Partner Center Security Compliance API

Appropriate roles: Security Administrator | Security Reader | Admin Agent

Applies to: Partner Center

The Partner Center security compliance API lets you retrieve your partner organization's compliance tasks, review response-time assessments, and update task statuses. It supports automation for the unified Task model used in the redesigned Security workspace, where security requirements and alerts are presented as actionable Tasks.

This article describes the task model, supported operations, JSON resources, and REST request and response examples. API property names and values retain their exact casing, even when the workspace uses different display labels.

Concepts in the redesigned experience

The following concepts connect the Security workspace experience to the API resources in this article.

Concept	Meaning in the workspace	API representation
Task	A discrete, actionable unit of work with a scope, lifecycle state, and, when available, a due date. Completion depends on verification of the underlying condition, not manual attestation alone.	A compliance task, identified by taskId.
Task Group	Related Tasks grouped by root cause or classification. Group progress is derived from its Tasks, rather than a separately editable group status.	Task properties such as taskGroupId, taskGroupTitle, and taskGroupClassification. The operations in this article don't return a separate Task Group resource or group-progress summary.
Occurrence	An instance of the underlying condition that helps identify what needs attention in the source system. Status is managed at the Task level.	There is no separate Occurrence resource or Occurrence status operation in this API reference. Don't assume that feed-specific details provide a standardized Occurrence collection.
Overall compliance	The workspace's Complete/Incomplete indicator, with an "As of" timestamp. The redesigned experience doesn't use a numerical security score.	No overall-compliance or numerical-score operation is defined in this article. The response-time assessment evaluates only the response-time requirement.
Data freshness	The time the underlying source data was refreshed, rather than the time a user opened the page or a client retrieved a response.	lastRefreshDateTime for Task Group data; calculatedAt and expiresAt for a response-time assessment. These timestamps aren't interchangeable.

Task lifecycle and states

The workspace calls the lifecycle value a state; the API exposes it as status. Use the following exact, case-sensitive strings in API requests and responses.

Status	Meaning	Can this API set it?
New	The Task has been created and hasn't yet been acknowledged or acted on.	No.
In Progress	The partner has taken ownership and work is under way. This corresponds to the acknowledgement action described as Investigating in the current alert experience.	Yes, subject to the transition restrictions below.
Ignore	For an eligible Task, the partner has determined that the event is known and legitimate. Ignoring a Task doesn't remediate the condition or remove responsibility for associated usage charges.	Yes, only when isIgnorable is true.
Ready for Review	The partner has completed the required work and is awaiting verification of the underlying condition.	Yes, subject to the transition restrictions below.
Complete	Microsoft has confirmed that the underlying condition is resolved.	No. Completion is system-managed.

To work with a Task programmatically:

1. List compliance tasks and select the Task that needs attention.
2. Get the Task details to review its current status, feed-specific information, notes, and recent activity.
3. Set the status to In Progress when work begins.
4. Remediate the condition in the appropriate source system, such as Microsoft Entra, the Azure portal, or Partner Center.
5. Set the status to Ready for Review when the work is finished, then retrieve the Task again after source verification to check its status and data freshness.

Important

A successful status update confirms a workflow change, not completion of the underlying work. Don't treat Ready for Review or Ignore as Complete. For a known, legitimate event, use Ignore only when permitted. An ignored Task must return to In Progress before it can move to Ready for Review; a Complete Task can't be changed by this operation.

API scope during the transition

The redesigned workspace and the API don't necessarily expose the same actions. Use the operations and schemas in this article as the contract for this API, rather than assuming that every workspace action has an API equivalent.

Capability	Support in this API
Retrieve Tasks and their details	List and detail operations, including Task Group identifiers, available scope information, and refresh timestamps.
Update a Task's state	Status operation for In Progress, Ready for Review, and, where permitted, Ignore. Each request targets one Task; no bulk status operation is defined here.
View notes and activity	Task details include existing notes and up to 50 retained activity entries. The activity log might be truncated.
Add notes or comments	Not supported by the operations in this article. Don't include notes in the status request.
View or change Occurrences	No separate Occurrence operation is defined here. Make required changes in the source system.
Review response time	A partner-wide assessment of time to the first recorded status change. It isn't an overall-compliance result.
Manage subscriptions	Not supported by these operations. Manage the subscription in the appropriate source system.
Enable the workspace preview	No preview-toggle operation is defined here. API access requires enablement for the partner organization.

