canonical: https://jentic.com/apis/azure.com/app-configuration-management-client # Microsoft Azure Azure App Configuration Management Client Jentic publishes the only available OpenAPI specification for Azure App Configuration Management Client, keeping it validated and agent-ready. This API manages Azure App Configuration store resources at the control plane: create, list, retrieve, and delete configuration stores, list and regenerate access keys, and read or list specific key-values held in a store. It is the surface used to provision the centralised configuration service that applications then read from at runtime. ## For AI agents Provision and manage Azure App Configuration stores, rotate their access keys, and read individual key-values via the management plane. ## Scope Does not perform high-volume data-plane reads or writes against key-values, manage feature flag rollouts, or integrate with Azure Key Vault directly - use only for App Configuration store lifecycle and access key management. ## Capabilities - Create, list, get, and delete App Configuration stores in a subscription - List access keys for a configuration store - Regenerate a primary or secondary access key on demand - Read a specific key-value held in a store via the management plane - Check whether a proposed configuration store name is available - List operations exposed by Microsoft.AppConfiguration ## Use cases ### Configuration Store Provisioning Platform teams provision an App Configuration store per environment via PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}. Once provisioned, apps connect using the access keys returned by the ListKeys endpoint. The lifecycle (create, list, delete) is fully scriptable so environment teardown leaves no orphan stores. Example prompt: Provision App Configuration store 'contoso-config' in resource group 'rg-prod' in westeurope and return the connection string from ListKeys ### Quarterly Access Key Rotation Compliance schedules dictate access key rotation on App Configuration stores every 90 days. POST /service/{configStoreName}/RegenerateKey rotates the primary or secondary key in place, and ListKeys returns the new value so deployment pipelines can update consumers without downtime if they are configured for dual-key roll. Example prompt: Regenerate the secondary key on store 'contoso-config', update the consuming app's secret reference, then regenerate the primary ### Centralised Feature Flag Inspection On-call engineers triaging an incident often need to read the current value of a single feature flag without waiting for the runtime. POST /service/{configStoreName}/listKeyValue retrieves a single key-value via the management plane, bypassing the data plane endpoint when the issue is configuration-driven. Example prompt: Read the key-value 'feature-flag-checkout' from store 'contoso-config' and return its value and label ### Agent-Driven Configuration Store Audits An AI agent running quarterly platform audits can list every App Configuration store in a subscription, check its SKU and location, and flag stores that should be rotated or decommissioned. Through Jentic, intent search returns the right list, get, and ListKeys operations; the Azure OAuth token never leaves the credential vault. Example prompt: Search Jentic for 'list Azure App Configuration stores', execute against the production subscription, and emit a CSV of name, SKU, and location ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.AppConfiguration/configurationStores | List configuration stores in a subscription | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores | List stores in a resource group | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName} | Get a configuration store | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/ListKeys | List access keys | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/RegenerateKey | Regenerate an access key | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/listKeyValue | List a specific key-value | | POST | /subscriptions/{subscriptionId}/providers/Microsoft.AppConfiguration/checkNameAvailability | Check store name availability | ## Key resources - **Configuration Stores** — Create, list, retrieve, update, and delete App Configuration stores - **Access Keys** — List and regenerate primary and secondary access keys - **Key-Values** — Read individual key-values via the management plane - **Name Availability** — Check whether a proposed store name is available - **Operations** — List operations exposed by Microsoft.AppConfiguration ## Why Jentic - **Setup:** Wiring Azure App Configuration Management by hand means registering an Azure AD app, minting and refreshing OAuth 2.0 bearer tokens for management.azure.com, and handling the async store lifecycle and key regeneration yourself. Through Jentic you install once, import Azure App Configuration Management from the API Directory, store the service principal credential once, and your agent calls it. - **Permission scoping:** Configuration stores are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/...), so a rule can pin your agent to one subscription, resource group, and named store. You choose the operations it may call, so destructive ones like deleting a store or regenerating an access key are not included unless you add them. - **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'rotate an Azure App Configuration access key' or 'read a feature-flag key-value', and Jentic returns the matching operation with its input schema so the agent supplies the store name without knowing the long Microsoft.AppConfiguration path layout. ## Related APIs - **Azure Resource Management Client** — Manages the resource group and tags that App Configuration stores live in. - **Azure Monitor Management Client** — Captures App Configuration diagnostic logs for change auditing. - **Azure Policy Client** — Enforces policies on store SKU, region, and key rotation cadence. - **Google Cloud Runtime Configurator API** — GCP managed configuration service comparable to App Configuration. ## FAQ ### Why is there no official OpenAPI spec for Azure App Configuration Management Client? Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure App Configuration Management Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Azure App Configuration Management Client use? The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on management.azure.com. Through Jentic, the AAD app secret is held in your Jentic One instance and exchanged for a short-lived bearer token at execution time, so agents never see the raw secret. ### Can I rotate App Configuration access keys with this API? Yes. POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/RegenerateKey rotates the primary or secondary key in place. Pair it with ListKeys to retrieve the new value for downstream consumers. ### How do I read a specific feature flag value through the management plane? Call POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppConfiguration/configurationStores/{configStoreName}/listKeyValue with the key and label. This is useful for ad-hoc inspection during incidents without standing up the data plane SDK. ### What are the rate limits for this API? Azure Resource Manager applies subscription-level throttling. Key regeneration and listKeyValue calls are subject to tighter limits because they touch secret material. Honour HTTP 429 Retry-After values and avoid scripting tight loops over RegenerateKey. ### How do I provision an App Configuration store and retrieve its connection string through Jentic? Run pip install jentic, then search Jentic with 'create Azure App Configuration store'. Jentic returns the PUT configurationStores endpoint and the ListKeys endpoint with their schemas. Execute create, then ListKeys to obtain the connection string; the OAuth token is resolved from the vault automatically. ### Can I limit what my agent is allowed to do with the Azure App Configuration Management API? Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and every configuration store is addressed by path parameters, so you can pin the agent to a single subscription, resource group, and named store. You choose which operations it may call, so read-only work like listing and getting stores or reading a key-value can be allowed while destructive operations such as DeleteConfigurationStore or RegenerateKey stay out of reach unless you add them. The Azure AD service principal credential is held by your instance and exchanged for a short-lived bearer token at execution time, so the agent never sees the raw secret.