swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  title: PolicyEventsClient
  version: 2017-08-09-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/policyinsights/resource-manager/Microsoft.PolicyInsights/preview/2017-08-09-preview/policyEvents.json
      version: "2.0"
  x-preferred: false
  x-providerName: azure.com
  x-serviceName: policyinsights-policyEvents
  x-tags:
    - Azure
    - Microsoft
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  apiVersionParameter:
    description: API version to use with the client requests.
    in: query
    name: api-version
    required: true
    type: string
    x-ms-parameter-location: client
  applyParameter:
    description: OData apply expression for aggregations.
    in: query
    name: $apply
    required: false
    type: string
    x-ms-client-name: Apply
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
  filterParameter:
    description: OData filter expression.
    in: query
    name: $filter
    required: false
    type: string
    x-ms-client-name: Filter
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
  fromParameter:
    description: ISO 8601 formatted timestamp specifying the start time of the interval to query. When not specified, the service uses ($to - 1-day).
    format: date-time
    in: query
    name: $from
    required: false
    type: string
    x-ms-client-name: From
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
  managementGroupNameParameter:
    description: Management group name.
    in: path
    name: managementGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  managementGroupsNamespaceParameter:
    description: The namespace for Microsoft Management resource provider; only "Microsoft.Management" is allowed.
    enum:
      - Microsoft.Management
    in: path
    name: managementGroupsNamespace
    required: true
    type: string
    x-ms-parameter-location: method
  orderByParameter:
    description: Ordering expression using OData notation. One or more comma-separated column names with an optional "desc" (the default) or "asc", e.g. "$orderby=PolicyAssignmentId, ResourceId asc".
    in: query
    name: $orderby
    required: false
    type: string
    x-ms-client-name: OrderBy
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
  policyEventsResourceParameter:
    description: The name of the virtual resource under PolicyEvents resource type; only "default" is allowed.
    enum:
      - default
    in: path
    name: policyEventsResource
    required: true
    type: string
    x-ms-parameter-location: method
  resourceGroupNameParameter:
    description: Resource group name.
    in: path
    name: resourceGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  resourceIdParameter:
    description: Resource ID.
    in: path
    name: resourceId
    required: true
    type: string
    x-ms-parameter-location: method
    x-ms-skip-url-encoding: true
  selectParameter:
    description: Select expression using OData notation. Limits the columns on each record to just those requested, e.g. "$select=PolicyAssignmentId, ResourceId".
    in: query
    name: $select
    required: false
    type: string
    x-ms-client-name: Select
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
  subscriptionIdParameter:
    description: Microsoft Azure subscription ID.
    in: path
    name: subscriptionId
    required: true
    type: string
    x-ms-parameter-location: method
  toParameter:
    description: ISO 8601 formatted timestamp specifying the end time of the interval to query. When not specified, the service uses request time.
    format: date-time
    in: query
    name: $to
    required: false
    type: string
    x-ms-client-name: To
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
  topParameter:
    description: Maximum number of records to return.
    format: int32
    in: query
    minimum: 0
    name: $top
    required: false
    type: integer
    x-ms-client-name: Top
    x-ms-parameter-grouping:
      name: QueryOptions
    x-ms-parameter-location: method
paths:
  "/providers/{managementGroupsNamespace}/managementGroups/{managementGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults":
    post:
      description: Queries policy events for the resources under the management group.
      operationId: PolicyEvents_ListQueryResultsForManagementGroup
      parameters:
        - $ref: "#/parameters/policyEventsResourceParameter"
        - $ref: "#/parameters/managementGroupsNamespaceParameter"
        - $ref: "#/parameters/managementGroupNameParameter"
        - $ref: "#/parameters/apiVersionParameter"
        - $ref: "#/parameters/topParameter"
        - $ref: "#/parameters/orderByParameter"
        - $ref: "#/parameters/selectParameter"
        - $ref: "#/parameters/fromParameter"
        - $ref: "#/parameters/toParameter"
        - $ref: "#/parameters/filterParameter"
        - $ref: "#/parameters/applyParameter"
      responses:
        "200":
          description: Query results.