During the workspace transition, distinguish these Partner Center endpoints from the current Microsoft Graph beta APIs for security alerts, requirements, and security score. This article doesn't define a retirement date, a one-to-one mapping from existing alert IDs to Task IDs, or a replacement for every existing operation. Obtain opaque Task IDs from this API; don't construct them from existing alert or subscription identifiers.

Note

The workspace describes the 24-hour alert acknowledgement requirement in terms of moving Tasks to In Progress. The response-time endpoint described here measures the first recorded status change, including elapsed time for measurable Tasks with no change. Use the assessment rules when interpreting API results; don't assume that the endpoint measures only transitions to In Progress or only Tasks that have already received a response.

Resource conventions

The following resources describe the JSON data returned or accepted by the operations in this article. As in other Partner Center REST resources, property tables define the request and response elements.

JSON property names and status values are case-sensitive. Timestamps are UTC ISO 8601 strings, for example 2026-10-01T12:00:00.000Z. Nullable fields can contain null; do not assume every task has customer, subscription, deadline, or resolution information.

Compliance task

Describes a compliance task, including its current status, severity, deadline, and associated customer or subscription. Both the list and detail operations return these properties.

Property	Type	Description
taskId	string	Opaque task identifier. Use it unchanged, URL-encoded, for detail and status requests.
taskGroupId	string	Task group identifier.
taskGroupTitle	string or null	Display title for the task group.
taskGroupClassification	string or null	Classification such as Fraud; do not infer a complete enumeration from this example.
isEligibilityRequirement	boolean	Whether the task group is marked as an eligibility requirement.
requirementId	string	Requirement identifier, usable in a list filter.
taskTitle	string or null	Display title for the task.
status	string	Current task status: New, In Progress, Ready for Review, Complete, or Ignore.
isIgnorable	boolean	Whether the feed allows the task to be ignored.
customerTenantId	string or null	Customer tenant identifier, when available.
customerName	string or null	Customer display name, when available.
subscriptionId	string or null	Subscription identifier, when available.
subscriptionName	string or null	Subscription display name, when available.
severity	string or null	Informational, High, Medium, Low, or null when unavailable/unrecognized.
deadlineDateTime	timestamp or null	Calculated task deadline, when available.
createdDate	timestamp	Task creation time.
lastModifiedDate	timestamp or null	Last task modification time.
lastRefreshDateTime	timestamp or null	Task-group data refresh time; not the time the client fetched the task.
resolvedDate	timestamp or null	Resolution time, when available.
version	string	Opaque storage version. Preserve its value, including embedded quotes; do not parse it.

Important

Task IDs are opaque strings, not GUIDs. Copy taskId from a list or detail response and URL-encode it once as a single path segment. Do not construct IDs, split them into business identifiers, append whitespace, or base64-encode them. The encoded colons in the examples are intentional.

Compliance task details

Describes a single compliance task with feed-specific details, notes, and recent activity. Includes all compliance task properties plus the following properties.

Property	Type	Description
details	object	Feed-specific detail fields. The detail response example is for Usage Anomaly Detection; other requirements can return different fields or an empty object.
notes	string or null	Existing task notes. This API's status operation cannot update notes.
activityLog	array of compliance task activity resources	Up to 50 retained activity entries, newest first.
activityLogTruncated	boolean	True when activity history is truncated. Do not treat the array as a complete audit trail.

Compliance task activity

Describes a recorded change to a compliance task. Optional values can be null.

Property	Type	Description
date	timestamp	Date and time of the activity.
action	string	Recorded action, such as FeedCreated.
oldStatus	string or null	Task status before the change, when available.
newStatus	string or null	Task status after the change, when available.
changeReason	string or null	Reason for the change, when available.
notes	string or null	Notes associated with the activity, when available.

