canonical: https://jentic.com/apis/azure.com/appserviceenvironments-api-client # Microsoft Azure AppServiceEnvironments API Client AppServiceEnvironments API Client is the Azure Resource Manager API for App Service Environment v2 (ASE) - Azure's single-tenant, isolated deployment of App Service that runs inside a customer virtual network. It covers ASE provisioning, capacity and virtual IP inspection, virtual network rebinding, diagnostics, multi-role pool scaling, worker pool sizing, metric retrieval, and operation tracking. Use this client to manage the dedicated infrastructure that hosts isolated App Service apps. ## For AI agents Provision and manage Azure App Service Environments - single-tenant isolated App Service deployments inside a VNet - including capacity, scaling, and diagnostics, from an AI agent. ## Scope Does not deploy application code, manage non-isolated App Service workloads, or configure VNet routing tables - use for App Service Environment v2 control-plane management only. ## Capabilities - Provision App Service Environment v2 instances inside an Azure virtual network - Inspect compute and virtual IP capacity for sizing and quota planning - Rebind an ASE to a different virtual network or subnet - Scale multi-role pools and worker pools that back hosted App Service plans - Retrieve diagnostic information for an ASE for troubleshooting - List long-running ARM operations performed against an ASE ## Use cases ### Provisioning Compliance-Grade Hosting Regulated industries (finance, healthcare, government) need App Service workloads that run inside their own VNet with no shared front-end. The API provisions an ASE, attaches it to a designated subnet, and sets the internal load balancer mode - all under ARM with role-based access control. Provisioning is a long-running operation taking up to several hours, tracked through the operations subresource. Example prompt: PUT a hostingEnvironments resource with the target subnet ID and internal load balancer mode, then poll the long-running operation until provisioningState is Succeeded. ### Capacity Planning and Scaling Platform engineering teams managing ASEs need real-time capacity data to decide when to scale worker pools. The compute and virtual IP capacity endpoints return available cores and IPs; combining them with worker pool size lets ops decide when to add Isolated SKU workers. Scaling is exposed as a PATCH on workerPools/{workerPoolName}. Example prompt: GET capacities/compute and capacities/virtualip, decide whether to scale, then PATCH workerPools/{workerPoolName} with the new workerCount. ### VNet Rebinding for Network Migration Network teams migrating an ASE to a redesigned VNet structure use the changeVirtualNetwork action to rebind without recreating the ASE. The operation reassigns the ASE to the new subnet, preserving hosted apps and certificates. It is a long-running operation, surfaced through the operations subresource. Example prompt: POST to /hostingEnvironments/{name}/changeVirtualNetwork with the new subnet ID, then poll operations/{operationId} until completion. ### Agent-Driven ASE Diagnostics via Jentic An ops AI agent investigating App Service availability incidents can pull ASE diagnostics through Jentic without holding the Azure subscription credentials. Jentic returns the diagnostic schema, the agent executes against the named ASE, and the returned diagnostic objects feed an incident summary or runbook automation. Example prompt: Search Jentic for 'get App Service Environment diagnostics', execute the call against the target ASE name, and summarise any items where the diagnostic level indicates an issue. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.Web/hostingEnvironments | List all App Service Environments in the subscription | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name} | Create or update an ASE | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/changeVirtualNetwork | Rebind an ASE to a different VNet or subnet | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/capacities/compute | Retrieve compute capacity for an ASE | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/diagnostics | List diagnostics for an ASE | ## Key resources - **Hosting environments** — Create, list, and update App Service Environment v2 instances - **Capacities** — Read compute and virtual IP capacity for an ASE - **Worker pools and multi-role pools** — Scale and configure the worker pools that back isolated App Service plans - **Diagnostics** — Retrieve diagnostic items and details for troubleshooting an ASE - **Operations** — Track long-running ARM operations performed against an ASE ## Why Jentic - **Setup:** Wiring the App Service Environments client by hand means registering an Azure AD app, acquiring and refreshing OAuth 2.0 bearer tokens for management.azure.com, and polling the long-running provisioning and VNet-rebind operations across the 42 hostingEnvironments, capacities, and worker-pool paths yourself. Through Jentic you install once, import the App Service Environments client from the API Directory, store the service principal credential once, and your agent calls it. - **Permission scoping:** App Service Environments are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/...), so a rule can pin your agent to one subscription, resource group, and named environment. You choose the operations it may call, so ones like rebinding the virtual network or scaling a worker pool are not included unless you add them. - **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. The secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'provision an App Service Environment' or 'get App Service Environment diagnostics', and Jentic returns the matching operation with its input schema so the agent supplies the subnet id and environment name without navigating the hostingEnvironments path layout. ## Related APIs - **AppServicePlans API Client** — Manage the App Service plans hosted inside an ASE - **Web Apps API Client** — Deploy and manage Web Apps that live inside the ASE - **Monitor Management Client** — Configure metric alerts and diagnostic settings on ASE resources ## FAQ ### What authentication does the AppServiceEnvironments API Client use? Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. Jentic securely stores the bearer token and supplies a scoped session at call time, so the agent never holds the underlying client secret. ### Can I provision a new ASE through this API? Yes. PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name} with the virtualNetwork.id and internalLoadBalancingMode in the properties block. ASE provisioning is long-running - poll the resource's provisioningState until it reaches Succeeded, which can take several hours. ### What are the rate limits for the AppServiceEnvironments API? Calls are bound by Azure Resource Manager throttling - generally 12,000 reads and 1,200 writes per hour per subscription. Long-running provisioning operations consume a single write but generate many polling reads; budget those when designing automation. ### How do I scale the worker pool of an ASE through Jentic? Search Jentic for 'scale ASE worker pool'. Jentic returns the schema for PATCH /hostingEnvironments/{name}/workerPools/{workerPoolName}; execute with the new workerCount value. The change is asynchronous and reflected in subsequent GETs on the worker pool resource. ### Can I retrieve diagnostic data for an ASE? Yes. GET /hostingEnvironments/{name}/diagnostics returns the diagnostic items available for the ASE; GET /hostingEnvironments/{name}/diagnostics/{diagnosticsName} returns the detail for a specific diagnostic item including findings and recommendations. ### How do I move an ASE to a new virtual network? POST to /hostingEnvironments/{name}/changeVirtualNetwork with the new subnet's resource ID. This is a long-running operation; poll the operations subresource to track progress and confirm completion. ### Can I limit what my agent is allowed to do with the Microsoft Azure App Service Environments API? Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. App Service Environments are addressed by path parameters (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/...), so you can pin the agent to a single subscription, resource group, and named environment. You also choose the operations it may call, so sensitive ones like rebinding the virtual network via changeVirtualNetwork or scaling a worker pool with PATCH workerPools are excluded unless you add them, while read-only calls such as listing environments or reading compute capacity stay available.