SQL Audit Settings - Update SQL Audit Settings

Service:

Warehouse

API Version:

v1

Update settings associated with the warehouse.

Permissions

The caller must have audit item permission.

Required Delegated Scopes

Item.Audit.All

Microsoft Entra supported identities

This API supports the Microsoft identities listed in this section.

Identity	Support
User	Yes
Service principal and Managed identities	Yes

Interface

PATCH https://api.fabric.microsoft.com/v1/workspaces/{workspaceId}/warehouses/{itemId}/settings/sqlAudit

URI Parameters

Name	In	Required	Type	Description
itemId	path	True	string (uuid)	The item ID.
workspaceId	path	True	string (uuid)	The workspace ID.

Request Body

Name	Type	Description
predicateExpression	string maxLength: 3000	The predicate expression that determines whether an audit event is processed. Specify only the <predicate_expression> value; don't include the WHERE keyword. The expression uses the following syntax from CREATE SERVER AUDIT (Transact-SQL): <predicate_expression> ::= { [ NOT ] <predicate_factor> [ { AND | OR } [ NOT ] { <predicate_factor> } ] [ ,... n ] } <predicate_factor> ::= event_field_name { = | < > | != | > | >= | < | <= | LIKE } { number | 'string' } Event field names correspond to the audit record columns documented in sys.fn_get_audit_file (Transact-SQL). All documented fields can be used except file_name, audit_file_offset, and event_time. Although action_id and class_type are returned as strings, they can only be compared with numeric values in a predicate. String comparisons don't perform implicit type conversion. The maximum expression length is 3,000 characters. When SQL auditing is enabled for the first time, omitting this property applies no predicate. On subsequent updates, omitting this property leaves the existing predicate unchanged. Specify an empty string to remove the existing predicate.
retentionDays	integer	Retention days.
state	AuditSettingsState	Audit settings state type.

Responses

Name	Type	Description
200 OK	SqlAuditSettings	Request completed successfully.
429 Too Many Requests	ErrorResponse	The service rate limit was exceeded. The server returns a Retry-After header indicating, in seconds, how long the client must wait before sending additional requests. Headers Retry-After: integer
Other Status Codes	ErrorResponse	Common error codes: ItemNotFound - The requested item was not found.

Examples

Update SQL Audit Settings

Sample request

HTTP

PATCH https://api.fabric.microsoft.com/v1/workspaces/a97f3e88-9f0a-4183-b1d9-31e6eb00e778/warehouses/70bcc992-a346-4f21-afe5-8b9ed1596a2b/settings/sqlAudit

{
  "state": "Enabled",
  "retentionDays": 10,
  "predicateExpression": "NOT statement LIKE 'SELECT %'"
}

Sample response

Status code:

200

{
  "state": "Enabled",
  "retentionDays": 10,
  "auditActionsAndGroups": [
    "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP"
  ],
  "predicateExpression": "NOT statement LIKE 'SELECT %'"
}

Definitions

Name	Description
AuditSettingsState	Audit settings state. Additional AuditSettingsState may be added over time.
ErrorParameter	A structured parameter providing additional machine-readable context about an error.
ErrorRelatedResource	The error related resource details object.
ErrorResponse	The error response.
ErrorResponseDetails	The error response details.
SqlAuditSettings	The current state of audit settings for an item.
SqlAuditSettingsUpdate	Audit settings update request.

AuditSettingsState

Enumeration

Audit settings state. Additional AuditSettingsState may be added over time.

Value	Description
Enabled	Enable the SQL audit.
Disabled	Disable the SQL audit.

ErrorParameter

Object

A structured parameter providing additional machine-readable context about an error.

Name	Type	Description
message	string	A human-readable description of the parameter's meaning.
name	string	The parameter identifier.
value	string	The parameter value.

ErrorRelatedResource

Object

The error related resource details object.

Name	Type	Description
resourceId	string	The resource ID that's involved in the error.
resourceType	string	The type of the resource that's involved in the error.

ErrorResponse

Object

The error response.

Name	Type	Description
errorCode	string	A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
isRetriable	boolean	When true, the request can be retried. Use the Retry-After response header to determine the delay, if available.
message	string	A human readable representation of the error.
moreDetails	ErrorResponseDetails[]	List of additional error details.
parameters	ErrorParameter[]	Structured parameters providing additional machine-readable context about the error.
relatedResource	ErrorRelatedResource	The error related resource details.
requestId	string (uuid)	ID of the request associated with the error.

ErrorResponseDetails

Object

The error response details.

Name	Type	Description
errorCode	string	A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
message	string	A human readable representation of the error.
parameters	ErrorParameter[]	Structured parameters providing additional machine-readable context about the error.
relatedResource	ErrorRelatedResource	The error related resource details.

SqlAuditSettings

Object

The current state of audit settings for an item.

Name	Type	Description
auditActionsAndGroups	string[]	Audit actions and groups.
predicateExpression	string maxLength: 3000	The predicate expression that determines whether an audit event is processed. Specify only the <predicate_expression> value; don't include the WHERE keyword. The expression uses the following syntax from CREATE SERVER AUDIT (Transact-SQL): <predicate_expression> ::= { [ NOT ] <predicate_factor> [ { AND | OR } [ NOT ] { <predicate_factor> } ] [ ,... n ] } <predicate_factor> ::= event_field_name { = | < > | != | > | >= | < | <= | LIKE } { number | 'string' } Event field names correspond to the audit record columns documented in sys.fn_get_audit_file (Transact-SQL). All documented fields can be used except file_name, audit_file_offset, and event_time. Although action_id and class_type are returned as strings, they can only be compared with numeric values in a predicate. String comparisons don't perform implicit type conversion. The maximum expression length is 3,000 characters. An empty string means that no predicate is applied.
retentionDays	integer	Retention days. 0 indicates indefinite retention period.
state	AuditSettingsState	Audit settings state type.

SqlAuditSettingsUpdate

Object

Audit settings update request.

Name	Type	Default value	Description
predicateExpression	string maxLength: 3000		The predicate expression that determines whether an audit event is processed. Specify only the <predicate_expression> value; don't include the WHERE keyword. The expression uses the following syntax from CREATE SERVER AUDIT (Transact-SQL): <predicate_expression> ::= { [ NOT ] <predicate_factor> [ { AND | OR } [ NOT ] { <predicate_factor> } ] [ ,... n ] } <predicate_factor> ::= event_field_name { = | < > | != | > | >= | < | <= | LIKE } { number | 'string' } Event field names correspond to the audit record columns documented in sys.fn_get_audit_file (Transact-SQL). All documented fields can be used except file_name, audit_file_offset, and event_time. Although action_id and class_type are returned as strings, they can only be compared with numeric values in a predicate. String comparisons don't perform implicit type conversion. The maximum expression length is 3,000 characters. When SQL auditing is enabled for the first time, omitting this property applies no predicate. On subsequent updates, omitting this property leaves the existing predicate unchanged. Specify an empty string to remove the existing predicate.
retentionDays	integer	0	Retention days.
state	AuditSettingsState		Audit settings state type.