Compliance task collection

Describes a page of compliance tasks.

Property	Type	Description
value	array of compliance task resources	Tasks on the current page. An empty result is {"value":[]}.
@odata.nextLink	string	URL for the next page. Present only when more results exist. Follow the returned link rather than constructing a continuation token.

The collection has no total-count property. For continuation behavior and expiration, see Pagination.

Response-time assessment

Describes your partner organization's average time to the first status change for compliance tasks. This is a partner-wide assessment, not an individual task's elapsed time, time to final resolution, or HTTP API latency.

Property	Type	Description
completion	string	Assessment result: complete, notComplete, or unknown. Not a task status.
thresholdSeconds	integer	Assessment threshold, currently 86,400 seconds (24 hours).
averageDurationSeconds	integer or null	Average measured duration in seconds, rounded up to a whole second. Null when no measurement is available.
sampleCount	integer or null	Number of measurable task samples included in the average.
availability	string	Availability of the underlying calculation evidence: available, partial, or unavailable. Inspect this separately from completion.
reason	string or null	Explanation for missing/partial evidence, such as noHistory, insufficientHistory, partialHistory, truncatedHistory, or registryPartial. Null when not needed.
definitionVersion	integer	Version of the measurement definition.
activeFeedSetVersion	string or null	Opaque version identifying the active feed set used in the assessment.
windowStart	timestamp or null	Measurement cohort window start, inclusive.
windowEnd	timestamp or null	Measurement cohort window end, exclusive.
calculatedAt	timestamp or null	Calculation time.
expiresAt	timestamp or null	Assessment expiration time.

For measurement rules and evidence limitations, see Get the response-time assessment.

Task status update request

Describes the request body for updating a compliance task's workflow status.

Property	Type	Required	Description
status	string	Yes	Exactly In Progress, Ready for Review, or Ignore.

Supply only status. For permitted transitions and restrictions, see Update a compliance task's status.

Task status update result

Describes a confirmed status update.

Property	Type	Description
taskId	string	Opaque identifier of the updated task.
status	string	Confirmed task status.
lastModifiedDate	timestamp	Task modification time.
version	string	Opaque storage version after the update, including embedded quotes.

Error

Describes an ordinary compliance API fault. Authentication/MFA failures and front-door failures can use different bodies; do not assume every error matches this shape.

Property	Type	Description
code	integer	Numeric error code. Use the HTTP status code and response body together to determine the next action.
description	string	Description of the error.
source	string	Identifier of the service that produced the error, such as PCFraudEvents.

For HTTP status codes and a sample error body, see Response success and error codes.

Operations

Use the following REST operations with these resources.

Operation	Method	Request URI
List compliance tasks	GET	/v1/compliance/tasks
Get a compliance task	GET	/v1/compliance/tasks/{taskId}
Get the response-time assessment	GET	/v1/compliance/responseTime
Update a compliance task's status	PUT	/v1/compliance/tasks/{taskId}/status

Prerequisites

• Configure a Microsoft Entra application for Partner Center API access. For setup guidance, see Set up API access in Partner Center.
• Obtain an access token using App+User authentication as described in Partner Center authentication. App-only authentication is not supported by these operations.
• The delegated user must satisfy MFA and have permission to view compliance/security information. Updating status requires management permission; read-only permission is insufficient.
• The API must be enabled for the partner organization. Requests operate on the authenticated partner's tenant, not a tenant selected through a request parameter or header.

For MFA integration guidance, see Enable secure application model.

REST request conventions

The production base URL is https://api.partnercenter.microsoft.com. The examples below use this URL. Examples don't establish availability for a particular partner organization; the API must be enabled for that organization.

Request headers

The following headers apply to these operations. For general header definitions, see Partner Center REST headers. Not every Partner Center header applies to every operation.

Header	Usage
Authorization	Required. Bearer <token>, using an access token obtained through Partner Center authentication. Never publish or log an actual token.
Accept	Use application/json.
Content-Type	Required for PUT: application/json. GET requests have no request body.
MS-CorrelationId	Supply a new GUID for each call to correlate logs and network traces when troubleshooting.
MS-RequestId	Supply a GUID identifying the request. For general retry conventions, see the Partner Center REST headers reference; for status updates, follow the endpoint-specific recovery guidance below.

