Namespace: microsoft.graph.security
Important
APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Start the process of adding a collection from Microsoft 365 services to a review set. After the operation is created, you can get the status of the operation by retrieving the Location parameter from the response headers. The location provides a URL that returns an Add to review set operation.
This API is available in the following national cloud deployments.
| Global service |
US Government L4 |
US Government L5 (DOD) |
China operated by 21Vianet |
| ✅ |
✅ |
✅ |
❌ |
Permissions
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
| Permission type |
Least privileged permissions |
Higher privileged permissions |
| Delegated (work or school account) |
eDiscovery.Read.All |
eDiscovery.ReadWrite.All |
| Delegated (personal Microsoft account) |
Not supported. |
Not supported. |
| Application |
eDiscovery.Read.All |
eDiscovery.ReadWrite.All |
HTTP request
POST /security/cases/ediscoveryCases/{eDiscoveryCaseId}/reviewSets/{eDiscoveryReviewSetId}/addToReviewSet
Request body
In the request body, supply a JSON representation of the parameters.
The following table shows the parameters that can be used with this action.
| Parameter |
Type |
Description |
| additionalDataOptions |
microsoft.graph.security.additionalDataOptions |
The options to add items to the review set. The possible values are: allVersions, linkedFiles, unknownFutureValue, advancedIndexing, listAttachments, htmlTranscripts, messageConversationExpansion, locationsWithoutHits, allItemsInFolder. Use the Prefer: include-unknown-enum-members request header to get the following values from this evolvable enum: advancedIndexing, listAttachments, htmlTranscripts, messageConversationExpansion, locationsWithoutHits, allItemsInFolder. The locationsWithoutHits and advancedIndexing values are only considered if itemsToIncude is set to partiallyIndexed. |
| cloudAttachmentVersion |
microsoft.graph.security.cloudAttachmentVersion |
Specifies the number of cloud attachment versions to collect. The possible values are: latest, recent10, recent100, all, unknownFutureValue. The default value is latest. |
| documentVersion |
microsoft.graph.security.documentVersion |
Specifies the number of document versions to collect. The possible values are: latest, recent10, recent100, all, unknownFutureValue. The default value is latest. |
| itemsToInclude |
microsoft.graph.security.itemsToInclude |
The items to include in the review set. The possible values are: searchHits, partiallyIndexed, unknownFutureValue. |
| search |
microsoft.graph.security.ediscoverySearch |
The ID of the eDiscovery search you'd like to add to the review set. |
Response
If successful, this action returns a 202 Accepted response code.
Examples
Example 1: Add search with linked files and the latest cloud attachment version
The following example shows how to add search to the review set and include the latest version of files shared as links.
Request
The following example shows a request.
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/addToReviewSet
Content-Type: application/json
{
"search": {
"id": "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
},
"additionalDataOptions": "linkedFiles",
"cloudAttachmentVersion": "latest"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Security.Cases.EdiscoveryCases.Item.ReviewSets.Item.MicrosoftGraphSecurityAddToReviewSet;
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new AddToReviewSetPostRequestBody
{
Search = new EdiscoverySearch
{
Id = "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7",
},
AdditionalDataOptions = AdditionalDataOptions.LinkedFiles,
CloudAttachmentVersion = CloudAttachmentVersion.Latest,
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
await graphClient.Security.Cases.EdiscoveryCases["{ediscoveryCase-id}"].ReviewSets["{ediscoveryReviewSet-id}"].MicrosoftGraphSecurityAddToReviewSet.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphsecurity.NewAddToReviewSetPostRequestBody()
search := graphmodelssecurity.NewEdiscoverySearch()
id := "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
search.SetId(&id)
requestBody.SetSearch(search)
additionalDataOptions := graphmodels.LINKEDFILES_ADDITIONALDATAOPTIONS
requestBody.SetAdditionalDataOptions(&additionalDataOptions)
cloudAttachmentVersion := graphmodels.LATEST_CLOUDATTACHMENTVERSION
requestBody.SetCloudAttachmentVersion(&cloudAttachmentVersion)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
