canonical: https://jentic.com/apis/azure.com/appservicecertificateorders-api-client # Microsoft Azure AppServiceCertificateOrders API Client AppServiceCertificateOrders API Client is the Azure Resource Manager surface for managing App Service Certificates - the Azure-managed TLS certificate offering for App Service Web Apps. It covers the full certificate order lifecycle: placing orders, validating registration data, retrieving and reissuing certificates, renewing before expiry, and resending email or domain verification. Certificates issued through the API can be deployed directly to App Service apps and Key Vault. ## For AI agents Order, validate, renew, and reissue Azure App Service Certificates programmatically, including domain verification and Key Vault binding from an AI agent. ## Scope Does not issue Let's Encrypt certificates, manage DNS records directly, or upload externally issued certificates - use for managing Azure-purchased App Service Certificate orders only. ## Capabilities - Place new App Service Certificate orders for one or more App Service apps - Validate certificate registration information before submitting an order - Retrieve issued certificates and bind them to App Service or Key Vault - Reissue an active certificate when the underlying CSR changes - Renew an App Service Certificate before its expiry date - Resend domain verification email to complete the validation step ## Use cases ### Automated TLS Certificate Provisioning Platform teams hosting customer sites on Azure App Service need TLS certificates issued and installed without ticket-based workflows. The API places the order, runs the validation, retrieves the issued certificate, and binds it to the target App Service site - turning a multi-day manual process into a programmatic flow that completes inside an hour for verified domains. Example prompt: Validate registration info via the validateCertificateRegistrationInformation endpoint, place a PUT on certificateOrders, poll provisioningState, then retrieve and bind the certificate to a target App Service site. ### Pre-Expiry Renewal Workflow Operations teams need to renew App Service Certificates before they expire to avoid TLS outages. Listing certificate orders and filtering by expirationTime gives a renewal queue, then calling the renew endpoint extends each certificate. Renewals can be scheduled 60 days before expiry to leave room for domain reverification. Example prompt: List certificate orders, filter to those expiring within 60 days, and POST to the renew endpoint for each, then verify the new expirationTime. ### Reissue After Key Rotation Security policies that mandate periodic private key rotation require certificates to be reissued with a new CSR. The API supports reissue without cancelling the order - preserving the certificate's history while issuing a new keypair. This keeps audit trails intact and avoids the cost of a fresh certificate purchase. Example prompt: Generate a new CSR, POST to the reissue endpoint with the CSR, and then retrieve the reissued certificate when provisioningState reaches Succeeded. ### Agent-Driven Certificate Management via Jentic An AI ops agent monitoring an Azure tenant can detect approaching certificate expiry, then use Jentic to discover and execute the renewal endpoint without holding the Azure subscription credentials. Jentic returns the schema for the renew action and the response payload directly, keeping the agent stateless on secrets. Example prompt: Search Jentic for 'renew an Azure App Service Certificate', execute against the target order resource, and verify the new expirationTime in the response. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.CertificateRegistration/certificateOrders | List all certificate orders in the subscription | | POST | /subscriptions/{subscriptionId}/providers/Microsoft.CertificateRegistration/validateCertificateRegistrationInformation | Validate registration data before placing an order | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName} | Create or update a certificate order | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/reissue | Reissue a certificate with a new CSR | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/renew | Renew an existing certificate order | ## Key resources - **Certificate orders** — Place, list, retrieve, and update App Service Certificate orders - **Certificates** — Retrieve issued certificates associated with an order and bind them to App Service or Key Vault - **Renew** — Renew an existing certificate before expiry - **Reissue** — Reissue a certificate with a new CSR while preserving the order - **Validation** — Validate certificate registration information and resend domain verification emails ## Why Jentic - **Setup:** Wiring the App Service Certificate Orders client by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, and sequencing the validate, order, domain-verification, and renew steps against the Microsoft.CertificateRegistration provider yourself. Through Jentic you install once, import the App Service Certificate Orders client from the API Directory, store the service principal credential once, and your agent calls it. - **Permission scoping:** Certificate orders are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.CertificateRegistration/certificateOrders/{certificateOrderName}/...), so a rule can pin your agent to one subscription, resource group, and named order. You choose the operations it may call, so destructive ones like reissuing a certificate or deleting an order are not included unless you add them. - **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'renew an Azure App Service Certificate' or 'validate certificate registration information', and Jentic returns the matching operation with its input schema so the agent supplies the order name and payload without navigating the certificateOrders hierarchy. ## Related APIs - **CertificateRegistrationProvider API Client** — Lists Microsoft.CertificateRegistration provider operations for RBAC scoping - **Certificates API Client** — Manage uploaded App Service certificates that were not purchased via Azure - **Key Vault Management Client** — Provision Key Vaults that store the issued certificates and keys ## FAQ ### What authentication does the AppServiceCertificateOrders API Client use? Azure Active Directory OAuth 2.0 bearer tokens against https://management.azure.com/. Through Jentic the token is vaulted and a scoped session is supplied at call time, so the agent never sees client secrets. ### Can I order a new TLS certificate with this API? Yes. POST to validateCertificateRegistrationInformation first to confirm the order payload is valid, then PUT to /certificateOrders/{certificateOrderName} with productType, distinguishedName, and validityInYears. The order then enters a domain verification stage before the certificate is issued. ### What are the rate limits for the AppServiceCertificateOrders API? Standard Azure Resource Manager throttling applies - typically 12,000 reads and 1,200 writes per hour per subscription. Order placement and renewal calls also go through GoDaddy as the underlying CA, which can introduce additional latency on validation steps. ### How do I renew a certificate through Jentic? Search Jentic for 'renew an App Service Certificate'. Jentic returns the schema for POST /certificateOrders/{certificateOrderName}/renew with the renewal payload. Execute the call and verify the new expirationTime in the returned certificate order resource. ### How much do App Service Certificates cost? App Service Certificates are billed annually per certificate. As of the 2018-02-01 API version, Standard certificates and Wildcard certificates are sold at fixed yearly rates set by Azure. The API does not surface live pricing - see the Azure App Service Certificate pricing page for current values. ### Can I bind the issued certificate to Key Vault? Yes. After issuance, the certificate can be stored in an Azure Key Vault by setting the keyVaultId and keyVaultSecretName on the order resource. The PUT call updates the order to point at the target Key Vault, and the certificate is then accessible to other Azure services that read from that vault. ### Can I limit what my agent is allowed to do with the AppServiceCertificateOrders API Client? Yes. Because your Jentic One instance is self-hosted, your own rules decide which operations and credentials the agent may use. Certificate orders are addressed by path parameters (subscription, resource group, and named certificate order), so you can pin the agent to a single subscription, resource group, and order. You also choose which operations it may call, so destructive actions like reissuing a certificate or deleting an order stay out of reach unless you explicitly add them.