Partner Center Security Compliance API

Appropriate roles: Security Administrator | Security Reader | Admin Agent

Applies to: Partner Center

The Partner Center security compliance API lets you retrieve your partner organization's compliance tasks, review response-time assessments, and update task statuses. It supports automation for the unified Task model used in the redesigned Security workspace, where security requirements and alerts are presented as actionable Tasks.

This article describes the task model, supported operations, JSON resources, and REST request and response examples. API property names and values retain their exact casing, even when the workspace uses different display labels.

Concepts in the redesigned experience

The following concepts connect the Security workspace experience to the API resources in this article.

Task lifecycle and states

The workspace calls the lifecycle value a state; the API exposes it as status. Use the following exact, case-sensitive strings in API requests and responses.

To work with a Task programmatically:

1. List compliance tasks and select the Task that needs attention.
2. Get the Task details to review its current status, feed-specific information, notes, and recent activity.
3. Set the status to In Progress when work begins.
4. Remediate the condition in the appropriate source system, such as Microsoft Entra, the Azure portal, or Partner Center.
5. Set the status to Ready for Review when the work is finished, then retrieve the Task again after source verification to check its status and data freshness.

API scope during the transition

The redesigned workspace and the API don't necessarily expose the same actions. Use the operations and schemas in this article as the contract for this API, rather than assuming that every workspace action has an API equivalent.

During the workspace transition, distinguish these Partner Center endpoints from the current Microsoft Graph beta APIs for security alerts, requirements, and security score. This article doesn't define a retirement date, a one-to-one mapping from existing alert IDs to Task IDs, or a replacement for every existing operation. Obtain opaque Task IDs from this API; don't construct them from existing alert or subscription identifiers.

Resource conventions

The following resources describe the JSON data returned or accepted by the operations in this article. As in other Partner Center REST resources, property tables define the request and response elements.

JSON property names and status values are case-sensitive. Timestamps are UTC ISO 8601 strings, for example 2026-10-01T12:00:00.000Z. Nullable fields can contain null; do not assume every task has customer, subscription, deadline, or resolution information.

Compliance task

Describes a compliance task, including its current status, severity, deadline, and associated customer or subscription. Both the list and detail operations return these properties.

Compliance task details

Describes a single compliance task with feed-specific details, notes, and recent activity. Includes all compliance task properties plus the following properties.

Compliance task activity

Describes a recorded change to a compliance task. Optional values can be null.

Compliance task collection

Describes a page of compliance tasks.

The collection has no total-count property. For continuation behavior and expiration, see Pagination.

Response-time assessment

Describes your partner organization's average time to the first status change for compliance tasks. This is a partner-wide assessment, not an individual task's elapsed time, time to final resolution, or HTTP API latency.

For measurement rules and evidence limitations, see Get the response-time assessment.

Task status update request

Describes the request body for updating a compliance task's workflow status.

Supply only status. For permitted transitions and restrictions, see Update a compliance task's status.

Task status update result

Describes a confirmed status update.

Error

Describes an ordinary compliance API fault. Authentication/MFA failures and front-door failures can use different bodies; do not assume every error matches this shape.

For HTTP status codes and a sample error body, see Response success and error codes.

Operations

Use the following REST operations with these resources.

Prerequisites

• Configure a Microsoft Entra application for Partner Center API access. For setup guidance, see Set up API access in Partner Center.
• Obtain an access token using App+User authentication as described in Partner Center authentication. App-only authentication is not supported by these operations.
• The delegated user must satisfy MFA and have permission to view compliance/security information. Updating status requires management permission; read-only permission is insufficient.
• The API must be enabled for the partner organization. Requests operate on the authenticated partner's tenant, not a tenant selected through a request parameter or header.

For MFA integration guidance, see Enable secure application model.

REST request conventions

The production base URL is https://api.partnercenter.microsoft.com. The examples below use this URL. Examples don't establish availability for a particular partner organization; the API must be enabled for that organization.

Request headers

The following headers apply to these operations. For general header definitions, see Partner Center REST headers. Not every Partner Center header applies to every operation.

List compliance tasks

Retrieve a paginated list of compliance tasks for your partner organization, including each task's status, severity, deadline, and available customer or subscription information. Use filters to narrow the results by status, task group, requirement, customer tenant, or subscription. Use the returned task IDs to retrieve details or update a task's status.

REST request

Query parameters

Supported filter fields: status, taskGroupId, requirementId, customerTenantId, and subscriptionId. Use eq with single-quoted string values and and between predicates. A parenthesized or group is supported for status values only, for example:

requirementId eq 'UsageAnomalyDetection' and (status eq 'New' or status eq 'In Progress')

Supported status filter values are New, In Progress, Ready for Review, Complete, and Ignore. Escape a literal apostrophe inside a value as two apostrophes, and URL-encode query values. This endpoint supports a limited OData-style syntax, not general OData: $orderby, $skip, $select, and repeated query parameters are not supported.

