Microsoft Azure AppServiceCertificateOrders API Client
Browse all Azure APIsCommunity OpenAPI document · agent-readySecuritySecrets Managementoauth220 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Order, validate, renew, and reissue Azure App Service Certificates programmatically, including domain verification and Key Vault binding from an AI agent.
Use for: I need to order a new App Service Certificate for my domain, Validate the registration information for a certificate order before submitting it, Renew the App Service Certificate that is expiring next month, Reissue the certificate after rotating the private key
Not supported: Does not issue Let's Encrypt certificates, manage DNS records directly, or upload externally issued certificates - use for managing Azure-purchased App Service Certificate orders only.
AppServiceCertificateOrders API Client is the Azure Resource Manager surface for managing App Service Certificates - the Azure-managed TLS certificate offering for App Service Web Apps. It covers the full certificate order lifecycle: placing orders, validating registration data, retrieving and reissuing certificates, renewing before expiry, and resending email or domain verification. Certificates issued through the API can be deployed directly to App Service apps and Key Vault.
Install Jentic One Beta
Connect the AppServiceCertificateOrders API Client to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AppServiceCertificateOrders API Client, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fappservicecertificateorders-api-client" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fappservicecertificateorders-api-client" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AppServiceCertificateOrders API Client API.
Place new App Service Certificate orders for one or more App Service apps
Validate certificate registration information before submitting an order
Retrieve issued certificates and bind them to App Service or Key Vault
Reissue an active certificate when the underlying CSR changes
Renew an App Service Certificate before its expiry date
Resend domain verification email to complete the validation step
Use Cases
Patterns agents use AppServiceCertificateOrders API Client API for, with concrete tasks.
★ Automated TLS Certificate Provisioning
Platform teams hosting customer sites on Azure App Service need TLS certificates issued and installed without ticket-based workflows. The API places the order, runs the validation, retrieves the issued certificate, and binds it to the target App Service site - turning a multi-day manual process into a programmatic flow that completes inside an hour for verified domains.
Validate registration info via the validateCertificateRegistrationInformation endpoint, place a PUT on certificateOrders, poll provisioningState, then retrieve and bind the certificate to a target App Service site.
Pre-Expiry Renewal Workflow
Operations teams need to renew App Service Certificates before they expire to avoid TLS outages. Listing certificate orders and filtering by expirationTime gives a renewal queue, then calling the renew endpoint extends each certificate. Renewals can be scheduled 60 days before expiry to leave room for domain reverification.
List certificate orders, filter to those expiring within 60 days, and POST to the renew endpoint for each, then verify the new expirationTime.
Reissue After Key Rotation
Security policies that mandate periodic private key rotation require certificates to be reissued with a new CSR. The API supports reissue without cancelling the order - preserving the certificate's history while issuing a new keypair. This keeps audit trails intact and avoids the cost of a fresh certificate purchase.
Generate a new CSR, POST to the reissue endpoint with the CSR, and then retrieve the reissued certificate when provisioningState reaches Succeeded.
Agent-Driven Certificate Management via Jentic
An AI ops agent monitoring an Azure tenant can detect approaching certificate expiry, then use Jentic to discover and execute the renewal endpoint without holding the Azure subscription credentials. Jentic returns the schema for the renew action and the response payload directly, keeping the agent stateless on secrets.
Search Jentic for 'renew an Azure App Service Certificate', execute against the target order resource, and verify the new expirationTime in the response.
Key Endpoints
20 endpoints — appservicecertificateorders api client is the azure resource manager surface for managing app service certificates - the azure-managed tls certificate offering for app service web apps.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.CertificateRegistration/certificateOrders
List all certificate orders in the subscription
POST
/subscriptions/{subscriptionId}/providers/Microsoft.CertificateRegistration/validateCertificateRegistrationInformation
Validate registration data before placing an order
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}
Create or update a certificate order
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/reissue
Reissue a certificate with a new CSR
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/renew
Renew an existing certificate order
GET
/subscriptions/{subscriptionId}/providers/Microsoft.CertificateRegistration/certificateOrders
List all certificate orders in the subscription
POST
/subscriptions/{subscriptionId}/providers/Microsoft.CertificateRegistration/validateCertificateRegistrationInformation
Validate registration data before placing an order
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}
Create or update a certificate order
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/reissue
Reissue a certificate with a new CSR
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/renew
Renew an existing certificate order
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the App Service Certificate Orders client by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, and sequencing the validate, order, domain-verification, and renew steps against the Microsoft.CertificateRegistration provider yourself. Through Jentic you install once, import the App Service Certificate Orders client from the API Directory, store the service principal credential once, and your agent calls it.
Permission scoping
Certificate orders are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/...), so a rule can pin your agent to one subscription, resource group, and named order. You choose the operations it may call, so destructive ones like reissuing a certificate or deleting an order are not included unless you add them.
Credential isolation
Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'renew an Azure App Service Certificate' or 'validate certificate registration information', and Jentic returns the matching operation with its input schema so the agent supplies the order name and payload without navigating the certificateOrders hierarchy.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AppServiceCertificateOrders API Client API through Jentic.
What authentication does the AppServiceCertificateOrders API Client use?
Azure Active Directory OAuth 2.0 bearer tokens against https://management.azure.com/. Through Jentic the token is vaulted and a scoped session is supplied at call time, so the agent never sees client secrets.
Can I order a new TLS certificate with this API?
Yes. POST to validateCertificateRegistrationInformation first to confirm the order payload is valid, then PUT to /certificateOrders/{certificateOrderName} with productType, distinguishedName, and validityInYears. The order then enters a domain verification stage before the certificate is issued.
What are the rate limits for the AppServiceCertificateOrders API?
Standard Azure Resource Manager throttling applies - typically 12,000 reads and 1,200 writes per hour per subscription. Order placement and renewal calls also go through GoDaddy as the underlying CA, which can introduce additional latency on validation steps.
How do I renew a certificate through Jentic?
Search Jentic for 'renew an App Service Certificate'. Jentic returns the schema for POST /certificateOrders/{certificateOrderName}/renew with the renewal payload. Execute the call and verify the new expirationTime in the returned certificate order resource.
How much do App Service Certificates cost?
App Service Certificates are billed annually per certificate. As of the 2018-02-01 API version, Standard certificates and Wildcard certificates are sold at fixed yearly rates set by Azure. The API does not surface live pricing - see the Azure App Service Certificate pricing page for current values.
Can I bind the issued certificate to Key Vault?
Yes. After issuance, the certificate can be stored in an Azure Key Vault by setting the keyVaultId and keyVaultSecretName on the order resource. The PUT call updates the order to point at the target Key Vault, and the certificate is then accessible to other Azure services that read from that vault.
Can I limit what my agent is allowed to do with the AppServiceCertificateOrders API Client?
Yes. Because your Jentic One instance is self-hosted, your own rules decide which operations and credentials the agent may use. Certificate orders are addressed by path parameters (subscription, resource group, and named certificate order), so you can pin the agent to a single subscription, resource group, and order. You also choose which operations it may call, so destructive actions like reissuing a certificate or deleting an order stay out of reach unless you explicitly add them.
GET STARTED