
                      denyAssignmentName: Deny assignment name
                      description: Deny assignment description
                      doNotApplyToChildScopes: false
                      excludePrincipals:
                        - id: principalId2
                          type: principalType2
                      isSystemProtected: true
                      permissions:
                        - actions:
                            - action
                          dataActions:
                            - action
                          notActions: []
                          notDataActions: []
                      principals:
                        - id: principalId1
                          type: principalType1
                      scope: /subscriptions/subId/resourcegroups/rgname/providers/resourceProviderNamespace/parentResourcePath/resourceType/resourceName
                    type: Microsoft.Authorization/denyAssignments
      x-ms-odata: "#/definitions/DenyAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/{denyAssignmentId}":
    get:
      description: Gets a deny assignment by ID.
      operationId: DenyAssignments_GetById
      parameters:
        - description: The fully qualified deny assignment ID. For example, use the format, /subscriptions/{guid}/providers/Microsoft.Authorization/denyAssignments/{denyAssignmentId} for subscription level deny assignments, or /providers/Microsoft.Authorization/denyAssignments/{denyAssignmentId} for tenant level deny assignments.
          in: path
          name: denyAssignmentId
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns the deny assignment.
          schema:
            $ref: "#/definitions/DenyAssignment"
      tags:
        - DenyAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-07-01-preview
            denyAssignmentId: subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/denyAssignments/daId
          responses:
            "200":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/denyAssignments/daId
                name: daId
                properties:
                  denyAssignmentName: Deny assignment name
                  description: Deny assignment description
                  doNotApplyToChildScopes: false
                  excludePrincipals:
                    - id: principalId2
                      type: principalType2
                  isSystemProtected: true
                  permissions:
                    - actions:
                        - action
                      dataActions: []
                      notActions: []
                      notDataActions: []
                  principals:
                    - id: principalId1
                      type: principalType1
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/denyAssignments
  "/{scope}/providers/Microsoft.Authorization/denyAssignments":
    get:
      description: Gets deny assignments for a scope.
      operationId: DenyAssignments_ListForScope
      parameters:
        - description: The scope of the deny assignments.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/FilterParameter"
      responses:
        "200":
          description: OK - Returns an array of deny assignments.
          schema:
            $ref: "#/definitions/DenyAssignmentListResult"
      tags:
        - DenyAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-07-01-preview
            scope: subscriptions/subId
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/subId/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId
                    name: denyAssignmentId
                    properties:
                      denyAssignmentName: Deny assignment name
                      description: Deny assignment description
                      doNotApplyToChildScopes: false
                      excludePrincipals:
                        - id: principalId2
                          type: principalType2
                      isSystemProtected: true
                      permissions:
                        - actions:
                            - action
                          dataActions:
                            - action
                          notActions: []
                          notDataActions: []
                      principals:
                        - id: principalId1
                          type: principalType1
                      scope: /subscriptions/subId
                    type: Microsoft.Authorization/denyAssignments
      x-ms-odata: "#/definitions/DenyAssignmentFilter"
      x-ms-pageable:
        nextLinkName: nextLink
  "/{scope}/providers/Microsoft.Authorization/denyAssignments/{denyAssignmentId}":
    get:
      description: Get the specified deny assignment.
      operationId: DenyAssignments_Get
      parameters:
        - description: The scope of the deny assignment.
          in: path
          name: scope
          required: true
          type: string
          x-ms-skip-url-encoding: true
        - description: The ID of the deny assignment to get.
          in: path
          name: denyAssignmentId
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: OK - Returns information about the deny assignment.
          schema:
            $ref: "#/definitions/DenyAssignment"
      tags:
        - DenyAssignments
      x-ms-examples:
        GetConfigurations:
          parameters:
            api-version: 2018-07-01-preview
            denyAssignmentId: denyAssignmentId
            scope: subscriptions/subId/resourcegroups/rgname
          responses:
            "200":
              body:
                id: /subscriptions/subId/resourcegroups/rgname/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId
                name: denyAssignmentId
                properties:
                  denyAssignmentName: Deny assignment name
                  description: Deny assignment description
                  doNotApplyToChildScopes: false
                  excludePrincipals:
                    - id: principalId2
                      type: principalType2
                  isSystemProtected: true
                  permissions:
                    - actions:
                        - action
                      dataActions: []
                      notActions: []
                      notDataActions: []
                  principals:
                    - id: principalId1
                      type: principalType1
                  scope: /subscriptions/subId/resourcegroups/rgname
                type: Microsoft.Authorization/denyAssignments
definitions:
  DenyAssignment:
    description: Deny Assignment
    properties:
      id:
        description: The deny assignment ID.
        readOnly: true
        type: string
      name:
        description: The deny assignment name.
        readOnly: true
        type: string
      properties:
        $ref: "#/definitions/DenyAssignmentProperties"
        description: Deny assignment properties.
        x-ms-client-flatten: true
      type:
        description: The deny assignment type.
        readOnly: true
        type: string
  DenyAssignmentFilter:
    description: Deny Assignments filter
    properties:
      denyAssignmentName:
        description: Return deny assignment with specified name.
        type: string
      gdprExportPrincipalId:
        description: Return all deny assignments where the specified principal is listed either in the principals list or exclude principals list of deny assignments.
        type: string
      principalId:
        description: Return all deny assignments where the specified principal is listed in the principals list of deny assignments.
        type: string
  DenyAssignmentListResult:
    description: Deny assignment list operation result.
    properties:
      nextLink:
        description: The URL to use for getting the next set of results.
        type: string
      value:
        description: Deny assignment list.
        items:
          $ref: "#/definitions/DenyAssignment"
        type: array
  DenyAssignmentPermission:
    description: Deny assignment permissions.
    properties:
      actions:
        description: Actions to which the deny assignment does not grant access.
        items:
          type: string
        type: array
      dataActions:
        description: Data actions to which the deny assignment does not grant access.
        items:
          type: string
        type: array
      notActions:
        description: Actions to exclude from that the deny assignment does not grant access.
        items:
          type: string
        type: array
      notDataActions:
        description: Data actions to exclude from that the deny assignment does not grant access.
        items:
          type: string
        type: array
  DenyAssignmentProperties:
    description: Deny assignment properties.
    properties:
      denyAssignmentName:
        description: The display name of the deny assignment.
        type: string
      description:
        description: The description of the deny assignment.
        type: string
      doNotApplyToChildScopes:
        description: Determines if the deny assignment applies to child scopes. Default value is false.
        type: boolean
      excludePrincipals:
        description: Array of principals to which the deny assignment does not apply.
        items:
          $ref: "#/definitions/Principal"
        type: array
      isSystemProtected:
        description: Specifies whether this deny assignment was created by Azure and cannot be edited or deleted.
        type: boolean
      permissions:
        description: An array of permissions that are denied by the deny assignment.
        items:
          $ref: "#/definitions/DenyAssignmentPermission"
        type: array
      principals:
        description: Array of principals to which the deny assignment applies.
        items:
          $ref: "#/definitions/Principal"
        type: array
      scope:
        description: The deny assignment scope.
        type: string
  Principal:
    description: Deny assignment principal.
    properties:
      id:
        description: Object ID of the Azure AD principal (user, group, or service principal) to which the deny assignment applies. An empty guid '00000000-0000-0000-0000-000000000000' as principal id and principal type as 'Everyone' represents all users, groups and service principals.
        readOnly: true
        type: string
      type:
        description: Type of object represented by principal id (user, group, or service principal). An empty guid '00000000-0000-0000-0000-000000000000' as principal id and principal type as 'Everyone' represents all users, groups and service principals.
        readOnly: true
        type: string