          schema:
            $ref: "#/definitions/PolicyEventsQueryResults"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/QueryFailure"
      x-ms-examples:
        Query at management group scope:
          parameters:
            api-version: 2017-08-09-preview
            managementGroupName: myManagementGroup
            managementGroupsNamespace: Microsoft.Management
            policyEventsResource: default
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T22:54:39.8128521Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff5d536aec743a0aa801c1a
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - null
                        - false
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - /Microsoft.OperationalInsights/workspaces
                        - canadacentral
                        - myResourceGroup
                        - tbd
                        - fff5d536aec743a0aa801c1a
                        - tbd
                        - "{}"
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - audit
                        - tbd
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/fffcefd2-fff6-ffff-fff4-fffa170eb1d5
                        - fffcefd2-fff6-ffff-fff4-fffa170eb1d5
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff21232277412542086
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ffffb743-fff5-fff7-fffe-fffc2444f333
                      - - 2018-02-05T22:54:39.8128521Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff16fce53454b15a7ed803d
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fff0414b-fff4-fffd-fff5-fff79a89232c
                        - null
                        - false
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - /Microsoft.OperationalInsights/workspaces
                        - canadacentral
                        - myResourceGroup
                        - tbd
                        - fff16fce53454b15a7ed803d
                        - tbd
                        - '{"allowedLocations":{"value":["eastus"]}}'
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fff0414b-fff4-fffd-fff5-fff79a89232c
                        - audit
                        - tbd
                        - ""
                        - ""
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ""
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ffffb743-fff5-fff7-fffe-fffc2444f333
  "/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults":
    post:
      description: Queries policy events for the resources under the subscription.
      operationId: PolicyEvents_ListQueryResultsForSubscription
      parameters:
        - $ref: "#/parameters/policyEventsResourceParameter"
        - $ref: "#/parameters/subscriptionIdParameter"
        - $ref: "#/parameters/apiVersionParameter"
        - $ref: "#/parameters/topParameter"
        - $ref: "#/parameters/orderByParameter"
        - $ref: "#/parameters/selectParameter"
        - $ref: "#/parameters/fromParameter"
        - $ref: "#/parameters/toParameter"
        - $ref: "#/parameters/filterParameter"
        - $ref: "#/parameters/applyParameter"
      responses:
        "200":
          description: Query results.
          schema:
            $ref: "#/definitions/PolicyEventsQueryResults"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/QueryFailure"
      x-ms-examples:
        Filter and aggregate only:
          parameters:
            $apply: aggregate($count as NumDenyEvents)
            $filter: PolicyDefinitionAction eq 'deny'
            $from: 2018-02-05T18:00:00Z
            api-version: 2017-08-09-preview
            policyEventsResource: default
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      NumDenyEvents:
                        dataType: Numeric
                        name: NumDenyEvents
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 40
        Filter and group with aggregate:
          parameters:
            $apply: groupby((PolicyAssignmentId, PolicyDefinitionId, PolicyDefinitionAction, ResourceId), aggregate($count as NumEvents))
            $filter: PolicyDefinitionAction eq 'audit' or PolicyDefinitionAction eq 'deny'
            $from: 2018-02-05T18:00:00Z
            $top: 2
            api-version: 2017-08-09-preview
            policyEventsResource: default
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      NumEvents:
                        dataType: Numeric
                        name: NumEvents
                        ordinal: 5
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 1
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 3
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 2
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 4
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policyassignments/3f3c4330183b4e218fe6fd29
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/24813039-7534-408a-9842-eb99f45721b1
                        - audit
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.servicefabric/clusters/myCluster/applications/resourcescachemonitor/services/myService
                        - 1
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policyassignments/d6be6bb37e5f4333baa95c2a
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/5948d091-78b7-4d3b-a404-cc6a0329b0c6
                        - audit
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.servicefabric/clusters/myCluster/applications/resourcescachemonitor/services/myService
                        - 1
        Filter and group without aggregate:
          parameters:
            $apply: groupby((PolicyAssignmentId, PolicyDefinitionId, PolicyDefinitionAction, ResourceId))
            $filter: PolicyDefinitionAction ne 'audit' and PolicyDefinitionAction ne 'append'
            $from: 2018-01-05T18:00:00Z
            $top: 2
            api-version: 2017-08-09-preview
            policyEventsResource: default
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 1
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 3
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 2
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 4
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.authorization/policyassignments/storageaccountsku
                        - /providers/microsoft.authorization/policydefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1
                        - deny
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/microsoft.storage/storageaccounts/mysa1
