Incidents - Run Playbook

Service:
Sentinel
API Version:
2025-09-01

Triggers playbook on a specific incident

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentIdentifier}/runPlaybook?api-version=2025-09-01

URI Parameters

Name In Required Type Description
incidentIdentifier
 path True

string

The incident identifier.
resourceGroupName
 path True

string

minLength: 1
maxLength: 90

The name of the resource group. The name is case insensitive.
subscriptionId
 path True

string (uuid)

The ID of the target subscription. The value must be an UUID.
workspaceName
 path True

string

minLength: 1
maxLength: 90
pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

The name of the workspace.
api-version
 query True

string

minLength: 1

The API version to use for this operation.

Request Body

Name Required Type Description
logicAppsResourceId True

string (arm-id)

Related Analytic rule resource id
tenantId

string (uuid)

Universally Unique Identifier

Responses

Name Type Description
204 No Content

Azure operation completed successfully.
Other Status Codes

CloudError

An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Incidents_RunPlaybook

Sample request

POST https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ar4/runPlaybook?api-version=2025-09-01

Sample response

Status code:
204

Definitions

Name Description
CloudError

Error response structure.
CloudErrorBody

Error details.
ManualTriggerRequestBody

CloudError

Object

Error response structure.

Name Type Description
error

CloudErrorBody

Error data

CloudErrorBody

Object

Error details.

Name Type Description
code

string

An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message

string

A message describing the error, intended to be suitable for display in a user interface.

ManualTriggerRequestBody

Object
Name Type Description
logicAppsResourceId

string (arm-id)

Related Analytic rule resource id
tenantId

string (uuid)

Universally Unique Identifier