swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  title: MonitorManagementClient
  version: 2015-04-01
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-ms-code-generation-settings:
    name: MonitorManagementClient
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/monitor/resource-manager/Microsoft.Insights/stable/2015-04-01/tenantActivityLogs_API.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: monitor-tenantActivityLogs_API
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ApiVersionParameter:
    description: Client Api Version.
    in: query
    name: api-version
    required: true
    type: string
  SelectParameter:
    description: "Used to fetch events with only the given properties.<br>The **$select** argument is a comma separated list of property names to be returned. Possible values are: *authorization*, *claims*, *correlationId*, *description*, *eventDataId*, *eventName*, *eventTimestamp*, *httpRequest*, *level*, *operationId*, *operationName*, *properties*, *resourceGroupName*, *resourceProviderName*, *resourceId*, *status*, *submissionTimestamp*, *subStatus*, *subscriptionId*"
    in: query
    name: $select
    required: false
    type: string
    x-ms-parameter-location: method
paths:
  /providers/microsoft.insights/eventtypes/management/values:
    get:
      description: Gets the Activity Logs for the Tenant.<br>Everything that is applicable to the API to get the Activity Logs for the subscription is applicable to this API (the parameters, $filter, etc.).<br>One thing to point out here is that this API does *not* retrieve the logs at the individual subscription of the tenant but only surfaces the logs that were generated at the tenant level.
      operationId: TenantActivityLogs_List
      parameters:
        - $ref: "#/parameters/ApiVersionParameter"
        - description: "Reduces the set of data collected. <br>The **$filter** is very restricted and allows only the following patterns.<br>- List events for a resource group: $filter=eventTimestamp ge '<Start Time>' and eventTimestamp le '<End Time>' and eventChannels eq 'Admin, Operation' and resourceGroupName eq '<ResourceGroupName>'.<br>- List events for resource: $filter=eventTimestamp ge '<Start Time>' and eventTimestamp le '<End Time>' and eventChannels eq 'Admin, Operation' and resourceUri eq '<ResourceURI>'.<br>- List events for a subscription: $filter=eventTimestamp ge '<Start Time>' and eventTimestamp le '<End Time>' and eventChannels eq 'Admin, Operation'.<br>- List events for a resource provider: $filter=eventTimestamp ge '<Start Time>' and eventTimestamp le '<End Time>' and eventChannels eq 'Admin, Operation' and resourceProvider eq '<ResourceProviderName>'.<br>- List events for a correlation Id: api-version=2014-04-01&$filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and eventChannels eq 'Admin, Operation' and correlationId eq '<CorrelationID>'.<br>**NOTE**: No other syntax is allowed."
          in: query
          name: $filter
          required: false
          type: string
        - $ref: "#/parameters/SelectParameter"
      responses:
        "200":
          description: Successful request to get a page of events in the tenant activity logs
          schema:
            $ref: "#/definitions/EventDataCollection"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - TenantActivityLogs
      x-ms-examples:
        Get Tenant Activity Logs with filter:
          parameters:
            $filter: eventTimestamp ge '2015-01-21T20:00:00Z' and eventTimestamp le '2015-01-23T20:00:00Z' and resourceGroupName eq 'MSSupportGroup'
            api-version: 2015-04-01
            subscriptionId: 089bd33f-d4ec-47fe-8ba5-0753aa5c5b33
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/########-####-####-####-############$skiptoken=######
                value:
                  - authorization:
                      action: microsoft.support/supporttickets/write
                      role: Subscription Admin
                      scope: /subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841
                    caller: admin@contoso.com
                    claims:
                      appid: c44b4083-3bq0-49c1-b47d-974e53cbdf3c
                      appidacr: "2"
                      aud: https://management.core.windows.net/
                      exp: "1421880271"
                      groups: cacfe77c-e058-4712-83qw-f9b08849fd60,7f71d11d-4c41-4b23-99d2-d32ce7aa621c,31522864-0578-4ea0-9gdc-e66cc564d18c
                      http://schemas.microsoft.com/claims/authnclassreference: "1"
                      http://schemas.microsoft.com/claims/authnmethodsreferences: pwd
                      http://schemas.microsoft.com/identity/claims/objectidentifier: 2468adf0-8211-44e3-95xq-85137af64708
                      http://schemas.microsoft.com/identity/claims/scope: user_impersonation
                      http://schemas.microsoft.com/identity/claims/tenantid: 1e8d8218-c5e7-4578-9acc-9abbd5d23315
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname: John
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name: admin@contoso.com
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier: 9vckmEGF7zDKk1YzIY8k0t1_EAPaXoeHyPRn6f413zM
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname: Smith
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn: admin@contoso.com
                      iat: "1421876371"
