Microsoft Graph subscriptions enable applications to receive real-time notifications when changes occur in user or organizational resources. Through Rewst, you can utilize subscriptions as workflow triggers, automating processes such as ticket creation in your PSA when a new user is added to Microsoft 365.
For additional information, see Microsoft's documentation on graph API subscriptions.
Rewst currently supports various subscriptions, each tailored to specific organizational needs:
The Users trigger is a webhook trigger that receives webhooks whenever a change occurs to any user in a Microsoft Graph API organization.
Purpose: To monitor and respond to changes in users within a Microsoft Graph API organization.
Trigger details:
- Name: Users
- Description: Changes to all users
- Type: Webhook trigger
- Webhook URL template:
/webhooks/microsoft_graph/{trigger_id}/{org_id}
User trigger parameters
The following are the parameters that can be passed to the Users trigger:
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | chats/getAllMessages | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 60 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | created,updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
User output
The Users trigger has a default output schema that includes the following fields:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| resourceData | object | The resource data object describing the change notification. |
Purpose: To subscribe to changes in all groups within Microsoft Graph, receiving notifications when groups are created or updated.
Trigger Details:
- Name: Groups
- Description: Changes to all groups
- Type: Webhook
- Webhook URL Template:
/webhooks/microsoft_graph/{trigger_id}/{org_id}
Group trigger parameters
The following parameters are available for the Groups trigger:
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | chats/getAllMessages | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 60 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | created,updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
Group output
The output schema for the Groups trigger is an object with the following properties:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| resourceData | object | The resource data object describing the change notification. |
Purpose: To receive notifications for changes in chat messages across all chats.
Chat message parameters
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | chats/getAllMessages | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 60 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | created,updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
| decrypt_messages | bool | true | Whether or not to decrypt the message payloads in incoming webhooks from this subscription. |
Chat message output
The output schema for the Chat trigger is an object with the following properties:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| decryptedContent | object | The resource data object describing the change notification. |
| encryptedContent | object | The resource data object describing the change notification. |
| resourceData | object | The resource data object describing the change notification. |
Output schema
The output schema for the Chat trigger decryptedContent property is object with the following properties:
| Field | Type | Description |
|---|---|---|
| id | string | The ID of the chat message. |
| replyToId | string | The ID of the message that this message is a reply to. |
| from | object | The sender of the chat message. |
| etag | string | An opaque string value that changes whenever the message is changed or deleted. |
| messageType | string | The type of the chat message. |
| createdDateTime | datetime | The timestamp of when the chat message was created. |
| lastModifiedDateTime | datetime | The timestamp of when the chat message was last modified. |
| lastEditedDateTime | datetime | The timestamp of when the chat message was last edited. |
| deletedDateTime | datetime | The timestamp of when the chat message was deleted. |
| subject | string | The subject of the chat message. |
| body | object | The content of the chat message. |
| summary | string | A short summary of the chat message. |
| attachments | array | The attachments (if any) associated with the chat message. |
| mentions | array | The mentions (if any) in the chat message. |
| importance | string | The importance of the chat message. |
| reactions | array | The reactions (if any) to the chat message. |
| locale | string | The locale of the chat message. |
| policyViolation | object | If the chat message violates a policy, this property provides details. |
| chatId | string | The ID of the chat thread. |
| channelIdentity | object | The identity of the channel where the chat message was posted. |
| webUrl | string | The URL of the chat message in the Teams UI. |
| eventDetail | object | Additional details about the chat message event. |
Purpose: This trigger receives webhook notifications from Microsoft Graph for changes to chat messages in a specific chat. See these instructions to get the chat ID from Microsoft Teams.
Chat message by chat ID parameters
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | chats/getAllMessages | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 60 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | created,updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
| decrypt_messages | bool | true | Whether or not to decrypt the message payloads in incoming webhooks from this subscription. |
| chat_id | string | undefined | The chat ID to subscribe to |
Chat message by chat ID output
The output schema for the Chat trigger is an object with the following properties:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| decryptedContent | object | The resource data object describing the change notification. |
| encryptedContent | object | The resource data object describing the change notification. |
| resourceData | object | The resource data object describing the change notification. |
Output schema
The output schema for the Chat trigger decryptedContent property is object with the following properties:
| Field | Type | Description |
|---|---|---|
| id | string | The ID of the chat message. |
| replyToId | string | The ID of the message that this message is a reply to. |
| from | object | The sender of the chat message. |
| etag | string | An opaque string value that changes whenever the message is changed or deleted. |
| messageType | string | The type of the chat message. |
| createdDateTime | datetime | The timestamp of when the chat message was created. |
| lastModifiedDateTime | datetime | The timestamp of when the chat message was last modified. |
| lastEditedDateTime | datetime | The timestamp of when the chat message was last edited. |
| deletedDateTime | datetime | The timestamp of when the chat message was deleted. |
| subject | string | The subject of the chat message. |
| body | object | The content of the chat message. |
| summary | string | A short summary of the chat message. |
| attachments | array | The attachments (if any) associated with the chat message. |
| mentions | array | The mentions (if any) in the chat message. |
| importance | string | The importance of the chat message. |
| reactions | array | The reactions (if any) to the chat message. |
| locale | string | The locale of the chat message. |
| policyViolation | object | If the chat message violates a policy, this property provides details. |
| chatId | string | The ID of the chat thread. |
| channelIdentity | object | The identity of the channel where the chat message was posted. |
| webUrl | string | The URL of the chat message in the Teams UI. |
| eventDetail | object | Additional details about the chat message event. |
Purpose: Changes to chat messages in all channels in all teams.