Note

The status update operation doesn't require If-Match. Do not assume that a request ID or a returned ETag makes an uncertain status update safe to replay. Retrieve the task before deciding whether to retry.

List compliance tasks

Retrieve a paginated list of compliance tasks for your partner organization, including each task's status, severity, deadline, and available customer or subscription information. Use filters to narrow the results by status, task group, requirement, customer tenant, or subscription. Use the returned task IDs to retrieve details or update a task's status.

REST request

Method	Request URI
GET	https://api.partnercenter.microsoft.com/v1/compliance/tasks

Query parameters

Name	Type	Required	Description
$top	integer	No	Page size from 1 to 100. Default: 100.
$filter	string	No	Supported equality expressions described below. Maximum length: 1,000 characters.
$skiptoken	string	No	Opaque continuation token supplied in @odata.nextLink. Follow the returned link rather than generating a token.

Supported filter fields: status, taskGroupId, requirementId, customerTenantId, and subscriptionId. Use eq with single-quoted string values and and between predicates. A parenthesized or group is supported for status values only, for example:

requirementId eq 'UsageAnomalyDetection' and (status eq 'New' or status eq 'In Progress')

Supported status filter values are New, In Progress, Ready for Review, Complete, and Ignore. Escape a literal apostrophe inside a value as two apostrophes, and URL-encode query values. This endpoint supports a limited OData-style syntax, not general OData: $orderby, $skip, $select, and repeated query parameters are not supported.

Request body

None.

Request example

GET https://api.partnercenter.microsoft.com/v1/compliance/tasks?$top=1&$filter=requirementId%20eq%20%27UsageAnomalyDetection%27%20and%20status%20eq%20%27New%27 HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
MS-CorrelationId: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
MS-RequestId: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb

REST response

If successful, this method returns 200 OK and a compliance task collection in the response body. An empty result is {"value":[]}; there is no total-count property.

Response example

{
  "value": [
    {
      "taskId": "usage-anomaly-detection::11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
      "taskGroupId": "usage-anomaly-detection",
      "taskGroupTitle": "Usage Anomaly Detection",
      "taskGroupClassification": "Fraud",
      "isEligibilityRequirement": false,
      "requirementId": "UsageAnomalyDetection",
      "taskTitle": "Action Required: Subscription Usage Anomaly Detected",
      "status": "New",
      "isIgnorable": true,
      "customerTenantId": null,
      "customerName": "Contoso Customer",
      "subscriptionId": "11111111-1111-4111-8111-111111111111",
      "subscriptionName": null,
      "severity": "High",
      "deadlineDateTime": "2026-10-15T12:00:00.000Z",
      "createdDate": "2026-09-15T12:00:00.000Z",
      "lastModifiedDate": "2026-09-15T12:00:00.000Z",
      "lastRefreshDateTime": "2026-10-01T11:00:00.000Z",
      "resolvedDate": null,
      "version": "\"33333333-3333-4333-8333-333333333333\""
    }
  ],
  "@odata.nextLink": "https://api.partnercenter.microsoft.com/v1/compliance/tasks?$top=1&$filter=requirementId%20eq%20%27UsageAnomalyDetection%27%20and%20status%20eq%20%27New%27&$skiptoken=55555555-5555-4555-8555-555555555555"
}

Pagination

Follow @odata.nextLink with the same authentication until the property is absent. Do not change the page size or filter during a traversal. Continuations expire one hour after the first page; fetching another page does not extend that expiration. An invalid, expired, or incompatible token returns 400; restart from the initial list request. Changes to the active feed configuration can invalidate a continuation. Paging a changing list is not a point-in-time snapshot.

Get a compliance task

Retrieve a single compliance task using a task ID returned by the list endpoint. The response includes the task's summary properties plus feed-specific details, existing notes, and recent activity history. Use this operation to investigate a task or refresh its current state before deciding on a status update.

