{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-entra/json-schema/microsoft-entra-service-principal-collection-response-schema.json",
  "title": "ServicePrincipalCollectionResponse",
  "description": "Paged collection of service principal objects",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-entra-service-principals-api-openapi.yml#/components/schemas/ServicePrincipalCollectionResponse",
  "type": "object",
  "properties": {
    "@odata.context": {
      "type": "string"
    },
    "@odata.count": {
      "type": "integer"
    },
    "@odata.nextLink": {
      "type": "string",
      "format": "uri"
    },
    "value": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/ServicePrincipal"
      }
    }
  },
  "$defs": {
    "AppRole": {
      "type": "object",
      "description": "Represents a role defined by an application that can be assigned to users, groups, or service principals",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid",
          "description": "Unique identifier for the app role"
        },
        "allowedMemberTypes": {
          "type": "array",
          "description": "Specifies whether the role can be assigned to users/groups, applications, or both",
          "items": {
            "type": "string",
            "enum": [
              "User",
              "Application"
            ]
          }
        },
        "displayName": {
          "type": "string",
          "description": "Display name for the app role"
        },
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "Description of the app role"
        },
        "value": {
          "type": [
            "string",
            "null"
          ],
          "description": "Value that is included in the roles claim in authentication tokens"
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Whether the app role is enabled"
        }
      }
    },
    "KeyCredential": {
      "type": "object",
      "description": "Contains a key credential (certificate) associated with an application or service principal",
      "properties": {
        "keyId": {
          "type": "string",
          "format": "uuid",
          "description": "Unique identifier for the key"
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Friendly name for the key"
        },
        "type": {
          "type": "string",
          "description": "Type of key credential",
          "enum": [
            "AsymmetricX509Cert",
            "X509CertAndPassword"
          ]
        },
        "usage": {
          "type": "string",
          "description": "Describes the purpose of the key",
          "enum": [
            "Sign",
            "Verify"
          ]
        },
        "key": {
          "type": "string",
          "format": "byte",
          "description": "The certificate's raw data in byte array converted to Base64 string"
        },
        "startDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the credential becomes valid"
        },
        "endDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the credential expires"
        }
      }
    },
    "PasswordCredential": {
      "type": "object",
      "description": "Represents a password credential (client secret) associated with an application or service principal",
      "properties": {
        "keyId": {
          "type": "string",
          "format": "uuid",
          "readOnly": true,
          "description": "Unique identifier for the password"
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Friendly name for the password credential"
        },
        "hint": {
          "type": "string",
          "readOnly": true,
          "description": "Contains the first three characters of the password (returned on read operations)"
        },
        "secretText": {
          "type": "string",
          "readOnly": true,
          "description": "The generated password value. Only returned at creation time and cannot be retrieved later."
        },
        "startDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the password becomes valid"
        },
        "endDateTime": {
          "type": "string",
          "format": "date-time",
          "description": "The date and time at which the password expires. Maximum lifetime varies by policy."
        }
      }
    },
    "PermissionScope": {
      "type": "object",
      "description": "Defines an OAuth 2.0 delegated permission scope exposed by a web API application",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid",
          "description": "Unique identifier for the scope"
        },
        "value": {
          "type": "string",
          "description": "The value that identifies the scope in OAuth 2.0 authorization requests"
        },
        "type": {
          "type": "string",
          "description": "Whether the scope can be consented to by a user or requires admin consent",
          "enum": [
            "User",
            "Admin"
          ]
        },
        "adminConsentDisplayName": {
          "type": "string",
          "description": "Display name shown on the admin consent experience"
        },
        "adminConsentDescription": {
          "type": "string",
          "description": "Description shown on the admin consent experience"
        },
        "userConsentDisplayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "Display name shown on the user consent experience"
        },
        "userConsentDescription": {
          "type": [
            "string",
            "null"
          ],
          "description": "Description shown on the user consent experience"
        },
        "isEnabled": {
          "type": "boolean",
          "description": "Whether the scope is enabled and can be requested"
        }
      }
    },
    "ServicePrincipal": {
      "type": "object",
      "description": "Represents an instance of an application in a tenant. The service principal is the local representation used for sign-in and access to resources. It inherits certain properties from the application object.",
      "properties": {
        "id": {
          "type": "string",
          "readOnly": true,
          "description": "Unique identifier for the service principal (GUID)"
        },
        "appId": {
          "type": "string",
          "description": "The unique identifier for the associated application (application's appId). Required on create."
        },
        "displayName": {
          "type": "string",
          "description": "The display name for the service principal"
        },
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "Description of the service principal's function"
        },
        "servicePrincipalType": {
          "type": "string",
          "description": "Identifies whether the service principal represents an application, a managed identity, or a legacy app",
          "enum": [
            "Application",
            "ManagedIdentity",
            "Legacy",
            "SocialIdp"
          ]
        },
        "appDisplayName": {
          "type": "string",
          "readOnly": true,
          "description": "The display name exposed by the associated application"
        },
        "appOwnerOrganizationId": {
          "type": [
            "string",
            "null"
          ],
          "format": "uuid",
          "readOnly": true,
          "description": "Contains the tenant ID where the application is registered"
        },
        "accountEnabled": {
          "type": "boolean",
          "description": "true if the service principal account is enabled; false otherwise",
          "default": true
        },
        "homepage": {
          "type": [
            "string",
            "null"
          ],
          "description": "Home page or landing page of the application",
          "format": "uri"
        },
        "loginUrl": {
          "type": [
            "string",
            "null"
          ],
          "description": "URL where the service provider redirects the user to Microsoft Entra ID to authenticate (SAML sign-on)",
          "format": "uri"
        },
        "logoutUrl": {
          "type": [
            "string",
            "null"
          ],
          "description": "URL used by Microsoft's authorization service to sign out a user",
          "format": "uri"
        },
        "replyUrls": {
          "type": "array",
          "description": "URLs where user tokens are sent for sign-in or redirect URIs for authorization codes and access tokens",
          "items": {
            "type": "string"
          }
        },
        "servicePrincipalNames": {
          "type": "array",
          "description": "Contains the list of identifierUris copied from the associated application plus the appId",
          "items": {
            "type": "string"
          }
        },
        "tags": {
          "type": "array",
          "description": "Custom strings used to categorize and identify the service principal. Values include WindowsAzureActiveDirectoryIntegratedApp.",
          "items": {
            "type": "string"
          }
        },
        "appRoles": {
          "type": "array",
          "readOnly": true,
          "description": "The roles exposed by the application that this service principal represents",
          "items": {
            "$ref": "#/$defs/AppRole"
          }
        },
        "oauth2PermissionScopes": {
          "type": "array",
          "readOnly": true,
          "description": "The delegated permission scopes exposed by the application",
          "items": {
            "$ref": "#/$defs/PermissionScope"
          }
        },
        "appRoleAssignmentRequired": {
          "type": "boolean",
          "description": "If true, users and other service principals must first be granted an app role assignment before they can sign in or obtain tokens",
          "default": false
        },
        "keyCredentials": {
          "type": "array",
          "description": "Collection of certificate credentials",
          "items": {
            "$ref": "#/$defs/KeyCredential"
          }
        },
        "passwordCredentials": {
          "type": "array",
          "description": "Collection of password credentials",
          "items": {
            "$ref": "#/$defs/PasswordCredential"
          }
        },
        "createdDateTime": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "readOnly": true,
          "description": "Date and time the service principal was created"
        }
      }
    }
  }
}