List - Entities API


Microsoft Defender for Cloud Apps is now part of Microsoft 365 Defender, which correlates signals from across the Microsoft Defender suite and provides incident-level detection, investigation, and powerful response capabilities. For more information, see Microsoft Defender for Cloud Apps in Microsoft 365 Defender.


This request is not available for Microsoft 365 Cloud App Security.

Run the GET or POST request to fetch a list of entities matching the specified filters.

HTTP request

GET /api/v1/entities/
POST /api/v1/entities/

Request BODY parameters

Parameter Description
filters Filter objects with all the search filters for the request, see entity filters for more details
sortDirection The sorting direction. Possible values are: asc and desc
sortField Fields used to sort entities. Possible values are:
- date: The date when then the entity was created
- severity: The severity of the entity
skip Skips the specified number of records
limit Maximum number of records returned by the request



Here is an example of the request.

curl -XPOST -H "Authorization:Token <your_token_key>" -H "Content-Type: application/json" "https://<tenant_id>.<tenant_region>" -d '{
  "filters": {
    // some filters
  "skip": 5,
  "limit": 10


Returns a list of activities in JSON format.

  "total": 5 // total number of records
  "hasNext": true // whether there is more data to show or not.
  "data": [
    // returned records

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.