REST request

Method	Request URI
GET	https://api.partnercenter.microsoft.com/v1/compliance/tasks/{taskId}

URI parameters

Name	Type	Required	Description
taskId	string	Yes	Opaque task identifier returned by a list or detail response, URL-encoded once as a single path segment.

Request body

None. No query parameters are supported.

Request example

GET https://api.partnercenter.microsoft.com/v1/compliance/tasks/usage-anomaly-detection%3A%3A11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222 HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
MS-CorrelationId: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
MS-RequestId: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb

REST response

If successful, this method returns 200 OK and compliance task details in the response body. The ETag response header matches version.

Response example

{
  "details": {
    "alertId": "11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
    "alertDisplayName": "Action Required: Subscription Usage Anomaly Detected",
    "severity": "High",
    "subscriptionId": "11111111-1111-4111-8111-111111111111",
    "customerName": "Contoso Customer",
    "detectedTime": "2026-09-15T12:00:00.000Z",
    "description": "Unusual subscription usage was detected. Review the affected subscription."
  },
  "notes": null,
  "activityLog": [
    {
      "date": "2026-09-15T12:00:00.000Z",
      "action": "FeedCreated",
      "oldStatus": null,
      "newStatus": "New",
      "changeReason": null,
      "notes": null
    }
  ],
  "activityLogTruncated": false,
  "taskId": "usage-anomaly-detection::11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
  "taskGroupId": "usage-anomaly-detection",
  "taskGroupTitle": "Usage Anomaly Detection",
  "taskGroupClassification": "Fraud",
  "isEligibilityRequirement": false,
  "requirementId": "UsageAnomalyDetection",
  "taskTitle": "Action Required: Subscription Usage Anomaly Detected",
  "status": "New",
  "isIgnorable": true,
  "customerTenantId": null,
  "customerName": "Contoso Customer",
  "subscriptionId": "11111111-1111-4111-8111-111111111111",
  "subscriptionName": null,
  "severity": "High",
  "deadlineDateTime": "2026-10-15T12:00:00.000Z",
  "createdDate": "2026-09-15T12:00:00.000Z",
  "lastModifiedDate": "2026-09-15T12:00:00.000Z",
  "lastRefreshDateTime": "2026-10-01T11:00:00.000Z",
  "resolvedDate": null,
  "version": "\"33333333-3333-4333-8333-333333333333\""
}

Get the response-time assessment

Retrieve your partner organization's assessment of how quickly compliance tasks receive their first status change, measured against the current 24-hour threshold. The assessment covers tasks opened during the preceding 30 days and includes elapsed time for measurable tasks that have not yet changed status. It returns the average duration, sample count, assessment result, and evidence availability; it does not measure final resolution time or API latency.

REST request

Method	Request URI
GET	https://api.partnercenter.microsoft.com/v1/compliance/responseTime

No query parameters are supported.

Request body

None.

Request example

GET https://api.partnercenter.microsoft.com/v1/compliance/responseTime HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
MS-CorrelationId: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
MS-RequestId: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb

REST response

If successful, this method returns 200 OK and a response-time assessment in the response body.

Response example

{
  "completion": "notComplete",
  "thresholdSeconds": 86400,
  "averageDurationSeconds": 108000,
  "sampleCount": 10,
  "availability": "available",
  "reason": null,
  "definitionVersion": 1,
  "activeFeedSetVersion": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "windowStart": "2026-09-01T12:00:00.000Z",
  "windowEnd": "2026-10-01T12:00:00.000Z",
  "calculatedAt": "2026-10-01T12:00:00.000Z",
  "expiresAt": "2026-10-01T12:10:00.000Z"
}

Assessment rules

The current definition considers tasks opened during the preceding 30 days in active feeds, excluding tasks initially Complete. It measures time from the recorded opening event to the first recorded status change; a measurable task with no change contributes elapsed time up to calculation time. Missing or truncated history can reduce availability. The average is therefore not limited to tasks already acted upon and is not time to final resolution.