graphClient.Security().Cases().EdiscoveryCases().ByEdiscoveryCaseId("ediscoveryCase-id").ReviewSets().ByEdiscoveryReviewSetId("ediscoveryReviewSet-id").MicrosoftGraphSecurityAddToReviewSet().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.security.cases.ediscoverycases.item.reviewsets.item.microsoftgraphsecurityaddtoreviewset.AddToReviewSetPostRequestBody addToReviewSetPostRequestBody = new com.microsoft.graph.beta.security.cases.ediscoverycases.item.reviewsets.item.microsoftgraphsecurityaddtoreviewset.AddToReviewSetPostRequestBody();
com.microsoft.graph.beta.models.security.EdiscoverySearch search = new com.microsoft.graph.beta.models.security.EdiscoverySearch();
search.setId("c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7");
addToReviewSetPostRequestBody.setSearch(search);
addToReviewSetPostRequestBody.setAdditionalDataOptions(EnumSet.of(com.microsoft.graph.beta.models.security.AdditionalDataOptions.LinkedFiles));
addToReviewSetPostRequestBody.setCloudAttachmentVersion(com.microsoft.graph.beta.models.security.CloudAttachmentVersion.Latest);
graphClient.security().cases().ediscoveryCases().byEdiscoveryCaseId("{ediscoveryCase-id}").reviewSets().byEdiscoveryReviewSetId("{ediscoveryReviewSet-id}").microsoftGraphSecurityAddToReviewSet().post(addToReviewSetPostRequestBody);
const options = {
authProvider,
};
const client = Client.init(options);
const addToReviewSet = {
search: {
id: 'c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7'
},
additionalDataOptions: 'linkedFiles',
cloudAttachmentVersion: 'latest'
};
await client.api('/security/cases/ediscoveryCases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/addToReviewSet')
.version('beta')
.post(addToReviewSet);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Cases\EdiscoveryCases\Item\ReviewSets\Item\MicrosoftGraphSecurityAddToReviewSet\AddToReviewSetPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\EdiscoverySearch;
use Microsoft\Graph\Beta\Generated\Models\Security\AdditionalDataOptions;
use Microsoft\Graph\Beta\Generated\Models\Security\CloudAttachmentVersion;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new AddToReviewSetPostRequestBody();
$search = new EdiscoverySearch();
$search->setId('c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7');
$requestBody->setSearch($search);
$requestBody->setAdditionalDataOptions(new AdditionalDataOptions('linkedFiles'));
$requestBody->setCloudAttachmentVersion(new CloudAttachmentVersion('latest'));
$graphServiceClient->security()->cases()->ediscoveryCases()->byEdiscoveryCaseId('ediscoveryCase-id')->reviewSets()->byEdiscoveryReviewSetId('ediscoveryReviewSet-id')->microsoftGraphSecurityAddToReviewSet()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Security
$params = @{
search = @{
id = "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
}
additionalDataOptions = "linkedFiles"
cloudAttachmentVersion = "latest"
}
Add-MgBetaSecurityCaseEdiscoveryCaseReviewSetToReviewSet -EdiscoveryCaseId $ediscoveryCaseId -EdiscoveryReviewSetId $ediscoveryReviewSetId -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.cases.ediscoverycases.item.reviewsets.item.microsoft_graph_security_add_to_review_set.add_to_review_set_post_request_body import AddToReviewSetPostRequestBody
from msgraph_beta.generated.models.security.ediscovery_search import EdiscoverySearch
from msgraph_beta.generated.models.additional_data_options import AdditionalDataOptions
from msgraph_beta.generated.models.cloud_attachment_version import CloudAttachmentVersion
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AddToReviewSetPostRequestBody(
search = EdiscoverySearch(
id = "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7",
),
additional_data_options = AdditionalDataOptions.LinkedFiles,
cloud_attachment_version = CloudAttachmentVersion.Latest,
)
await graph_client.security.cases.ediscovery_cases.by_ediscovery_case_id('ediscoveryCase-id').review_sets.by_ediscovery_review_set_id('ediscoveryReviewSet-id').microsoft_graph_security_add_to_review_set.post(request_body)
Response
The following example shows the response.
HTTP/1.1 202 Accepted
Example 2: Add search with all data options and the latest cloud and document versions
The following example shows how to add search to the review set with all options selected for additionalDataOptions, the 10 most recent versions selected for documents, and the latest version selected for cloud attachments.
Request
The following example shows a request.
