Microsoft Graph Search — security.casesRoot

naftiko: 1.0.0-alpha2
info:
  label: Microsoft Graph Search — security.casesRoot
  description: 'Microsoft Graph Search — security.casesRoot. 24 operations. Lead operation: Microsoft Graph List searches.
    Self-contained Naftiko capability covering one Microsoft Graph business surface.'
  tags:
  - Microsoft Graph
  - security.casesRoot
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    MICROSOFT_GRAPH_API_KEY: MICROSOFT_GRAPH_API_KEY
capability:
  consumes:
  - type: http
    namespace: search-security-casesroot
    baseUri: ''
    description: Microsoft Graph Search — security.casesRoot business capability. Self-contained, no shared references.
    resources:
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches
      operations:
      - name: securitycasesediscoverycaseslistsearches
        method: GET
        description: Microsoft Graph List searches
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitycasesediscoverycasescreatesearches
        method: POST
        description: Microsoft Graph Create searches
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-$count
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/$count
      operations:
      - name: securitycasesediscoverycasessearchesgetcount87f1
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}
      operations:
      - name: securitycasesediscoverycasesgetsearches
        method: GET
        description: Microsoft Graph Get ediscoverySearch
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitycasesediscoverycasesupdatesearches
        method: PATCH
        description: Microsoft Graph Update ediscoverySearch
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitycasesediscoverycasesdeletesearches
        method: DELETE
        description: Microsoft Graph Delete ediscoverySearch
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/addToReviewSetOperation
      operations:
      - name: securitycasesediscoverycasessearchesgetaddtoreviewsetoperation
        method: GET
        description: Microsoft Graph Get addToReviewSetOperation from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/additionalSources
      operations:
      - name: securitycasesediscoverycasessearcheslistadditionalsources
        method: GET
        description: Microsoft Graph List additionalSources
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitycasesediscoverycasessearchescreateadditionalsources
        method: POST
        description: Microsoft Graph Add additional sources
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/additionalSources/$count
      operations:
      - name: securitycasesediscoverycasessearchesadditionalsourcesgetcountf0d1
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/additionalSources/{dataSource-id}
      operations:
      - name: securitycasesediscoverycasessearchesgetadditionalsources
        method: GET
        description: Microsoft Graph Get additionalSources from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
      - name: securitycasesediscoverycasessearchesupdateadditionalsources
        method: PATCH
        description: Microsoft Graph Update the navigation property additionalSources in security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
      - name: securitycasesediscoverycasessearchesdeleteadditionalsources
        method: DELETE
        description: Microsoft Graph Delete navigation property additionalSources for security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: If-Match
          in: header
          type: string
          description: ETag
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-cu
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/custodianSources
      operations:
      - name: securitycasesediscoverycasessearcheslistcustodiansources
        method: GET
        description: Microsoft Graph List custodianSources
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-cu
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/custodianSources/$count
      operations:
      - name: securitycasesediscoverycasessearchescustodiansourcesgetcountfb3f
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-cu
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/custodianSources/{dataSource-id}
      operations:
      - name: securitycasesediscoverycasessearchesgetcustodiansources
        method: GET
        description: Microsoft Graph Get custodianSources from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-la
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/lastEstimateStatisticsOperation
      operations:
      - name: securitycasesediscoverycasessearchesgetlastestimatestatisticsoperation
        method: GET
        description: Microsoft Graph List lastEstimateStatisticsOperation
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.estimateStatistics
      operations:
      - name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchestimatestatistics
        method: POST
        description: Microsoft Graph Invoke action estimateStatistics
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.exportReport
      operations:
      - name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchexportreport
        method: POST
        description: Microsoft Graph Invoke action exportReport
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.exportResult
      operations:
      - name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchexportresult
        method: POST
        description: Microsoft Graph Invoke action exportResult
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.purgeData
      operations:
      - name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchpurgedata
        method: POST
        description: Microsoft Graph Invoke action purgeData
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: true
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-no
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/noncustodialSources
      operations:
      - name: securitycasesediscoverycasessearcheslistnoncustodialsources
        method: GET
        description: Microsoft Graph Get noncustodialSources from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $orderby
          in: query
          type: array
          description: Order items by property values
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-no
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/noncustodialSources/$count
      operations:
      - name: securitycasesediscoverycasessearchesnoncustodialsourcesgetcount14fa
        method: GET
        description: Microsoft Graph Get the number of the resource
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-no
      path: /security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/noncustodialSources/{ediscoveryNoncustodialDataSource-id}
      operations:
      - name: securitycasesediscoverycasessearchesgetnoncustodialsources
        method: GET
        description: Microsoft Graph Get noncustodialSources from security
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: $select
          in: query
          type: array
          description: Select properties to be returned
        - name: $expand
          in: query
          type: array
          description: Expand related entities
  exposes:
  - type: rest
    namespace: search-security-casesroot-rest
    port: 8080
    description: REST adapter for Microsoft Graph Search — security.casesRoot. One Spectral-compliant resource per consumed
      operation, prefixed with /v1.