Request body

None.

Request example

GET https://api.partnercenter.microsoft.com/v1/compliance/tasks?$top=1&$filter=requirementId%20eq%20%27UsageAnomalyDetection%27%20and%20status%20eq%20%27New%27 HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
MS-CorrelationId: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
MS-RequestId: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb

REST response

If successful, this method returns 200 OK and a compliance task collection in the response body. An empty result is {"value":[]}; there is no total-count property.

Response example

{
  "value": [
    {
      "taskId": "usage-anomaly-detection::11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
      "taskGroupId": "usage-anomaly-detection",
      "taskGroupTitle": "Usage Anomaly Detection",
      "taskGroupClassification": "Fraud",
      "isEligibilityRequirement": false,
      "requirementId": "UsageAnomalyDetection",
      "taskTitle": "Action Required: Subscription Usage Anomaly Detected",
      "status": "New",
      "isIgnorable": true,
      "customerTenantId": null,
      "customerName": "Contoso Customer",
      "subscriptionId": "11111111-1111-4111-8111-111111111111",
      "subscriptionName": null,
      "severity": "High",
      "deadlineDateTime": "2026-10-15T12:00:00.000Z",
      "createdDate": "2026-09-15T12:00:00.000Z",
      "lastModifiedDate": "2026-09-15T12:00:00.000Z",
      "lastRefreshDateTime": "2026-10-01T11:00:00.000Z",
      "resolvedDate": null,
      "version": "\"33333333-3333-4333-8333-333333333333\""
    }
  ],
  "@odata.nextLink": "https://api.partnercenter.microsoft.com/v1/compliance/tasks?$top=1&$filter=requirementId%20eq%20%27UsageAnomalyDetection%27%20and%20status%20eq%20%27New%27&$skiptoken=55555555-5555-4555-8555-555555555555"
}

Pagination

Follow @odata.nextLink with the same authentication until the property is absent. Do not change the page size or filter during a traversal. Continuations expire one hour after the first page; fetching another page does not extend that expiration. An invalid, expired, or incompatible token returns 400; restart from the initial list request. Changes to the active feed configuration can invalidate a continuation. Paging a changing list is not a point-in-time snapshot.

Get a compliance task

Retrieve a single compliance task using a task ID returned by the list endpoint. The response includes the task's summary properties plus feed-specific details, existing notes, and recent activity history. Use this operation to investigate a task or refresh its current state before deciding on a status update.

REST request

URI parameters

Request body

None. No query parameters are supported.

Request example

GET https://api.partnercenter.microsoft.com/v1/compliance/tasks/usage-anomaly-detection%3A%3A11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222 HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
MS-CorrelationId: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
MS-RequestId: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb

REST response

If successful, this method returns 200 OK and compliance task details in the response body. The ETag response header matches version.

Response example

{
  "details": {
    "alertId": "11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
    "alertDisplayName": "Action Required: Subscription Usage Anomaly Detected",
    "severity": "High",
    "subscriptionId": "11111111-1111-4111-8111-111111111111",
    "customerName": "Contoso Customer",
    "detectedTime": "2026-09-15T12:00:00.000Z",
    "description": "Unusual subscription usage was detected. Review the affected subscription."
  },
  "notes": null,
  "activityLog": [
    {
      "date": "2026-09-15T12:00:00.000Z",
      "action": "FeedCreated",
      "oldStatus": null,
      "newStatus": "New",
      "changeReason": null,
      "notes": null
    }
  ],
  "activityLogTruncated": false,
  "taskId": "usage-anomaly-detection::11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
  "taskGroupId": "usage-anomaly-detection",
  "taskGroupTitle": "Usage Anomaly Detection",
  "taskGroupClassification": "Fraud",
  "isEligibilityRequirement": false,
  "requirementId": "UsageAnomalyDetection",
  "taskTitle": "Action Required: Subscription Usage Anomaly Detected",
  "status": "New",
  "isIgnorable": true,
  "customerTenantId": null,
  "customerName": "Contoso Customer",
  "subscriptionId": "11111111-1111-4111-8111-111111111111",
  "subscriptionName": null,
  "severity": "High",
  "deadlineDateTime": "2026-10-15T12:00:00.000Z",
  "createdDate": "2026-09-15T12:00:00.000Z",
  "lastModifiedDate": "2026-09-15T12:00:00.000Z",
  "lastRefreshDateTime": "2026-10-01T11:00:00.000Z",
  "resolvedDate": null,
  "version": "\"33333333-3333-4333-8333-333333333333\""
}

Get the response-time assessment

Retrieve your partner organization's assessment of how quickly compliance tasks receive their first status change, measured against the current 24-hour threshold. The assessment covers tasks opened during the preceding 30 days and includes elapsed time for measurable tasks that have not yet changed status. It returns the average duration, sample count, assessment result, and evidence availability; it does not measure final resolution time or API latency.