POST https://graph.microsoft.com/beta/security/cases/ediscoveryCases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/addToReviewSet
Content-Type: application/json
{
"search": {
"id": "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
},
"additionalDataOptions": "linkedFiles, allVersions, advancedIndexing, listAttachments, htmlTranscripts, messageConversationExpansion, locationsWithoutHits, allItemsInFolder",
"cloudAttachmentVersion": "latest",
"documentVersion": "recent10"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Security.Cases.EdiscoveryCases.Item.ReviewSets.Item.MicrosoftGraphSecurityAddToReviewSet;
using Microsoft.Graph.Beta.Models.Security;
var requestBody = new AddToReviewSetPostRequestBody
{
Search = new EdiscoverySearch
{
Id = "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7",
},
AdditionalDataOptions = AdditionalDataOptions.LinkedFiles | AdditionalDataOptions.AllVersions | AdditionalDataOptions.AdvancedIndexing | AdditionalDataOptions.ListAttachments | AdditionalDataOptions.HtmlTranscripts | AdditionalDataOptions.MessageConversationExpansion | AdditionalDataOptions.LocationsWithoutHits | AdditionalDataOptions.AllItemsInFolder,
CloudAttachmentVersion = CloudAttachmentVersion.Latest,
DocumentVersion = DocumentVersion.Recent10,
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
await graphClient.Security.Cases.EdiscoveryCases["{ediscoveryCase-id}"].ReviewSets["{ediscoveryReviewSet-id}"].MicrosoftGraphSecurityAddToReviewSet.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphsecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/security"
graphmodelssecurity "github.com/microsoftgraph/msgraph-beta-sdk-go/models/security"
//other-imports
)
requestBody := graphsecurity.NewAddToReviewSetPostRequestBody()
search := graphmodelssecurity.NewEdiscoverySearch()
id := "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
search.SetId(&id)
requestBody.SetSearch(search)
additionalDataOptions := graphmodels.LINKEDFILES, ALLVERSIONS, ADVANCEDINDEXING, LISTATTACHMENTS, HTMLTRANSCRIPTS, MESSAGECONVERSATIONEXPANSION, LOCATIONSWITHOUTHITS, ALLITEMSINFOLDER_ADDITIONALDATAOPTIONS
requestBody.SetAdditionalDataOptions(&additionalDataOptions)
cloudAttachmentVersion := graphmodels.LATEST_CLOUDATTACHMENTVERSION
requestBody.SetCloudAttachmentVersion(&cloudAttachmentVersion)
documentVersion := graphmodels.RECENT10_DOCUMENTVERSION
requestBody.SetDocumentVersion(&documentVersion)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
graphClient.Security().Cases().EdiscoveryCases().ByEdiscoveryCaseId("ediscoveryCase-id").ReviewSets().ByEdiscoveryReviewSetId("ediscoveryReviewSet-id").MicrosoftGraphSecurityAddToReviewSet().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.beta.security.cases.ediscoverycases.item.reviewsets.item.microsoftgraphsecurityaddtoreviewset.AddToReviewSetPostRequestBody addToReviewSetPostRequestBody = new com.microsoft.graph.beta.security.cases.ediscoverycases.item.reviewsets.item.microsoftgraphsecurityaddtoreviewset.AddToReviewSetPostRequestBody();
com.microsoft.graph.beta.models.security.EdiscoverySearch search = new com.microsoft.graph.beta.models.security.EdiscoverySearch();
search.setId("c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7");
addToReviewSetPostRequestBody.setSearch(search);
addToReviewSetPostRequestBody.setAdditionalDataOptions(EnumSet.of(com.microsoft.graph.beta.models.security.AdditionalDataOptions.LinkedFiles, com.microsoft.graph.beta.models.security.AdditionalDataOptions.AllVersions, com.microsoft.graph.beta.models.security.AdditionalDataOptions.AdvancedIndexing, com.microsoft.graph.beta.models.security.AdditionalDataOptions.ListAttachments, com.microsoft.graph.beta.models.security.AdditionalDataOptions.HtmlTranscripts, com.microsoft.graph.beta.models.security.AdditionalDataOptions.MessageConversationExpansion, com.microsoft.graph.beta.models.security.AdditionalDataOptions.LocationsWithoutHits, com.microsoft.graph.beta.models.security.AdditionalDataOptions.AllItemsInFolder));
addToReviewSetPostRequestBody.setCloudAttachmentVersion(com.microsoft.graph.beta.models.security.CloudAttachmentVersion.Latest);