All channels chat messages parameters
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | teams/getAllMessages | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 60 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | created,updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
| decrypt_messages | bool | true | Whether or not to decrypt the message payloads in incoming webhooks from this subscription. |
All channels chat messages output
The output schema for the Teams trigger is an object with the following properties:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| decryptedContent | object | The resource data object describing the change notification. |
| encryptedContent | object | The resource data object describing the change notification. |
| resourceData | object | The resource data object describing the change notification. |
Output schema
The output schema for the Chat trigger decryptedContent property is object with the following properties:
| Field | Type | Description |
|---|---|---|
| id | string | The ID of the chat message. |
| replyToId | string | The ID of the message that this message is a reply to. |
| from | object | The sender of the chat message. |
| etag | string | An opaque string value that changes whenever the message is changed or deleted. |
| messageType | string | The type of the chat message. |
| createdDateTime | datetime | The timestamp of when the chat message was created. |
| lastModifiedDateTime | datetime | The timestamp of when the chat message was last modified. |
| lastEditedDateTime | datetime | The timestamp of when the chat message was last edited. |
| deletedDateTime | datetime | The timestamp of when the chat message was deleted. |
| subject | string | The subject of the chat message. |
| body | object | The content of the chat message. |
| summary | string | A short summary of the chat message. |
| attachments | array | The attachments (if any) associated with the chat message. |
| mentions | array | The mentions (if any) in the chat message. |
| importance | string | The importance of the chat message. |
| reactions | array | The reactions (if any) to the chat message. |
| locale | string | The locale of the chat message. |
| policyViolation | object | If the chat message violates a policy, this property provides details. |
| chatId | string | The ID of the chat thread. |
| channelIdentity | object | The identity of the channel where the chat message was posted. |
| webUrl | string | The URL of the chat message in the Teams UI. |
| eventDetail | object | Additional details about the chat message event. |
Purpose: Changes to chat messages in a specific channel. See these instructions to get the team ID and channel ID from Microsoft Teams.
Teams message parameters
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | teams/getAllMessages | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 60 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | created,updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
| decrypt_messages | bool | true | Whether or not to decrypt the message payloads in incoming webhooks from this subscription. |
| team_id | string | undefined | The channel ID to subscribe to |
| channel_id | string | undefined | The team ID of the channel to subscribe to |
Teams message output
The output schema for the Teams trigger is an object with the following properties:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| decryptedContent | object | The resource data object describing the change notification. |
| encryptedContent | object | The resource data object describing the change notification. |
| resourceData | object | The resource data object describing the change notification. |
Output schema
The output schema for the Chat trigger decryptedContent property is object with the following properties:
| Field | Type | Description |
|---|---|---|
| id | string | The ID of the chat message. |
| replyToId | string | The ID of the message that this message is a reply to. |
| from | object | The sender of the chat message. |
| etag | string | An opaque string value that changes whenever the message is changed or deleted. |
| messageType | string | The type of the chat message. |
| createdDateTime | datetime | The timestamp of when the chat message was created. |
| lastModifiedDateTime | datetime | The timestamp of when the chat message was last modified. |
| lastEditedDateTime | datetime | The timestamp of when the chat message was last edited. |
| deletedDateTime | datetime | The timestamp of when the chat message was deleted. |
| subject | string | The subject of the chat message. |
| body | object | The content of the chat message. |
| summary | string | A short summary of the chat message. |
| attachments | array | The attachments (if any) associated with the chat message. |
| mentions | array | The mentions (if any) in the chat message. |
| importance | string | The importance of the chat message. |
| reactions | array | The reactions (if any) to the chat message. |
| locale | string | The locale of the chat message. |
| policyViolation | object | If the chat message violates a policy, this property provides details. |
| chatId | string | The ID of the chat thread. |
| channelIdentity | object | The identity of the channel where the chat message was posted. |
| webUrl | string | The URL of the chat message in the Teams UI. |
| eventDetail | object | Additional details about the chat message event. |
Purpose: This trigger receives webhook notifications from Microsoft Graph for new Security Alerts.
Security alert parameters
| Name | Data Type | Default Value | Description |
|---|---|---|---|
| resource | immutable str | security/alerts?$filter=Status eq 'NewAlert' | The resource to subscribe to. |
| max_expiration_time_minutes | immutable int | 43100 | The maximum amount of time (in minutes) before the subscription expires. |
| change_type | immutable str | updated | The type of change to listen for. Possible values are "created", "updated", "deleted", and "deleted,updated". |
Security alert output
The output schema for the Security Alerts trigger is an object with the following properties:
| Parameter | Type | Description |
|---|---|---|
| id | string | The ID of the change notification. |
| subscriptionId | string | The ID of the subscription. |
| subscriptionExpirationDateTime | datetime | The expiration datetime for this subscription. |
| changeType | string | The type of changes being subscribed to. |
| clientState | string | An ID used internally to validate the subscription payloads. |
| tenantId | string | The Microsoft tenant ID tied to this subscription. |
| resourceData | object | The resource data object describing the change notification. |