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.authorization/policyassignments/da43b50031bf4bce84584faa
                        - /providers/microsoft.authorization/policydefinitions/1e30110a-5ceb-460c-a204-c1c3969c6d62
                        - deny
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.storage/storageaccounts/mysa2
        Filter and multiple groups:
          parameters:
            $apply: groupby((PolicyAssignmentId, PolicyDefinitionId, ResourceId))/groupby((PolicyAssignmentId, PolicyDefinitionId), aggregate($count as NumDeniedResources))
            $filter: PolicyDefinitionAction eq 'deny'
            $from: 2018-01-01T00:00:00Z
            $orderby: NumDeniedResources desc
            $top: 10
            api-version: 2017-08-09-preview
            policyEventsResource: default
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      NumDeniedResources:
                        dataType: Numeric
                        name: NumDeniedResources
                        ordinal: 3
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 1
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 2
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup1/providers/microsoft.authorization/policyassignments/0591f497c35344fcbaf7a393
                        - /providers/microsoft.authorization/policydefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c
                        - 3
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup1/providers/microsoft.authorization/policyassignments/mypolicyassignment2
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/mypolicydefinition2
                        - 2
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup1/providers/microsoft.authorization/policyassignments/mypolicyassignment2
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/mypolicydefinition3
                        - 2
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/5bc427ca-0089-4d0d-85bd-e98d1e40b3bf/providers/microsoft.authorization/policyassignments/mypolicyassignment3
                        - /providers/microsoft.authorization/policydefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1
                        - 1
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.authorization/policyassignments/da43b50031bf4bce84584faa
                        - /providers/microsoft.authorization/policydefinitions/1e30110a-5ceb-460c-a204-c1c3969c6d62
                        - 1
                      - - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup2/providers/microsoft.authorization/policyassignments/mypolicyassignment1
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/microsoft.authorization/policydefinitions/mypolicydefinition1
                        - 1
        Query at subscription scope:
          parameters:
            api-version: 2017-08-09-preview
            policyEventsResource: default
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T22:54:39.8128521Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff5d536aec743a0aa801c1a
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - null
                        - false
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - /Microsoft.OperationalInsights/workspaces
                        - canadacentral
                        - myResourceGroup
                        - tbd
                        - fff5d536aec743a0aa801c1a
                        - tbd
                        - "{}"
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - audit
                        - tbd
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/fffcefd2-fff6-ffff-fff4-fffa170eb1d5
                        - fffcefd2-fff6-ffff-fff4-fffa170eb1d5
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff21232277412542086
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ffffb743-fff5-fff7-fffe-fffc2444f333
                      - - 2018-02-05T22:54:39.8128521Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff16fce53454b15a7ed803d
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fff0414b-fff4-fffd-fff5-fff79a89232c
                        - null
                        - false
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - /Microsoft.OperationalInsights/workspaces
                        - canadacentral
                        - myResourceGroup
                        - tbd
                        - fff16fce53454b15a7ed803d
                        - tbd
                        - '{"allowedLocations":{"value":["eastus"]}}'
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fff0414b-fff4-fffd-fff5-fff79a89232c
                        - audit
                        - tbd
                        - ""
                        - ""
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ""
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ffffb743-fff5-fff7-fffe-fffc2444f333
        "Time range; sort, select and limit":
          parameters:
            $from: 2018-02-05T18:00:00Z
            $orderby: Timestamp desc, PolicyAssignmentId asc, SubscriptionId asc, ResourceGroup asc, ResourceId
            $select: Timestamp, PolicyAssignmentId, PolicyDefinitionId, SubscriptionId, ResourceGroup, ResourceId
            $to: 2018-02-06T18:00:00Z
            $top: 2
            api-version: 2017-08-09-preview
            policyEventsResource: default
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 2
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 3
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 5
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 6
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 4
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T22:34:02.3475017Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/Microsoft.Authorization/policyAssignments/fff27f38-fff4-fff8-fff1-fffc84b8c017
                        - /providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - myResourceGroup
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName
                      - - 2018-02-05T22:34:01.6135357Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/providers/Microsoft.Authorization/policyAssignments/Enable Monitoring in Azure Security Center
                        - /providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - myResourceGroup
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults":
    post:
      description: Queries policy events for the resources under the resource group.