    resources:
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches
      name: security-cases-ediscoverycases-ediscoverycase-id-searches
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches.
      operations:
      - method: GET
        name: securitycasesediscoverycaseslistsearches
        description: Microsoft Graph List searches
        call: search-security-casesroot.securitycasesediscoverycaseslistsearches
        with:
          $orderby: rest.$orderby
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: securitycasesediscoverycasescreatesearches
        description: Microsoft Graph Create searches
        call: search-security-casesroot.securitycasesediscoverycasescreatesearches
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/count
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-count
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-$count.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesgetcount87f1
        description: Microsoft Graph Get the number of the resource
        call: search-security-casesroot.securitycasesediscoverycasessearchesgetcount87f1
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id.
      operations:
      - method: GET
        name: securitycasesediscoverycasesgetsearches
        description: Microsoft Graph Get ediscoverySearch
        call: search-security-casesroot.securitycasesediscoverycasesgetsearches
        with:
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: securitycasesediscoverycasesupdatesearches
        description: Microsoft Graph Update ediscoverySearch
        call: search-security-casesroot.securitycasesediscoverycasesupdatesearches
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
      - method: DELETE
        name: securitycasesediscoverycasesdeletesearches
        description: Microsoft Graph Delete ediscoverySearch
        call: search-security-casesroot.securitycasesediscoverycasesdeletesearches
        with:
          If-Match: rest.If-Match
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/addtoreviewsetoperation
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-ad
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesgetaddtoreviewsetoperation
        description: Microsoft Graph Get addToReviewSetOperation from security
        call: search-security-casesroot.securitycasesediscoverycasessearchesgetaddtoreviewsetoperation
        with:
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/additionalsources
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-ad
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearcheslistadditionalsources
        description: Microsoft Graph List additionalSources
        call: search-security-casesroot.securitycasesediscoverycasessearcheslistadditionalsources
        with:
          $orderby: rest.$orderby
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: securitycasesediscoverycasessearchescreateadditionalsources
        description: Microsoft Graph Add additional sources
        call: search-security-casesroot.securitycasesediscoverycasessearchescreateadditionalsources
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/additionalsources/count
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-ad
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesadditionalsourcesgetcountf0d1
        description: Microsoft Graph Get the number of the resource
        call: search-security-casesroot.securitycasesediscoverycasessearchesadditionalsourcesgetcountf0d1
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/additionalsources/{datasource-id}
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-ad
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-ad.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesgetadditionalsources
        description: Microsoft Graph Get additionalSources from security
        call: search-security-casesroot.securitycasesediscoverycasessearchesgetadditionalsources
        with:
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
      - method: PATCH
        name: securitycasesediscoverycasessearchesupdateadditionalsources
        description: Microsoft Graph Update the navigation property additionalSources in security
        call: search-security-casesroot.securitycasesediscoverycasessearchesupdateadditionalsources
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
      - method: DELETE
        name: securitycasesediscoverycasessearchesdeleteadditionalsources
        description: Microsoft Graph Delete navigation property additionalSources for security
        call: search-security-casesroot.securitycasesediscoverycasessearchesdeleteadditionalsources
        with:
          If-Match: rest.If-Match
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/custodiansources
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-cu
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-cu.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearcheslistcustodiansources
        description: Microsoft Graph List custodianSources
        call: search-security-casesroot.securitycasesediscoverycasessearcheslistcustodiansources
        with:
          $orderby: rest.$orderby
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/custodiansources/count
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-cu
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-cu.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchescustodiansourcesgetcountfb3f
        description: Microsoft Graph Get the number of the resource
        call: search-security-casesroot.securitycasesediscoverycasessearchescustodiansourcesgetcountfb3f
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/custodiansources/{datasource-id}
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-cu
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-cu.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesgetcustodiansources
        description: Microsoft Graph Get custodianSources from security
        call: search-security-casesroot.securitycasesediscoverycasessearchesgetcustodiansources
        with:
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/lastestimatestatisticsoperation
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-la
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-la.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesgetlastestimatestatisticsoperation
        description: Microsoft Graph List lastEstimateStatisticsOperation
        call: search-security-casesroot.securitycasesediscoverycasessearchesgetlastestimatestatisticsoperation
        with:
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/microsoft-graph-security-estimatestatistics
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-mi
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi.