addToReviewSetPostRequestBody.setDocumentVersion(com.microsoft.graph.beta.models.security.DocumentVersion.Recent10);
graphClient.security().cases().ediscoveryCases().byEdiscoveryCaseId("{ediscoveryCase-id}").reviewSets().byEdiscoveryReviewSetId("{ediscoveryReviewSet-id}").microsoftGraphSecurityAddToReviewSet().post(addToReviewSetPostRequestBody);
const options = {
authProvider,
};
const client = Client.init(options);
const addToReviewSet = {
search: {
id: 'c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7'
},
additionalDataOptions: 'linkedFiles, allVersions, advancedIndexing, listAttachments, htmlTranscripts, messageConversationExpansion, locationsWithoutHits, allItemsInFolder',
cloudAttachmentVersion: 'latest',
documentVersion: 'recent10'
};
await client.api('/security/cases/ediscoveryCases/58399dff-cebe-478f-b1af-d3227f1fd645/reviewSets/63ef0fd7-0db2-45eb-a9d7-7d75c8239873/addToReviewSet')
.version('beta')
.post(addToReviewSet);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Security\Cases\EdiscoveryCases\Item\ReviewSets\Item\MicrosoftGraphSecurityAddToReviewSet\AddToReviewSetPostRequestBody;
use Microsoft\Graph\Beta\Generated\Models\Security\EdiscoverySearch;
use Microsoft\Graph\Beta\Generated\Models\Security\AdditionalDataOptions;
use Microsoft\Graph\Beta\Generated\Models\Security\CloudAttachmentVersion;
use Microsoft\Graph\Beta\Generated\Models\Security\DocumentVersion;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new AddToReviewSetPostRequestBody();
$search = new EdiscoverySearch();
$search->setId('c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7');
$requestBody->setSearch($search);
$requestBody->setAdditionalDataOptions(new AdditionalDataOptions('linkedFiles, allVersions, advancedIndexing, listAttachments, htmlTranscripts, messageConversationExpansion, locationsWithoutHits, allItemsInFolder'));
$requestBody->setCloudAttachmentVersion(new CloudAttachmentVersion('latest'));
$requestBody->setDocumentVersion(new DocumentVersion('recent10'));
$graphServiceClient->security()->cases()->ediscoveryCases()->byEdiscoveryCaseId('ediscoveryCase-id')->reviewSets()->byEdiscoveryReviewSetId('ediscoveryReviewSet-id')->microsoftGraphSecurityAddToReviewSet()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Security
$params = @{
search = @{
id = "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7"
}
additionalDataOptions = "linkedFiles, allVersions, advancedIndexing, listAttachments, htmlTranscripts, messageConversationExpansion, locationsWithoutHits, allItemsInFolder"
cloudAttachmentVersion = "latest"
documentVersion = "recent10"
}
Add-MgBetaSecurityCaseEdiscoveryCaseReviewSetToReviewSet -EdiscoveryCaseId $ediscoveryCaseId -EdiscoveryReviewSetId $ediscoveryReviewSetId -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.security.cases.ediscoverycases.item.reviewsets.item.microsoft_graph_security_add_to_review_set.add_to_review_set_post_request_body import AddToReviewSetPostRequestBody
from msgraph_beta.generated.models.security.ediscovery_search import EdiscoverySearch
from msgraph_beta.generated.models.additional_data_options import AdditionalDataOptions
from msgraph_beta.generated.models.cloud_attachment_version import CloudAttachmentVersion
from msgraph_beta.generated.models.document_version import DocumentVersion
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AddToReviewSetPostRequestBody(
search = EdiscoverySearch(
id = "c17e91d6-6bc0-4ecb-b388-269ea3d4ffb7",
),
additional_data_options = AdditionalDataOptions.LinkedFiles | AdditionalDataOptions.AllVersions | AdditionalDataOptions.AdvancedIndexing | AdditionalDataOptions.ListAttachments | AdditionalDataOptions.HtmlTranscripts | AdditionalDataOptions.MessageConversationExpansion | AdditionalDataOptions.LocationsWithoutHits | AdditionalDataOptions.AllItemsInFolder,
cloud_attachment_version = CloudAttachmentVersion.Latest,
document_version = DocumentVersion.Recent10,
)
await graph_client.security.cases.ediscovery_cases.by_ediscovery_case_id('ediscoveryCase-id').review_sets.by_ediscovery_review_set_id('ediscoveryReviewSet-id').microsoft_graph_security_add_to_review_set.post(request_body)
Response
The following example shows the response.
HTTP/1.1 202 Accepted