Microsoft Defender for Endpoint POST request returning 405

Hi @Vanta Integration ,

Direct answer: no, section 4.17 ($query passed via POST body) is not supported by the Defender for Endpoint API. The 405 is expected behavior, not a bug.

When the docs say "Supports OData V4 queries", it means a documented subset of OData query options passed in the URL of a GET request, not full OData v4.01 protocol compliance. For the vulnerabilities endpoint specifically, the request is GET /api/vulnerabilities with an empty body, and only $filter (on id, name, description, cvssV3, publishedOn, severity, updatedOn), $top (max 8,000) and $skip are supported. There is no $query route at all, and the resource only accepts GET, which is why POST returns 405. The same whitelist model applies across the other MDE endpoints, and not all properties are filterable.

So your options:

1. Keep it as GET with the query options URL-encoded in the query string, for example:

GET https://api.security.microsoft.com/api/vulnerabilities?$filter=severity eq 'Critical' and publishedOn gt 2026-01-01&$top=1000

URL length is rarely a problem given the small operator whitelist.

1. If you need complex queries beyond that whitelist (joins, aggregations, arbitrary conditions), the supported "query in a POST body" mechanism in Defender is the Advanced Hunting API. POST your query as KQL to /api/advancedqueries/run and use the vulnerability tables (DeviceTvmSoftwareVulnerabilities, DeviceTvmSoftwareVulnerabilitiesKB). That gives you far more expressive power than the OData filters ever will.
2. For bulk pulls of the full dataset, use the export assessment APIs (for example vulnerabilities per machine) instead of paging the OData endpoint.

References: https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-odata-samples https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-apiHi @Vanta Integration,

Direct answer: no, section 4.17 ($query passed via POST body) is not supported by the Defender for Endpoint API. The 405 is expected behavior, not a bug.

When the docs say "Supports OData V4 queries", it means a documented subset of OData query options passed in the URL of a GET request, not full OData v4.01 protocol compliance. For the vulnerabilities endpoint specifically, the request is GET /api/vulnerabilities with an empty body, and only $filter (on id, name, description, cvssV3, publishedOn, severity, updatedOn), $top (max 8,000) and $skip are supported. There is no $query route at all, and the resource only accepts GET, which is why POST returns 405. The same whitelist model applies across the other MDE endpoints, and not all properties are filterable.

So your options:

1. Keep it as GET with the query options URL-encoded in the query string, for example:

GET https://api.security.microsoft.com/api/vulnerabilities?$filter=severity eq 'Critical' and publishedOn gt 2026-01-01&$top=1000

URL length is rarely a problem given the small operator whitelist.

1. If you need complex queries beyond that whitelist (joins, aggregations, arbitrary conditions), the supported "query in a POST body" mechanism in Defender is the Advanced Hunting API. POST your query as KQL to /api/advancedqueries/run and use the vulnerability tables (DeviceTvmSoftwareVulnerabilities, DeviceTvmSoftwareVulnerabilitiesKB). That gives you far more expressive power than the OData filters ever will.
2. For bulk pulls of the full dataset, use the export assessment APIs (for example, vulnerabilities per machine) instead of paging the OData endpoint.

References:
https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities
https://learn.microsoft.com/en-us/defender-endpoint/api/exposed-apis-odata-samples
https://learn.microsoft.com/en-us/defender-endpoint/api/run-advanced-query-api