                      iss: https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/
                      name: John Smith
                      nbf: "1421876371"
                      puid: 20030000801A118C
                      ver: "1.0"
                    correlationId: 1e121103-0ba6-4300-ac9d-952bb5d0c80f
                    description: ""
                    eventDataId: 44ade6b4-3813-45e6-ae27-7420a95fa2f8
                    eventName:
                      localizedValue: End request
                      value: EndRequest
                    eventTimestamp: 2015-01-21T22:14:26.9792776Z
                    httpRequest:
                      clientIpAddress: 192.168.35.115
                      clientRequestId: 27003b25-91d3-418f-8eb1-29e537dcb249
                      method: PUT
                    id: /subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841/events/44ade6b4-3813-45e6-ae27-7420a95fa2f8/ticks/635574752669792776
                    level: Informational
                    operationId: 1e121103-0ba6-4300-ac9d-952bb5d0c80f
                    operationName:
                      localizedValue: microsoft.support/supporttickets/write
                      value: microsoft.support/supporttickets/write
                    properties:
                      statusCode: Created
                    resourceGroupName: MSSupportGroup
                    resourceProviderName:
                      localizedValue: microsoft.support
                      value: microsoft.support
                    status:
                      localizedValue: Succeeded
                      value: Succeeded
                    subStatus:
                      localizedValue: "Created (HTTP Status Code: 201)"
                      value: Created
                    submissionTimestamp: 2015-01-21T22:14:39.9936304Z
                    subscriptionId: 089bd33f-d4ec-47fe-8ba5-0753aa5c5b33
        Get Tenant Activity Logs with filter and select:
          parameters:
            $filter: eventTimestamp ge '2015-01-21T20:00:00Z' and eventTimestamp le '2015-01-23T20:00:00Z' and resourceGroupName eq 'MSSupportGroup'
            $select: eventName,id,resourceGroupName,resourceProviderName,operationName,status,eventTimestamp,correlationId,submissionTimestamp,level
            api-version: 2015-04-01
            subscriptionId: 089bd33f-d4ec-47fe-8ba5-0753aa5c5b33
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/########-####-####-####-############$skiptoken=######
                value:
                  - correlationId: 1e121103-0ba6-4300-ac9d-952bb5d0c80f
                    eventName:
                      localizedValue: End request
                      value: EndRequest
                    eventTimestamp: 2015-01-21T22:14:26.9792776Z
                    id: /subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841/events/44ade6b4-3813-45e6-ae27-7420a95fa2f8/ticks/635574752669792776
                    level: Informational
                    operationName:
                      localizedValue: microsoft.support/supporttickets/write
                      value: microsoft.support/supporttickets/write
                    resourceGroupName: MSSupportGroup
                    resourceProviderName:
                      localizedValue: microsoft.support
                      value: microsoft.support
                    status:
                      localizedValue: Succeeded
                      value: Succeeded
                    submissionTimestamp: 2015-01-21T22:14:39.9936304Z
        Get Tenant Activity Logs with select:
          parameters:
            $select: eventName,id,resourceGroupName,resourceProviderName,operationName,status,eventTimestamp,correlationId,submissionTimestamp,level
            api-version: 2015-04-01
            subscriptionId: 089bd33f-d4ec-47fe-8ba5-0753aa5c5b33
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/########-####-####-####-############$skiptoken=######
                value:
                  - correlationId: 1e121103-0ba6-4300-ac9d-952bb5d0c80f
                    eventName:
                      localizedValue: End request
                      value: EndRequest
                    eventTimestamp: 2015-01-21T22:14:26.9792776Z
                    id: /subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841/events/44ade6b4-3813-45e6-ae27-7420a95fa2f8/ticks/635574752669792776
                    level: Informational
                    operationName:
                      localizedValue: microsoft.support/supporttickets/write
                      value: microsoft.support/supporttickets/write
                    resourceGroupName: MSSupportGroup
                    resourceProviderName:
                      localizedValue: microsoft.support
                      value: microsoft.support
                    status:
                      localizedValue: Succeeded
                      value: Succeeded
                    submissionTimestamp: 2015-01-21T22:14:39.9936304Z
        Get Tenant Activity Logs without filter or select:
          parameters:
            api-version: 2015-04-01
            subscriptionId: 089bd33f-d4ec-47fe-8ba5-0753aa5c5b33
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/########-####-####-####-############$skiptoken=######
                value:
                  - authorization:
                      action: microsoft.support/supporttickets/write
                      role: Subscription Admin
