canonical: https://jentic.com/apis/azure.com/automationmanagementclient

# Microsoft Azure AutomationManagementClient

AutomationManagementClient is the Azure Resource Manager API for managing webhooks attached to Azure Automation runbooks. It supports listing, creating, updating, and deleting webhooks, plus generating the unique webhook URI used to trigger a runbook from an external system. Use this client to wire runbooks into webhook-driven event sources such as monitoring tools, custom apps, or third-party CI systems.

## For AI agents

Create and manage webhooks that trigger Azure Automation runbooks from external systems, callable by an AI agent.

## Scope

Does not author runbooks, execute jobs, or manage Automation account billing - use for runbook webhook lifecycle management only.

## Capabilities

- List all webhooks attached to a specific Automation account
- Generate the unique webhook URI used to invoke a runbook
- Create a webhook bound to a runbook with optional parameter defaults
- Update a webhook's name, expiry, or enabled state
- Delete a webhook to revoke external invocation access
- Retrieve a single webhook's metadata for inspection

## Use cases

### Event-Driven Runbook Triggering

Operations teams want their monitoring tools, CI systems, or custom apps to trigger an Azure Automation runbook on specific events. Generating a webhook URI and creating the webhook resource produces a single-use HTTPS endpoint that, when POSTed to, starts the bound runbook. Webhook URIs are returned only at creation time and cannot be retrieved later, so they must be captured and stored securely.

Example prompt: POST /webhooks/generateUri to get a fresh URI, then PUT a webhook resource with that URI bound to the target runbook, and securely capture the URI in the response.

### Webhook Lifecycle Hygiene

Security policies require webhooks to expire and be rotated periodically. Listing webhooks per account, filtering by expiryTime, and PATCHing the expiryTime forward (or deleting and recreating) keeps the webhook estate aligned with policy. Disabled webhooks reject incoming POSTs but preserve the resource for audit.

Example prompt: List webhooks, identify those expiring within 30 days, and either PATCH the expiryTime or DELETE and recreate based on the rotation policy.

### Abuse Response

If a webhook URI is leaked, the fastest mitigation is to disable or delete the webhook. PATCHing isEnabled to false stops the runbook from being invoked while preserving the resource for incident review; DELETE removes it entirely. Both calls take effect immediately at the control plane.

Example prompt: PATCH the affected webhook with isEnabled=false to stop incoming invocations, then GET to confirm the disabled state, and decide whether to DELETE.

### Agent-Driven Webhook Provisioning via Jentic

An AI agent setting up an event-driven workflow can use Jentic to create a runbook webhook on demand, capture the returned URI, and pass it to the upstream event source - all without holding the Automation account credentials in its context. Jentic returns the schemas for both the URI generation and webhook creation calls.

Example prompt: Search Jentic for 'create an Azure Automation runbook webhook', execute the generateUri POST followed by the webhook PUT, and return the URI for the agent to relay to the event source.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/webhooks | List all webhooks on an Automation account |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/webhooks/generateUri | Generate a unique webhook URI |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/webhooks/{webhookName} | Create or update a webhook bound to a runbook |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/webhooks/{webhookName} | Retrieve a webhook resource |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/webhooks/{webhookName} | Delete a webhook |

## Key resources

- **Webhooks** — Create, list, update, retrieve, and delete webhooks attached to runbooks
- **Webhook URI generation** — Generate a unique single-disclosure URI used to invoke a runbook

## Why Jentic

- **Setup:** Wiring AutomationManagementClient by hand means registering an Azure AD app, exchanging OAuth 2.0 tokens for management.azure.com, and learning the two-step webhook dance where you generate a URI and then bind it before Azure Resource Manager throttling and retries get in the way. Through Jentic you install once, import AutomationManagementClient from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This client puts the subscription, resource group, automation account, and webhook name in the URL path (for example /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Automation/automationAccounts/{automationAccountName}/webhooks/{webhookName}), so a rule can pin your agent to one account's webhooks. You choose the operations it may call, so ones like deleting a webhook or generating a fresh invocation URI are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a runbook webhook' or 'rotate an Azure Automation webhook', and Jentic returns the ordered schema (generateUri then the webhook PUT) so the agent does not have to infer the two-step sequence from the spec.

## Related APIs

- **Automation Management** — Provision the parent Automation account that hosts these webhooks
- **Monitor Management Client** — Configure Azure Monitor action groups that POST to runbook webhooks
- **Authorization Management Client** — Grant RBAC roles on the Automation account that controls webhook management

## FAQ

### What authentication does the AutomationManagementClient use?

Azure Active Directory OAuth 2.0 bearer tokens scoped to https://management.azure.com/. Through Jentic the token is held in the encrypted vault and a scoped session is supplied at call time.

### Can I create a webhook for a runbook with this API?

Yes. POST to /webhooks/generateUri first to receive a single-disclosure URI, then PUT /webhooks/{webhookName} with the URI, runbook reference, expiry time, and any default parameter values. The URI is only returned at this PUT and cannot be retrieved later, so capture and store it immediately.

### What are the rate limits for the AutomationManagementClient?

Calls go through Azure Resource Manager and follow ARM throttling - typically 12,000 reads and 1,200 writes per hour per subscription. Webhook management is low-frequency in normal use; rate limits are unlikely to be a constraint.

### How do I rotate a runbook webhook through Jentic?

Search Jentic for 'rotate Azure Automation webhook'. Jentic returns the schemas for the generateUri POST, the webhook PUT, and the DELETE. Execute generateUri, create a new webhook with the fresh URI, switch the upstream caller to the new URI, then DELETE the old webhook.

### Is the AutomationManagementClient free?

Webhook management calls do not have a per-request charge. Runbook job execution triggered by the webhook is billed under the parent Automation account's SKU (Free monthly minutes plus per-minute Basic billing above the allowance).

### What happens when a webhook expires?

Once expiryTime passes, POSTs to the webhook URI are rejected with HTTP 401, and the runbook does not start. The webhook resource itself remains visible via GET so you can audit when it expired; PATCHing expiryTime forward reactivates it without changing the URI.

### Can I limit what my agent is allowed to do with the Azure Automation Webhooks API?

Yes. Because you run Jentic One yourself, you write the rules that decide which operations and credentials the agent may use. Since this API carries the subscription, resource group, automation account, and webhook name in the URL path, you can pin the agent to a single Automation account's webhooks and grant only the calls you want, such as listing webhooks or retrieving one for inspection. Higher-impact operations like generating a fresh invocation URI, creating or updating a webhook, or deleting one stay out of the agent's reach until you explicitly add them.