      operationId: PolicyEvents_ListQueryResultsForResourceGroup
      parameters:
        - $ref: "#/parameters/policyEventsResourceParameter"
        - $ref: "#/parameters/subscriptionIdParameter"
        - $ref: "#/parameters/resourceGroupNameParameter"
        - $ref: "#/parameters/apiVersionParameter"
        - $ref: "#/parameters/topParameter"
        - $ref: "#/parameters/orderByParameter"
        - $ref: "#/parameters/selectParameter"
        - $ref: "#/parameters/fromParameter"
        - $ref: "#/parameters/toParameter"
        - $ref: "#/parameters/filterParameter"
        - $ref: "#/parameters/applyParameter"
      responses:
        "200":
          description: Query results.
          schema:
            $ref: "#/definitions/PolicyEventsQueryResults"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/QueryFailure"
      x-ms-examples:
        Query at resource group scope:
          parameters:
            api-version: 2017-08-09-preview
            policyEventsResource: default
            resourceGroupName: myResourceGroup
            subscriptionId: fffedd8f-ffff-fffd-fffd-fffed2f84852
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T22:54:39.8128521Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff5d536aec743a0aa801c1a
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - null
                        - false
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - /Microsoft.OperationalInsights/workspaces
                        - canadacentral
                        - myResourceGroup
                        - tbd
                        - fff5d536aec743a0aa801c1a
                        - tbd
                        - "{}"
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - audit
                        - tbd
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/fffcefd2-fff6-ffff-fff4-fffa170eb1d5
                        - fffcefd2-fff6-ffff-fff4-fffa170eb1d5
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff21232277412542086
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ffffb743-fff5-fff7-fffe-fffc2444f333
                      - - 2018-02-05T22:54:39.8128521Z
                        - /subscriptions/fffedd8f-ffff-fffd-fffd-fffed2f84852/resourcegroups/myResourceGroup/providers/Microsoft.OperationalInsights/workspaces/myWorkspace
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff16fce53454b15a7ed803d
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fff0414b-fff4-fffd-fff5-fff79a89232c
                        - null
                        - false
                        - fffedd8f-ffff-fffd-fffd-fffed2f84852
                        - /Microsoft.OperationalInsights/workspaces
                        - canadacentral
                        - myResourceGroup
                        - tbd
                        - fff16fce53454b15a7ed803d
                        - tbd
                        - '{"allowedLocations":{"value":["eastus"]}}'
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fff0414b-fff4-fffd-fff5-fff79a89232c
                        - audit
                        - tbd
                        - ""
                        - ""
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ""
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ffffb743-fff5-fff7-fffe-fffc2444f333
  "/{resourceId}/providers/Microsoft.PolicyInsights/policyEvents/{policyEventsResource}/queryResults":
    post:
      description: Queries policy events for the resource.
      operationId: PolicyEvents_ListQueryResultsForResource
      parameters:
        - $ref: "#/parameters/policyEventsResourceParameter"
        - $ref: "#/parameters/resourceIdParameter"
        - $ref: "#/parameters/apiVersionParameter"
        - $ref: "#/parameters/topParameter"
        - $ref: "#/parameters/orderByParameter"
        - $ref: "#/parameters/selectParameter"
        - $ref: "#/parameters/fromParameter"
        - $ref: "#/parameters/toParameter"
        - $ref: "#/parameters/filterParameter"
        - $ref: "#/parameters/applyParameter"
      responses:
        "200":
          description: Query results.