With measurable evidence, an average at or below 86,400 seconds evaluates to complete; above that evaluates to notComplete. A partial feed registry evaluates to unknown. With no history, the current implementation can return completion: "complete" with availability: "unavailable" and a null average; do not interpret this as a measured zero-second response time. Successful assessment objects can represent partial/unavailable evidence; dependency failures can instead return 503.

Update a compliance task's status

Update a task's workflow status to In Progress, Ready for Review, or Ignore, subject to the task's current status and whether its feed permits Ignore. This operation requires management permission and returns the confirmed status, modification time, and version. Changing the status records your workflow progress; it does not remediate the underlying issue or allow you to mark the task Complete.

REST request

Method	Request URI
PUT	https://api.partnercenter.microsoft.com/v1/compliance/tasks/{taskId}/status

URI parameters

Name	Type	Required	Description
taskId	string	Yes	Opaque task identifier returned by a list or detail response, URL-encoded once as a single path segment.

No query parameters are supported.

Request body

Use a task status update request containing the required status property.

Supply only status. Additional/duplicate properties, a missing or nonstring status, and malformed JSON return 400.

• New and Complete cannot be set by this operation; Complete is system-managed.
• A Complete task cannot be changed by this operation.
• Ignore is permitted only when the feed allows it (isIgnorable).
• An ignored task can remain Ignore or be reopened to In Progress, but cannot move directly to Ready for Review.
• The server checks concurrency internally. A client If-Match header is not required by this endpoint; the returned version is not a documented client precondition.

Request example

PUT https://api.partnercenter.microsoft.com/v1/compliance/tasks/usage-anomaly-detection%3A%3A11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222/status HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
Content-Type: application/json
MS-CorrelationId: cccccccc-cccc-4ccc-8ccc-cccccccccccc
MS-RequestId: dddddddd-dddd-4ddd-8ddd-dddddddddddd

{
  "status": "In Progress"
}

REST response

If successful, this method returns 200 OK and a task status update result in the response body. The ETag response header matches the returned version.

Response example

{
  "taskId": "usage-anomaly-detection::11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
  "status": "In Progress",
  "lastModifiedDate": "2026-10-01T12:05:00.000Z",
  "version": "\"44444444-4444-4444-8444-444444444444\""
}

Important

A status update records a workflow change; it does not itself remediate the underlying issue. On a conflict, timeout, or response saying the update could not be confirmed, GET the task before deciding whether to retry. Some failures can occur after the source status has already been saved. Do not blindly replay a PUT.

Response success and error codes

See Partner Center REST error codes for general guidance. The following cases are specific to these operations:

HTTP status	Meaning / client action
200	Successful list, detail, assessment, or status update.
400	Invalid ID, unsupported/repeated query parameter, invalid filter/page size/continuation, invalid body, or disallowed status transition. Correct the request; restart pagination for invalid continuations.
401	Authentication is missing/invalid, additional authentication is required, or MFA is missing. Obtain a suitable authenticated user token.
403	Caller is not a supported delegated partner user, tenant validation fails, or permission is denied.
404	Task is not visible to the authenticated partner/in an active feed, or the API is not enabled.
409	Concurrent change or source synchronization could not be confirmed. Refresh the task before retrying.
415	PUT request is missing the required JSON content type.
503	Compliance data, authorization, pagination storage, or a required dependency is temporarily unavailable. For writes, inspect the response and refresh before retrying.

Example task-not-found body:

{
  "code": 600026,
  "description": "Compliance task not found.",
  "source": "PCFraudEvents"
}

Ordinary compliance faults use the error resource. Authentication/MFA failures and front-door failures can use different bodies. Responses set Cache-Control: no-store, private and Vary: Authorization.

Troubleshooting

Check the request URL, API version, headers, and JSON formatting when a request fails. Use the HTTP status code and response body together to determine the next action. For general REST debugging guidance, see Test and debug.

Record the request time, operation, HTTP status, and request and correlation IDs so that a failed call can be traced. Protect access tokens when capturing logs or network traces.

For list requests, use the returned @odata.nextLink unchanged. Restart from the initial request if a continuation expires. For status updates with an uncertain result, retrieve the task's current state before retrying.