      operations:
      - method: POST
        name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchestimatestatistics
        description: Microsoft Graph Invoke action estimateStatistics
        call: search-security-casesroot.securitycasesediscoverycasesediscoverycasesearchesediscoverysearchestimatestatistics
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/microsoft-graph-security-exportreport
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-mi
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi.
      operations:
      - method: POST
        name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchexportreport
        description: Microsoft Graph Invoke action exportReport
        call: search-security-casesroot.securitycasesediscoverycasesediscoverycasesearchesediscoverysearchexportreport
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/microsoft-graph-security-exportresult
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-mi
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi.
      operations:
      - method: POST
        name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchexportresult
        description: Microsoft Graph Invoke action exportResult
        call: search-security-casesroot.securitycasesediscoverycasesediscoverycasesearchesediscoverysearchexportresult
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/microsoft-graph-security-purgedata
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-mi
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-mi.
      operations:
      - method: POST
        name: securitycasesediscoverycasesediscoverycasesearchesediscoverysearchpurgedata
        description: Microsoft Graph Invoke action purgeData
        call: search-security-casesroot.securitycasesediscoverycasesediscoverycasesearchesediscoverysearchpurgedata
        with:
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/noncustodialsources
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-no
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-no.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearcheslistnoncustodialsources
        description: Microsoft Graph Get noncustodialSources from security
        call: search-security-casesroot.securitycasesediscoverycasessearcheslistnoncustodialsources
        with:
          $orderby: rest.$orderby
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/noncustodialsources/count
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-no
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-no.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesnoncustodialsourcesgetcount14fa
        description: Microsoft Graph Get the number of the resource
        call: search-security-casesroot.securitycasesediscoverycasessearchesnoncustodialsourcesgetcount14fa
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/security/cases/ediscoverycases/{ediscoverycase-id}/searches/{ediscoverysearch-id}/noncustodialsources/{ediscoverynoncustodialdatasource-id}
      name: security-cases-ediscoverycases-ediscoverycase-id-searches-ediscoverysearch-id-no
      description: REST surface for security-cases-ediscoveryCases-ediscoveryCase-id-searches-ediscoverySearch-id-no.
      operations:
      - method: GET
        name: securitycasesediscoverycasessearchesgetnoncustodialsources
        description: Microsoft Graph Get noncustodialSources from security
        call: search-security-casesroot.securitycasesediscoverycasessearchesgetnoncustodialsources
        with:
          $select: rest.$select
          $expand: rest.$expand
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: search-security-casesroot-mcp
    port: 9090
    transport: http
    description: MCP adapter for Microsoft Graph Search — security.casesRoot. One tool per consumed operation, routed inline
      through this capability's consumes block.
    tools:
    - name: microsoft-graph-list-searches
      description: Microsoft Graph List searches
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: search-security-casesroot.securitycasesediscoverycaseslistsearches
      with:
        $orderby: tools.$orderby
        $select: tools.$select
        $expand: tools.$expand
      outputParameters:
      - type: object
        mapping: $.
    - name: microsoft-graph-create-searches
      description: Microsoft Graph Create searches
      hints:
        readOnly: true
        destructive: false
        idempotent: false
      call: sear

# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-graph/refs/heads/main/capabilities/search-security-casesroot.yaml