          schema:
            $ref: "#/definitions/PolicyEventsQueryResults"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/QueryFailure"
      x-ms-examples:
        Query at nested resource scope:
          parameters:
            api-version: 2017-08-09-preview
            policyEventsResource: default
            resourceId: subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourceGroups/myResourceGroup/providers/Microsoft.ServiceFabric/clusters/myCluster/applications/myApplication
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T23:24:28.4444412Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ServiceFabric/clusters/myCluster/applications/myApplication
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fffc58b7db524a9799381531
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyDefinitions/fff79b49-fff9-fff5-fffe-fff49ab8b474
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.ServiceFabric/clusters/applications
                        - eastus
                        - myResourceGroup
                        - tbd
                        - fffc58b7db524a9799381531
                        - tbd
                        - '{"TAGNAME_1":{"value":"NA"}}'
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - fff79b49-fff9-fff5-fffe-fff49ab8b474
                        - audit
                        - tbd
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policySetDefinitions/fff58873-fff8-fff5-fffc-fffbe7c9d697
                        - fff58873-fff8-fff5-fffc-fffbe7c9d697
                        - null
                        - null
                        - null
                        - ""
                        - "2124621540977569058"
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff3809a-fffc-fffe-fff1-fffe57573195
                      - - 2018-02-05T23:24:28.4444412Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ServiceFabric/clusters/myCluster/applications/myApplication
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff044306c044a1d8c0ff76c
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.ServiceFabric/clusters/applications
                        - eastus
                        - myResourceGroup
                        - tbd
                        - fff044306c044a1d8c0ff76c
                        - tbd
                        - '{"allowedLocations":{"value":["centralus"]}}'
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - audit
                        - tbd
                        - ""
                        - ""
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ""
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff3809a-fffc-fffe-fff1-fffe57573195
        Query at resource scope:
          parameters:
            api-version: 2017-08-09-preview
            policyEventsResource: default
            resourceId: subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourceGroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T22:34:02.3475017Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fff27f38-fff4-fff8-fff1-fffc84b8c017
                        - /providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.ClassicCompute/domainNames
                        - eastus
                        - myResourceGroup
                        - tbd
                        - fff27f38-fff4-fff8-fff1-fffc84b8c017
                        - tbd
                        - "{}"
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - audit
                        - tbd
                        - /providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - null
                        - null
                        - null
                        - ""
                        - null
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff890fa-fff0-fff3-fff9-fffd7653f078
                      - - 2018-02-05T22:34:01.6135357Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/resourcegroups/myResourceGroup/providers/Microsoft.ClassicCompute/domainNames/myDomainName
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/Enable Monitoring in Azure Security Center
                        - /providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.ClassicCompute/domainNames
                        - eastus
                        - myResourceGroup
                        - tbd
                        - Enable Monitoring in Azure Security Center
                        - tbd
                        - "{}"
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - audit
                        - tbd
                        - /providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - null
                        - null
                        - null
                        - ""
                        - null
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff890fa-fff0-fff3-fff9-fffd7653f078
        Query at subscription level nested resource scope:
          parameters:
            api-version: 2017-08-09-preview
            policyEventsResource: default
            resourceId: subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResource/someNestedResourceType/someNestedResource
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T23:24:28.4444412Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResource/someNestedResourceType/someNestedResource
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fffc58b7db524a9799381531
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyDefinitions/fff79b49-fff9-fff5-fffe-fff49ab8b474
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.SomeNamespace/someResourceType/someNestedResourceType
                        - eastus
                        - ""
                        - tbd
                        - fffc58b7db524a9799381531
                        - tbd
                        - '{"TAGNAME_1":{"value":"NA"}}'
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - fff79b49-fff9-fff5-fffe-fff49ab8b474
                        - audit
                        - tbd
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policySetDefinitions/fff58873-fff8-fff5-fffc-fffbe7c9d697
                        - fff58873-fff8-fff5-fffc-fffbe7c9d697
                        - null
                        - null
                        - null
                        - ""
                        - "2124621540977569058"
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff3809a-fffc-fffe-fff1-fffe57573195
                      - - 2018-02-05T23:24:28.4444412Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResource/someNestedResourceType/someNestedResource
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyAssignments/fff044306c044a1d8c0ff76c
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup/providers/Microsoft.Authorization/policyDefinitions/fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.SomeNamespace/someResourceType/someNestedResourceType
                        - eastus
                        - ""
                        - tbd
                        - fff044306c044a1d8c0ff76c
                        - tbd
                        - '{"allowedLocations":{"value":["centralus"]}}'
                        - /providers/Microsoft.Management/managementGroups/myManagementGroup
                        - fffd9357-fff0-fff7-fff4-fff30ce4c32d
                        - audit
                        - tbd
                        - ""
                        - ""
                        - null
                        - null
                        - null
                        - myManagementGroup,fff988bf-fff1-ffff-fffb-fffcd011db47
                        - ""
