canonical: https://jentic.com/apis/azure.com/appplatformmanagementclient

# Microsoft Azure AppPlatformManagementClient

AppPlatformManagementClient is the Azure Resource Manager API for Azure Spring Cloud (Azure Spring Apps). It lets you provision Spring service instances, deploy and version Spring Boot apps, manage bindings to Azure resources, configure custom domains and SSL certificates, and stream logs and metrics. The API covers the full app lifecycle from creating a service to rolling out new deployments and listing test endpoints.

## For AI agents

Provision Azure Spring Cloud services, deploy and version Spring Boot applications, manage bindings, custom domains, and certificates from an AI agent.

## Scope

Does not run application code, ingest logs, or manage non-Spring workloads - use for control-plane management of Azure Spring Cloud services and apps only.

## Capabilities

- Provision and configure Azure Spring Cloud service instances inside a resource group
- Create, update, and version Spring Boot app deployments with active deployment switching
- Bind Spring apps to backing Azure services such as databases and caches
- Configure custom domains and upload TLS certificates for Spring apps
- Retrieve test endpoint keys to validate staged deployments before promoting them
- Check Spring service name availability inside an Azure region before provisioning

## Use cases

### Blue-Green Deployment for Spring Boot Apps

Platform teams running Spring Boot workloads on Azure Spring Cloud need a controlled way to ship new versions without downtime. The API lets you create a parallel deployment under the same app, push the new JAR or source archive, run smoke tests against the test endpoint, and then switch the active deployment pointer. Rollback is a single PATCH call to flip the pointer back.

Example prompt: Create a new deployment named green under the target app, upload the new artifact, poll until status is Running, then PATCH the app to set activeDeploymentName to green.

### Custom Domain and TLS Setup

Production Spring apps need branded URLs and managed certificates. The API exposes endpoints to upload a certificate, attach it to an app, and bind a custom domain - all idempotent control-plane calls that fit a Terraform-style or agent-driven setup. SSL binding propagation is asynchronous and reflected in the resource provisioningState field.

Example prompt: Upload a certificate to the Spring service, create a custom domain resource pointing the hostname to the app, and verify provisioningState reaches Succeeded.

### Service Discovery for Internal Tools

Internal developer portals need a live inventory of Spring Cloud services and apps across the org. Listing services per subscription and apps per service gives a current map of which workloads run where, which deployment is active, and what bindings each app has. This data feeds catalogues, dashboards, and incident-response tooling.

Example prompt: List all Spring services in the subscription, then for each service list its apps and active deployment, returning a flat inventory of app name, service, region, and active version.

### Agent-Driven Spring App Deployment via Jentic

An AI agent receiving a 'ship version 1.4 of payments-api to staging' instruction can use Jentic to find the Azure Spring Cloud deploy operation, supply the artifact URL and target app, and watch the deployment to completion - all without holding the Azure subscription credentials in its context. Jentic returns the schema and Azure ARM polls the long-running operation transparently.

Example prompt: Search Jentic for 'deploy a Spring Cloud app version', execute the deployments PUT with the artifact URI, then poll the operation status until provisioningState is Succeeded.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.AppPlatform/Spring | List all Spring services in the subscription |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppPlatform/Spring/{serviceName} | Create or update a Spring service instance |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppPlatform/Spring/{serviceName}/apps | List apps within a Spring service |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppPlatform/Spring/{serviceName}/apps/{appName} | Create or update an app and its active deployment pointer |
| POST | /subscriptions/{subscriptionId}/providers/Microsoft.AppPlatform/locations/{location}/checkNameAvailability | Check Spring service name availability in a region |

## Key resources

- **Spring services** — Provision, list, and delete Azure Spring Cloud service instances
- **Apps** — Manage Spring Boot apps within a service, including the active deployment pointer
- **Deployments** — Create, list, start, stop, and restart specific deployment versions of an app
- **Bindings** — Bind apps to backing Azure resources such as databases and caches
- **Custom domains and certificates** — Configure hostnames and upload TLS certificates for app endpoints

## Why Jentic

- **Setup:** Wiring the AppPlatform Management Client for Azure Spring Cloud by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, and polling long-running deployment and SSL-binding operations across dozens of paths yourself. Through Jentic you install once, import the AppPlatform Management Client from the API Directory, store the service principal credential once, and your agent calls it.
- **Permission scoping:** Spring services, apps, and deployments are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.AppPlatform/Spring/{serviceName}/apps/{appName}/...), so a rule can pin your agent to one subscription, resource group, and named service. You choose the operations it may call, so destructive ones like deleting a Spring service or switching the active deployment are not included unless you add them.
- **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'deploy a Spring Cloud app version' or 'list Spring services in a subscription', and Jentic returns the matching operation with its input schema so the agent supplies the artifact URI and app name without hunting through the Microsoft.AppPlatform endpoints.

## Related APIs

- **Web Apps API Client** — Azure App Service Web Apps for general-purpose web hosting beyond Spring Boot
- **AppServicePlans API Client** — Manage the underlying compute plans that host App Service workloads
- **Monitor Management Client** — Configure alerts, action groups, and diagnostic settings for Spring services

## FAQ

### What authentication does the AppPlatformManagementClient use?

Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. Through Jentic the bearer token is held in the encrypted vault and a short-lived scoped session is issued to the agent at call time.

### Can I deploy a new Spring Boot version with this API?

Yes. Create a deployment under the target app via PUT on the deployments path, upload the JAR or source archive URL in the deployment resource, and then PATCH the parent app to set activeDeploymentName to the new deployment. The deployment is a long-running ARM operation; poll provisioningState until it reaches Succeeded.

### What are the rate limits for the AppPlatformManagementClient?

Calls go through Azure Resource Manager and are subject to ARM's per-subscription throttling - typically 12,000 reads and 1,200 writes per hour per subscription. Long-running operation polls count toward the read budget. Check response headers x-ms-ratelimit-remaining-subscription-reads and x-ms-ratelimit-remaining-subscription-writes.

### How do I list Spring services in my subscription through Jentic?

Search Jentic with 'list Azure Spring Cloud services' and execute the returned operation. Jentic loads the schema for GET /subscriptions/{subscriptionId}/providers/Microsoft.AppPlatform/Spring, supplies the scoped Azure token, and returns the parsed JSON list.

### Is the AppPlatformManagementClient free to call?

Management calls do not have a per-request charge. The Azure Spring Cloud / Azure Spring Apps service itself is billed by tier (Basic, Standard, Enterprise) and by app vCPU and memory consumption. See Azure Spring Apps pricing for current rates.

### Can I bind a Spring app to a backing service like Cosmos DB?

Yes. Use PUT on /Spring/{serviceName}/apps/{appName}/bindings/{bindingName} with the resourceId of the Cosmos DB account. The binding makes connection strings available to the app at runtime via injected environment variables.

### Can I limit what my agent is allowed to do with the Azure Spring Cloud API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and Spring services, apps, and deployments are addressed by path parameters, so a rule can pin the agent to a single subscription, resource group, and named service. You also choose the exact operations it may call, so destructive ones such as deleting a Spring service or switching an app's active deployment stay out of reach unless you add them. Your Azure AD service principal credential is stored encrypted by your own instance and exchanged for a short-lived scoped token at call time, so the secret never enters the agent's prompt or logs.