REST request

No query parameters are supported.

Request body

None.

Request example

GET https://api.partnercenter.microsoft.com/v1/compliance/responseTime HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
MS-CorrelationId: aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
MS-RequestId: bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb

REST response

If successful, this method returns 200 OK and a response-time assessment in the response body.

Response example

{
  "completion": "notComplete",
  "thresholdSeconds": 86400,
  "averageDurationSeconds": 108000,
  "sampleCount": 10,
  "availability": "available",
  "reason": null,
  "definitionVersion": 1,
  "activeFeedSetVersion": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "windowStart": "2026-09-01T12:00:00.000Z",
  "windowEnd": "2026-10-01T12:00:00.000Z",
  "calculatedAt": "2026-10-01T12:00:00.000Z",
  "expiresAt": "2026-10-01T12:10:00.000Z"
}

Assessment rules

The current definition considers tasks opened during the preceding 30 days in active feeds, excluding tasks initially Complete. It measures time from the recorded opening event to the first recorded status change; a measurable task with no change contributes elapsed time up to calculation time. Missing or truncated history can reduce availability. The average is therefore not limited to tasks already acted upon and is not time to final resolution.

With measurable evidence, an average at or below 86,400 seconds evaluates to complete; above that evaluates to notComplete. A partial feed registry evaluates to unknown. With no history, the current implementation can return completion: "complete" with availability: "unavailable" and a null average; do not interpret this as a measured zero-second response time. Successful assessment objects can represent partial/unavailable evidence; dependency failures can instead return 503.

Update a compliance task's status

Update a task's workflow status to In Progress, Ready for Review, or Ignore, subject to the task's current status and whether its feed permits Ignore. This operation requires management permission and returns the confirmed status, modification time, and version. Changing the status records your workflow progress; it does not remediate the underlying issue or allow you to mark the task Complete.

REST request

URI parameters

No query parameters are supported.

Request body

Use a task status update request containing the required status property.

Supply only status. Additional/duplicate properties, a missing or nonstring status, and malformed JSON return 400.

• New and Complete cannot be set by this operation; Complete is system-managed.
• A Complete task cannot be changed by this operation.
• Ignore is permitted only when the feed allows it (isIgnorable).
• An ignored task can remain Ignore or be reopened to In Progress, but cannot move directly to Ready for Review.
• The server checks concurrency internally. A client If-Match header is not required by this endpoint; the returned version is not a documented client precondition.

Request example

PUT https://api.partnercenter.microsoft.com/v1/compliance/tasks/usage-anomaly-detection%3A%3A11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222/status HTTP/1.1
Authorization: Bearer <token>
Accept: application/json
Content-Type: application/json
MS-CorrelationId: cccccccc-cccc-4ccc-8ccc-cccccccccccc
MS-RequestId: dddddddd-dddd-4ddd-8ddd-dddddddddddd

{
  "status": "In Progress"
}

REST response

If successful, this method returns 200 OK and a task status update result in the response body. The ETag response header matches the returned version.

Response example

{
  "taskId": "usage-anomaly-detection::11111111-1111-4111-8111-111111111111-22222222-2222-4222-8222-222222222222",
  "status": "In Progress",
  "lastModifiedDate": "2026-10-01T12:05:00.000Z",
  "version": "\"44444444-4444-4444-8444-444444444444\""
}

Response success and error codes

See Partner Center REST error codes for general guidance. The following cases are specific to these operations:

Example task-not-found body:

{
  "code": 600026,
  "description": "Compliance task not found.",
  "source": "PCFraudEvents"
}

Ordinary compliance faults use the error resource. Authentication/MFA failures and front-door failures can use different bodies. Responses set Cache-Control: no-store, private and Vary: Authorization.

Troubleshooting

Check the request URL, API version, headers, and JSON formatting when a request fails. Use the HTTP status code and response body together to determine the next action. For general REST debugging guidance, see Test and debug.

Record the request time, operation, HTTP status, and request and correlation IDs so that a failed call can be traced. Protect access tokens when capturing logs or network traces.

For list requests, use the returned @odata.nextLink unchanged. Restart from the initial request if a continuation expires. For status updates with an uncertain result, retrieve the task's current state before retrying.