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff3809a-fffc-fffe-fff1-fffe57573195
        Query at subscription level resource scope:
          parameters:
            api-version: 2017-08-09-preview
            policyEventsResource: default
            resourceId: subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResourceName
          responses:
            "200":
              body:
                value:
                  - columns:
                      EffectiveParameters:
                        dataType: String
                        name: EffectiveParameters
                        ordinal: 5
                      IsCompliant:
                        dataType: Boolean
                        name: IsCompliant
                        ordinal: 6
                      ManagementGroupIds:
                        dataType: String
                        name: ManagementGroupIds
                        ordinal: 24
                      PolicyAssignmentId:
                        dataType: String
                        name: PolicyAssignmentId
                        ordinal: 3
                      PolicyAssignmentName:
                        dataType: String
                        name: PolicyAssignmentName
                        ordinal: 12
                      PolicyAssignmentOwner:
                        dataType: String
                        name: PolicyAssignmentOwner
                        ordinal: 13
                      PolicyAssignmentParameters:
                        dataType: String
                        name: PolicyAssignmentParameters
                        ordinal: 14
                      PolicyAssignmentScope:
                        dataType: String
                        name: PolicyAssignmentScope
                        ordinal: 15
                      PolicyDefinitionAction:
                        dataType: String
                        name: PolicyDefinitionAction
                        ordinal: 17
                      PolicyDefinitionCategory:
                        dataType: String
                        name: PolicyDefinitionCategory
                        ordinal: 18
                      PolicyDefinitionId:
                        dataType: String
                        name: PolicyDefinitionId
                        ordinal: 4
                      PolicyDefinitionName:
                        dataType: String
                        name: PolicyDefinitionName
                        ordinal: 16
                      PolicyDefinitionReferenceId:
                        dataType: String
                        name: PolicyDefinitionReferenceId
                        ordinal: 25
                      PolicySetDefinitionCategory:
                        dataType: String
                        name: PolicySetDefinitionCategory
                        ordinal: 22
                      PolicySetDefinitionId:
                        dataType: String
                        name: PolicySetDefinitionId
                        ordinal: 19
                      PolicySetDefinitionName:
                        dataType: String
                        name: PolicySetDefinitionName
                        ordinal: 20
                      PolicySetDefinitionOwner:
                        dataType: String
                        name: PolicySetDefinitionOwner
                        ordinal: 21
                      PolicySetDefinitionParameters:
                        dataType: String
                        name: PolicySetDefinitionParameters
                        ordinal: 23
                      PrincipalOid:
                        dataType: String
                        name: PrincipalOid
                        ordinal: 27
                      ResourceGroup:
                        dataType: String
                        name: ResourceGroup
                        ordinal: 10
                      ResourceId:
                        dataType: String
                        name: ResourceId
                        ordinal: 2
                      ResourceLocation:
                        dataType: String
                        name: ResourceLocation
                        ordinal: 9
                      ResourceTags:
                        dataType: String
                        name: ResourceTags
                        ordinal: 11
                      ResourceType:
                        dataType: String
                        name: ResourceType
                        ordinal: 8
                      SubscriptionId:
                        dataType: String
                        name: SubscriptionId
                        ordinal: 7
                      TenantId:
                        dataType: String
                        name: TenantId
                        ordinal: 26
                      Timestamp:
                        dataType: DateTime
                        name: Timestamp
                        ordinal: 1
                    metadata:
                      generatedQuery: ""
                    rows:
                      - - 2018-02-05T22:34:02.3475017Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResourceName
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/fff27f38-fff4-fff8-fff1-fffc84b8c017
                        - /providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.SomeNamespace/someResourceType
                        - eastus
                        - ""
                        - tbd
                        - fff27f38-fff4-fff8-fff1-fffc84b8c017
                        - tbd
                        - "{}"
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - audit
                        - tbd
                        - /providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - null
                        - null
                        - null
                        - ""
                        - null
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff890fa-fff0-fff3-fff9-fffd7653f078
                      - - 2018-02-05T22:34:01.6135357Z
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.SomeNamespace/someResourceType/someResourceName
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5/providers/Microsoft.Authorization/policyAssignments/Enable Monitoring in Azure Security Center
                        - /providers/Microsoft.Authorization/policyDefinitions/fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - null
                        - false
                        - fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - /Microsoft.SomeNamespace/someResourceType
                        - eastus
                        - ""
                        - tbd
                        - Enable Monitoring in Azure Security Center
                        - tbd
                        - "{}"
                        - /subscriptions/fff10b27-fff3-fff5-fff8-fffbe01e86a5
                        - fffea587-fff0-fff3-ffff-fff0ae01cfd6
                        - audit
                        - tbd
                        - /providers/Microsoft.Authorization/policySetDefinitions/fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - fffafdf9-fff9-fffd-ffff-fffa613e70a8
                        - null
                        - null
                        - null
                        - ""
                        - null
                        - fff988bf-fff1-ffff-fffb-fffcd011db47
                        - fff890fa-fff0-fff3-fff9-fffd7653f078
definitions:
  Column:
    description: Column definition.