                      scope: /subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841
                    caller: admin@contoso.com
                    claims:
                      appid: c44b4083-3bq0-49c1-b47d-974e53cbdf3c
                      appidacr: "2"
                      aud: https://management.core.windows.net/
                      exp: "1421880271"
                      groups: cacfe77c-e058-4712-83qw-f9b08849fd60,7f71d11d-4c41-4b23-99d2-d32ce7aa621c,31522864-0578-4ea0-9gdc-e66cc564d18c
                      http://schemas.microsoft.com/claims/authnclassreference: "1"
                      http://schemas.microsoft.com/claims/authnmethodsreferences: pwd
                      http://schemas.microsoft.com/identity/claims/objectidentifier: 2468adf0-8211-44e3-95xq-85137af64708
                      http://schemas.microsoft.com/identity/claims/scope: user_impersonation
                      http://schemas.microsoft.com/identity/claims/tenantid: 1e8d8218-c5e7-4578-9acc-9abbd5d23315
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname: John
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name: admin@contoso.com
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier: 9vckmEGF7zDKk1YzIY8k0t1_EAPaXoeHyPRn6f413zM
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname: Smith
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn: admin@contoso.com
                      iat: "1421876371"
                      iss: https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/
                      name: John Smith
                      nbf: "1421876371"
                      puid: 20030000801A118C
                      ver: "1.0"
                    correlationId: 1e121103-0ba6-4300-ac9d-952bb5d0c80f
                    description: ""
                    eventDataId: 44ade6b4-3813-45e6-ae27-7420a95fa2f8
                    eventName:
                      localizedValue: End request
                      value: EndRequest
                    eventTimestamp: 2015-01-21T22:14:26.9792776Z
                    httpRequest:
                      clientIpAddress: 192.168.35.115
                      clientRequestId: 27003b25-91d3-418f-8eb1-29e537dcb249
                      method: PUT
                    id: /subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841/events/44ade6b4-3813-45e6-ae27-7420a95fa2f8/ticks/635574752669792776
                    level: Informational
                    operationId: 1e121103-0ba6-4300-ac9d-952bb5d0c80f
                    operationName:
                      localizedValue: microsoft.support/supporttickets/write
                      value: microsoft.support/supporttickets/write
                    properties:
                      statusCode: Created
                    resourceGroupName: MSSupportGroup
                    resourceProviderName:
                      localizedValue: microsoft.support
                      value: microsoft.support
                    status:
                      localizedValue: Succeeded
                      value: Succeeded
                    subStatus:
                      localizedValue: "Created (HTTP Status Code: 201)"
                      value: Created
                    submissionTimestamp: 2015-01-21T22:14:39.9936304Z
                    subscriptionId: 089bd33f-d4ec-47fe-8ba5-0753aa5c5b33
      x-ms-odata: "#/definitions/EventData"
      x-ms-pageable:
        nextLinkName: nextLink
definitions:
  ErrorResponse:
    description: Describes the format of Error response.
    properties:
      code:
        description: Error code
        type: string
      message:
        description: Error message indicating why the operation failed.
        type: string
    type: object
  EventData:
    description: The Azure event log entries are of type EventData
    properties:
      authorization:
        $ref: "#/definitions/SenderAuthorization"
        description: The sender authorization information.
        readOnly: true
      caller:
        description: the email address of the user who has performed the operation, the UPN claim or SPN claim based on availability.
        readOnly: true
        type: string
      category:
        $ref: "#/definitions/LocalizableString"
        description: the event category.
        readOnly: true
      claims:
        additionalProperties:
          type: string
        description: key value pairs to identify ARM permissions.
        readOnly: true
        type: object
      correlationId:
        description: the correlation Id, usually a GUID in the string format. The correlation Id is shared among the events that belong to the same uber operation.
        readOnly: true
        type: string
      description:
        description: the description of the event.
        readOnly: true
        type: string
      eventDataId:
        description: the event data Id. This is a unique identifier for an event.
        readOnly: true
        type: string
      eventName:
        $ref: "#/definitions/LocalizableString"
        description: the event name. This value should not be confused with OperationName. For practical purposes, OperationName might be more appealing to end users.
        readOnly: true
      eventTimestamp:
        description: the timestamp of when the event was generated by the Azure service processing the request corresponding the event. It in ISO 8601 format.
