`client.authenticated_definitions`¶

Manage authenticated scan definitions and their history.

Property¶

client.authenticated_definitions

Methods¶

get_all(query: AuthenticatedDefinitionsQuery | None = None) -> AuthenticatedDefinitionsResults: list authenticated scan definitions.
get(id: str) -> AuthenticatedDefinitionsResults: fetch one authenticated scan definition by ID.
definition_history(ids: str | list[str], query: AuthenticatedScanHistoryQuery | None = None) -> AuthenticatedScanHistoryResults: fetch scan history by definition ID.
session_history(ids: str | list[str], query: AuthenticatedScanHistoryQuery | None = None) -> AuthenticatedScanHistoryResults: fetch scan history by session ID.
add(payload: AuthenticatedDefinitionsAlterPayload) -> AuthenticatedDefinitionsResults: create a scan definition.
update(payload: AuthenticatedDefinitionsAlterPayload) -> AuthenticatedDefinitionsResults: update a scan definition.
delete(ids: str | list[str]) -> AuthenticatedDefinitionsResults: delete one or more scan definitions.

Notes¶

The history endpoints use POST requests with explicit request bodies even though they read data.
Mutating methods still return lazy results wrappers rather than booleans.
AuthenticatedScanHistoryQuery disables the inherited page_size default so it does not leak into POST bodies.

API¶

Microsoft Defender for Endpoint authenticated-scan endpoint models and client surface.

This module defines: - DeviceAuthenticatedAgentsQuery and AuthenticatedDefinitionsQuery request models. - AuthenticatedScanHistoryQuery for history pagination. - Payload models for creating, updating, and deleting scan definitions (AuthenticatedDefinitionsAlterPayload, ScannerAgentRefPayload, etc.). - *Results wrappers mapped to Arrow schemas for scan agents, definitions, and history records. - DeviceAuthenticatedAgentsEndpoint and AuthenticatedDefinitionsEndpoint with methods for retrieving agents, listing/creating/updating/deleting scan definitions, and querying scan history by definition or session ID.

Endpoint methods return lazy BaseResults subclasses and defer HTTP requests until a terminal materialization method is called.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-authenticated-scan-agent

AuthenticatedDefinitionsQuery ¶

Query parameters for the /api/DeviceAuthenticatedScanDefinitions endpoint. Endpoint doesn't have any documented query parameters, but this class is left here for consistency and future-proofing.

AuthenticatedScanHistoryQuery ¶

OData query parameters for authenticated scan history actions.

The history endpoints are POST-shaped, so the inherited page_size pagination hint must not leak into the request body. extra="forbid" enforces that and page_size is forced to None by default.

AuthenticatedDefinitionsAlterPayload ¶

Query parameters for Add, update, or delete a scan definition on the /api/DeviceAuthenticatedScanDefinitions endpoint.

page_size(None): Forced to None in the endpoint

ScannerAgentRefPayload ¶

Reference to a scanner agent device.

ScanHistoryByDefinitionRequestPayload ¶

Request body for scan history by definition.

ScanHistoryBySessionRequestPayload ¶

Request body for scan history by session.

AuthenticatedDefinitionsResults ¶

AuthenticatedDefinitionsResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results wrapper for authenticated scan definitions queries.

AuthenticatedScanHistoryResults ¶

AuthenticatedScanHistoryResults(
    endpoint: BaseEndpoint,
    params: dict[str, str],
    *,
    path: str | None = None,
    single: bool = False,
    files: bool = False,
    method: str = "GET",
    request_kwargs: dict[str, Any] | None = None,
    use_concurrent_skip_pagination: bool | None = None,
    skip_page_size: int | None = None,
    skip_max_concurrent: int | None = None,
)

Results wrapper for authenticated scan history queries.

AuthenticatedDefinitionsEndpoint ¶

AuthenticatedDefinitionsEndpoint(
    http: Client, auth: MSALAuth
)

Endpoint for managing authenticated scan definitions.

Methods:

Name	Description
`- get_all`	Get all authenticated scan definitions.
`- definition_history`	Get scan history by definition IDs.
`- session_history`	Get scan history by session IDs.
`- add`	Add a new authenticated scan definition.
`- update`	Update an existing authenticated scan definition.
`- delete`	Delete existing authenticated scan definition.

get_all ¶

get_all(
    query: AuthenticatedDefinitionsQuery | None = None,
) -> AuthenticatedDefinitionsResults

Get all authenticated scan definitions.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-scan-definitions

get ¶

get(id: str) -> AuthenticatedDefinitionsResults

Get a single authenticated scan definition by ID.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-scan-definition-by-id

definition_history ¶

definition_history(
    ids: str | list[str],
    query: AuthenticatedScanHistoryQuery | None = None,
) -> AuthenticatedScanHistoryResults

Get scan history by definition IDs.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-scan-history-by-definition

session_history ¶

session_history(
    ids: str | list[str],
    query: AuthenticatedScanHistoryQuery | None = None,
) -> AuthenticatedScanHistoryResults

Get scan history by session IDs.

Docs: https://learn.microsoft.com/en-us/defender-endpoint/api/get-scan-history-by-session

add ¶

add(
    payload: AuthenticatedDefinitionsAlterPayload,
) -> AuthenticatedDefinitionsResults

Add a new authenticated scan definition.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/add-a-new-scan-definition - https://learn.microsoft.com/en-us/defender-endpoint/api/add-a-new-scan-definition#example-request-to-add-a-new-scan

update ¶

update(
    payload: AuthenticatedDefinitionsAlterPayload,
) -> AuthenticatedDefinitionsResults

Update an existing authenticated scan definition.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/add-a-new-scan-definition - https://learn.microsoft.com/en-us/defender-endpoint/api/add-a-new-scan-definition#example-request-to-update-a-scan

delete ¶

delete(
    ids: str | list[str],
) -> AuthenticatedDefinitionsResults

Delete existing authenticated scan definition.

Docs: - https://learn.microsoft.com/en-us/defender-endpoint/api/add-a-new-scan-definition - https://learn.microsoft.com/en-us/defender-endpoint/api/add-a-new-scan-definition#example-request-to-delete-scans

client.authenticated_definitions¶