    properties:
      dataType:
        description: Data type of the column.
        type: string
      name:
        description: Name of the column.
        type: string
      ordinal:
        description: Ordinal value of the column in a record.
        format: int32
        type: integer
  PolicyEventsQueryResults:
    description: Query results.
    properties:
      value:
        description: Query results.
        items:
          $ref: "#/definitions/PolicyEventsQueryResultsTable"
        type: array
  PolicyEventsQueryResultsTable:
    description: Query results table.
    properties:
      columns:
        additionalProperties:
          description: The list of key/value pairs for the additional properties, in the format 'key':'value' where key = the field name, and value = the field value. By default this is not populated
        description: List of columns included in query results.
        properties:
          EffectiveParameters:
            $ref: "#/definitions/Column"
            description: Effective parameters for the policy assignment.
          IsCompliant:
            $ref: "#/definitions/Column"
            description: Flag which states whether the resource is compliant against the policy assignment it was evaluated against.
          ManagementGroupIds:
            $ref: "#/definitions/Column"
            description: Comma separated list of management group IDs, which represent the hierarchy of the management groups the resource is under.
          PolicyAssignmentId:
            $ref: "#/definitions/Column"
            description: Policy assignment ID.
          PolicyAssignmentName:
            $ref: "#/definitions/Column"
            description: Policy assignment name.
          PolicyAssignmentOwner:
            $ref: "#/definitions/Column"
            description: Policy assignment owner.
          PolicyAssignmentParameters:
            $ref: "#/definitions/Column"
            description: Policy assignment parameters.
          PolicyAssignmentScope:
            $ref: "#/definitions/Column"
            description: Policy assignment scope.
          PolicyDefinitionAction:
            $ref: "#/definitions/Column"
            description: Policy definition action, i.e. effect.
          PolicyDefinitionCategory:
            $ref: "#/definitions/Column"
            description: Policy definition category.
          PolicyDefinitionId:
            $ref: "#/definitions/Column"
            description: Policy definition ID.
          PolicyDefinitionName:
            $ref: "#/definitions/Column"
            description: Policy definition name.
          PolicyDefinitionReferenceId:
            $ref: "#/definitions/Column"
            description: Reference ID for the policy definition inside the policy set, if the policy assignment is for a policy set.
          PolicySetDefinitionCategory:
            $ref: "#/definitions/Column"
            description: Policy set definition category, if the policy assignment is for a policy set.
          PolicySetDefinitionId:
            $ref: "#/definitions/Column"
            description: Policy set definition ID, if the policy assignment is for a policy set.
          PolicySetDefinitionName:
            $ref: "#/definitions/Column"
            description: Policy set definition name, if the policy assignment is for a policy set.
          PolicySetDefinitionOwner:
            $ref: "#/definitions/Column"
            description: Policy set definition owner, if the policy assignment is for a policy set.
          PolicySetDefinitionParameters:
            $ref: "#/definitions/Column"
            description: Policy set definition parameters, if the policy assignment is for a policy set.
          PrincipalOid:
            $ref: "#/definitions/Column"
            description: Principal object ID for the user who initiated the resource operation that triggered the policy event.
          ResourceGroup:
            $ref: "#/definitions/Column"
            description: Resource group name.
          ResourceId:
            $ref: "#/definitions/Column"
            description: Resource ID.
          ResourceLocation:
            $ref: "#/definitions/Column"
            description: Resource location.
          ResourceTags:
            $ref: "#/definitions/Column"
            description: List of resource tags.
          ResourceType:
            $ref: "#/definitions/Column"
            description: Resource type.
          SubscriptionId:
            $ref: "#/definitions/Column"
            description: Subscription ID.
          TenantId:
            $ref: "#/definitions/Column"
            description: Tenant ID for the policy event record.
          Timestamp:
            $ref: "#/definitions/Column"
            description: Timestamp for the policy event record.
        type: object
      metadata:
        description: Metadata about the query results.
        properties:
          generatedQuery:
            description: Internal query generated. Used for diagnostics purposes.
            type: string
      rows:
        description: Query result rows, each representing a policy event record.
        items:
          description: Query result row.
          items:
            description: Each column of the query result row.
          type: array
        type: array
  QueryFailure:
    description: Error response.
    properties:
      error:
        description: Error definition.
        properties:
          code:
            description: Service specific error code which serves as the substatus for the HTTP error code.
            type: string
          message:
            description: Description of the error.
            type: string