        format: date-time
        readOnly: true
        type: string
      httpRequest:
        $ref: "#/definitions/HttpRequestInfo"
        description: the HTTP request info. Usually includes the 'clientRequestId', 'clientIpAddress' (IP address of the user who initiated the event) and 'method' (HTTP method e.g. PUT).
        readOnly: true
      id:
        description: the Id of this event as required by ARM for RBAC. It contains the EventDataID and a timestamp information.
        readOnly: true
        type: string
      level:
        description: the event level
        enum:
          - Critical
          - Error
          - Warning
          - Informational
          - Verbose
        readOnly: true
        type: string
        x-ms-enum:
          modelAsString: false
          name: EventLevel
      operationId:
        description: It is usually a GUID shared among the events corresponding to single operation. This value should not be confused with EventName.
        readOnly: true
        type: string
      operationName:
        $ref: "#/definitions/LocalizableString"
        description: the operation name.
        readOnly: true
      properties:
        additionalProperties:
          type: string
        description: the set of <Key, Value> pairs (usually a Dictionary<String, String>) that includes details about the event.
        readOnly: true
        type: object
      resourceGroupName:
        description: the resource group name of the impacted resource.
        externalDocs:
          url: http://msdn.microsoft.com/en-us/library/azure/dn790546.aspx
        readOnly: true
        type: string
      resourceId:
        description: the resource uri that uniquely identifies the resource that caused this event.
        externalDocs:
          url: http://msdn.microsoft.com/en-us/library/azure/dn790569.aspx
        readOnly: true
        type: string
      resourceProviderName:
        $ref: "#/definitions/LocalizableString"
        description: the resource provider name of the impacted resource.
        externalDocs:
          url: http://msdn.microsoft.com/en-us/library/azure/dn790572.aspx
        readOnly: true
      resourceType:
        $ref: "#/definitions/LocalizableString"
        description: the resource type
        externalDocs:
          url: http://msdn.microsoft.com/en-us/library/azure/dn790569.aspx
        readOnly: true
      status:
        $ref: "#/definitions/LocalizableString"
        description: "a string describing the status of the operation. Some typical values are: Started, In progress, Succeeded, Failed, Resolved."
        readOnly: true
      subStatus:
        $ref: "#/definitions/LocalizableString"
        description: "the event sub status. Most of the time, when included, this captures the HTTP status code of the REST call. Common values are: OK (HTTP Status Code: 200), Created (HTTP Status Code: 201), Accepted (HTTP Status Code: 202), No Content (HTTP Status Code: 204), Bad Request(HTTP Status Code: 400), Not Found (HTTP Status Code: 404), Conflict (HTTP Status Code: 409), Internal Server Error (HTTP Status Code: 500), Service Unavailable (HTTP Status Code:503), Gateway Timeout (HTTP Status Code: 504)"
        readOnly: true
      submissionTimestamp:
        description: the timestamp of when the event became available for querying via this API. It is in ISO 8601 format. This value should not be confused eventTimestamp. As there might be a delay between the occurrence time of the event, and the time that the event is submitted to the Azure logging infrastructure.
        format: date-time
        readOnly: true
        type: string
      subscriptionId:
        description: the Azure subscription Id usually a GUID.
        readOnly: true
        type: string
      tenantId:
        description: the Azure tenant Id
        readOnly: true
        type: string
  EventDataCollection:
    description: Represents collection of events.
    properties:
      nextLink:
        description: Provides the link to retrieve the next set of events.
        type: string
      value:
        description: this list that includes the Azure audit logs.
        items:
          $ref: "#/definitions/EventData"
        type: array
    required:
      - value
  HttpRequestInfo:
    description: The Http request info.
    properties:
      clientIpAddress:
        description: the client Ip Address
        type: string
      clientRequestId:
        description: the client request id.
        type: string
      method:
        description: the Http request method.
        type: string
      uri:
        description: the Uri.
        type: string
  LocalizableString:
    description: The localizable string class.
    properties:
      localizedValue:
        description: the locale specific value.
        type: string
      value:
        description: the invariant value.
        type: string
    required:
      - value
  SenderAuthorization:
    description: the authorization used by the user who has performed the operation that led to this event. This captures the RBAC properties of the event. These usually include the 'action', 'role' and the 'scope'
    properties:
      action:
        description: "the permissible actions. For instance: microsoft.support/supporttickets/write"
        type: string
      role:
        description: "the role of the user. For instance: Subscription Admin"
        type: string
      scope:
        description: the scope.
        type: string
