canonical: https://jentic.com/apis/azure.com/api-management-client

# Microsoft Azure Azure API Management Client

Jentic publishes the only available OpenAPI specification for Azure API Management Client, keeping it validated and agent-ready. This deployment-level surface manages Azure API Management service instances themselves: list services in a subscription or resource group, get service details, check name availability, run backups and restores, apply network configuration updates, and obtain SSO tokens for the management portal. The product-level operations on APIs, products, and policies live on adjacent APIM clients.

## For AI agents

Provision, back up, restore, and inspect Azure API Management service instances at the deployment level.

## Scope

Does not manage APIs, products, policies, subscriptions, or developer accounts inside an APIM instance - use only for the deployment-level service lifecycle.

## Capabilities

- List API Management services across a subscription or within a resource group
- Check whether a proposed API Management service name is available
- Back up an API Management service to a storage account
- Restore an API Management service from a previous backup
- Apply queued network configuration updates to a service
- Obtain an SSO token for the API Management developer portal

## Use cases

### Disaster Recovery Backups

Operations teams schedule regular API Management backups so a corrupted policy push or an accidental deletion can be rolled back. POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/backup writes to a storage account container, and the matching restore endpoint reverses it on demand.

Example prompt: Back up API Management service 'contoso-apim' in resource group 'rg-prod' to storage account 'contosobackups' container 'apim-backups'

### Pre-Provisioning Name and Region Checks

Before creating an API Management service, automation needs to confirm the chosen DNS name is globally unique. POST /subscriptions/{subscriptionId}/providers/Microsoft.ApiManagement/checkNameAvailability validates the name and surfaces the reason if it is taken, so deployment templates fail fast with a clear error.

Example prompt: Call POST /subscriptions/{subscriptionId}/providers/Microsoft.ApiManagement/checkNameAvailability with name 'contoso-apim' and report the result

### Network Configuration Drift Resolution

When VNet integration changes (subnets, NSGs) outside an APIM update, the service can flag pending network reconfiguration. POST /service/{serviceName}/applynetworkconfigurationupdates re-applies the current configuration so the data plane and gateway re-converge with the underlying network state.

Example prompt: Apply queued network configuration updates to service 'contoso-apim' in resource group 'rg-prod' and poll until the operation succeeds

### Agent-Driven APIM Inventory

An AI agent producing an Azure cost or compliance report can list every API Management instance in a subscription, fetch details, and flag SKUs or regions that violate policy. Through Jentic, the agent searches by intent and gets the right list/get operations with their schemas; the Azure OAuth token is held in the credential vault.

Example prompt: Search Jentic for 'list Azure API Management services', execute against subscription 1111-2222-3333-4444, and emit a CSV of name, region, and SKU

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.ApiManagement/service | List API Management services in a subscription |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service | List services in a resource group |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName} | Get a service |
| POST | /subscriptions/{subscriptionId}/providers/Microsoft.ApiManagement/checkNameAvailability | Check service name availability |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/backup | Back up a service |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/applynetworkconfigurationupdates | Apply queued network configuration updates |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/getssotoken | Get an SSO token |

## Key resources

- **Service Instances** — List, get, back up, restore, and update API Management service instances
- **Name Availability** — Check whether a proposed service name is available
- **Network Configuration** — Apply queued VNet configuration updates
- **SSO Tokens** — Obtain SSO tokens for the developer portal
- **Operations** — List operations exposed by Microsoft.ApiManagement

## Why Jentic

- **Setup:** Wiring Azure API Management by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, and polling the long-running backup and restore operations yourself. Through Jentic you install once, import Azure API Management from the API Directory, store the service principal credential once, and your agent calls it.
- **Permission scoping:** Service instances are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/...), so a rule can pin your agent to one subscription, resource group, and named service. You choose the operations it may call, so destructive ones like backup restore or applying network configuration updates are not included unless you add them.
- **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'back up an Azure API Management service' or 'list API Management instances in a subscription', and Jentic returns the matching operation with its input schema so the agent supplies the storage account and service name without walking the Microsoft.ApiManagement path tree.

## Related APIs

- **Azure Monitor Management Client** — Captures APIM metrics and diagnostic logs for alerting and dashboards.
- **Azure Application Insights Management Client** — Collects backend telemetry for APIs fronted by API Management.
- **Azure Resource Management Client** — Manages the resource group and tags that APIM services live in.
- **Google App Engine API** — GCP managed application surface - different shape but a comparable managed entry point for APIs.

## FAQ

### Why is there no official OpenAPI spec for Azure API Management Client?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure API Management Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure API Management Client use?

The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on management.azure.com. Jentic holds the AAD app secret in your Jentic One instance and exchanges it for a short-lived bearer token per call.

### Can I back up an API Management service with this API?

Yes. POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/backup takes the storage account, container, and blob name and writes a backup. The endpoint is asynchronous; poll the returned operation until it succeeds.

### How do I check whether an APIM service name is available?

Call POST /subscriptions/{subscriptionId}/providers/Microsoft.ApiManagement/checkNameAvailability with the proposed name. The response indicates availability and includes a reason and message when the name is not allowed, so deployments can fail fast with a useful error.

### What are the rate limits for this API?

Azure Resource Manager applies subscription-level throttling. Backup and restore endpoints are tighter because they trigger long-running operations. Honour HTTP 429 Retry-After values and avoid back-to-back backup calls on the same service.

### How do I run a scheduled APIM backup through Jentic?

Run pip install jentic, then search Jentic with 'back up Azure API Management service'. Jentic returns the backup endpoint with its input schema. Load and execute with the storage account, container, and blob name; the OAuth token is resolved from the vault automatically.

### Can I limit what my agent is allowed to do with the Microsoft Azure API Management Client API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. Since every service instance is addressed by path parameters (subscription, resource group, and service name), you can pin the agent to a single subscription, resource group, and named APIM service. You also choose exactly which operations it may call, so you can grant read-only actions like listing services or getting service details while leaving out destructive ones such as backup, restore, or applying network configuration updates.