canonical: https://jentic.com/apis/azure.com/azure-database-for-mysql

# Microsoft Azure MySQLManagementClient

Jentic publishes the only available OpenAPI specification for Azure Database for MySQL management, keeping it validated and agent-ready. The Microsoft.DBforMySQL Resource Provider exposes full lifecycle management for managed MySQL servers, databases, firewall rules, virtual network rules, configurations, log files, and Active Directory administrators. It is the control plane behind Azure Database for MySQL on the Single Server tier, covering provisioning, scaling, network access, security configuration, and operational telemetry. Server names, regions, and SKUs can be checked, validated, and changed without restarting the engine in many cases.

## For AI agents

Provision and manage Azure Database for MySQL servers, databases, firewall rules, vnet rules, and configurations. Covers 33 control-plane endpoints under Microsoft.DBforMySQL.

## Scope

Does not execute SQL queries, manage backups, or perform point-in-time restore - use for Azure Database for MySQL control plane operations only.

## Capabilities

- Provision MySQL servers with a chosen SKU, version, and storage profile
- Add or remove databases on an existing managed MySQL server
- Configure firewall rules to allow traffic from specific IP ranges
- Attach virtual network rules so that a subnet can reach the server privately
- Update server configuration parameters such as max_connections without restart
- Manage Azure Active Directory administrator on a MySQL server for AAD-based login
- Retrieve performance tier definitions and check name availability before provisioning

## Use cases

### Automated MySQL server provisioning

Platform teams provisioning per-environment MySQL servers from CI run a single workflow that checks name availability, picks the right performance tier, creates the server with a chosen SKU and storage size, then layers on databases and firewall rules. Provisioning a new general-purpose server typically completes in under 10 minutes, and the API returns a fully qualified hostname ready for the application to connect.

Example prompt: Create a MySQL server named orders-prod in resource group app-prod with SKU GP_Gen5_4, 100 GB storage, version 5.7, and admin login orders-admin.

### Network access management for managed MySQL

Security teams limit MySQL server reachability by configuring firewall rules and virtual network rules through the API. Firewall rules allow specific IPv4 ranges; vnet rules permit specific Azure subnets to reach the server over service endpoints. Adding or removing rules is a control-plane operation that takes effect within seconds and does not require a server restart.

Example prompt: Add firewall rule office-corp allowing 203.0.113.10 to 203.0.113.50 on server orders-prod, and add a vnet rule attaching subnet app-subnet from vnet app-vnet.

### Performance tuning via configuration updates

Database engineers tune Azure Database for MySQL server parameters such as innodb_buffer_pool_size, max_connections, and slow_query_log without redeploying the server. The configurations endpoint accepts a value update in place, and most parameters apply on the next session without downtime. Combined with reading server metrics through Azure Monitor, this allows iterative tuning loops driven entirely from code.

Example prompt: Update the max_connections parameter on server orders-prod to 600 by patching the configurations subresource and verify the new value via a follow-up GET.

### Agent-driven Azure MySQL operations

AI agents can use Jentic to discover Microsoft.DBforMySQL operations by intent, load the structured input schema, and execute calls against management.azure.com without browsing the Azure REST docs. A platform agent that handles new database requests can stand up the server, create the application database, open the right firewall holes, and return the connection string from a single natural language request.

Example prompt: Search Jentic for create azure mysql server, load the input schema, and execute it for a Basic tier server with SKU B_Gen5_1 in westus2 and admin login appuser.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DBforMySQL/servers/{serverName} | Create or update a managed MySQL server |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.DBforMySQL/servers | List MySQL servers in a subscription |
| POST | /subscriptions/{subscriptionId}/providers/Microsoft.DBforMySQL/checkNameAvailability | Check MySQL server name availability |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DBforMySQL/servers/{serverName}/Administrators/activeDirectory | Set the AAD administrator on a MySQL server |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.DBforMySQL/locations/{locationName}/performanceTiers | List performance tiers in a region |

## Key resources

- **Servers** — Top-level Microsoft.DBforMySQL resource representing a managed MySQL server with SKU, storage, and version.
- **Databases** — Logical databases created on a managed MySQL server.
- **Firewall Rules** — IPv4 range allow-lists controlling public network access to a MySQL server.
- **Virtual Network Rules** — Subnet allow-lists permitting Azure VNet traffic to a MySQL server via service endpoints.
- **Configurations** — Per-server parameter values such as max_connections and innodb_buffer_pool_size.
- **Administrators** — Azure Active Directory administrator binding for AAD-based MySQL login.
- **Log Files** — Server log file metadata available for download from the managed server.
- **Performance Tiers** — Per-region catalog of available performance tier and storage combinations.

## Why Jentic

- **Setup:** Wiring MySQLManagementClient by hand means implementing Azure AD OAuth 2.0, minting an ARM-scoped bearer token for management.azure.com, polling long-running server provisioning operations, and modelling the server, database, firewall, and configuration hierarchy under Microsoft.DBforMySQL yourself. Through Jentic you install once, import Azure Database for MySQL Management from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The API puts the subscription, resource group, and server name in the URL path, so a rule can pin your agent to one MySQL server: it can read the server, add databases, and set firewall rules on it and nothing else. You choose the operations it may call, so destructive ones like deleting the server or a database are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived ARM-scoped bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an Azure MySQL server' or 'add an Azure MySQL firewall rule', and Jentic returns the matching Microsoft.DBforMySQL operation with its input schema so the agent supplies the SKU, storage, and network settings and executes.

## Related APIs

- **Azure Database for PostgreSQL Management** — Same control plane shape for managed PostgreSQL instead of MySQL.
- **Azure SQL Management** — Managed Microsoft SQL Server alternative with elastic pools and managed instance options.
- **Azure Network Management** — Manages the virtual networks and subnets referenced by MySQL vnet rules.

## FAQ

### Why is there no official OpenAPI spec for MySQLManagementClient 2017-12-01-preview?

Microsoft Azure does not publish an OpenAPI specification for this preview slice of the Microsoft.DBforMySQL Resource Provider. Jentic generates and maintains this spec from the Azure Resource Manager contracts so that AI agents and developers can call MySQLManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure Database for MySQL Management API use?

The API uses Azure Active Directory OAuth 2.0 with the user_impersonation scope against https://login.microsoftonline.com/common/oauth2/authorize. Jentic stores the AAD client secret or service principal credentials encrypted in its vault and supplies scoped bearer tokens to agents at execution time without exposing the underlying credential.

### Can I create a database on a MySQL server through this API?

Yes. PUT under /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DBforMySQL/servers/{serverName}/databases/{databaseName} creates or updates a database on a managed server. The body accepts charset and collation; once created, the database is reachable via the standard MySQL wire protocol on the server hostname.

### What are the rate limits for the Azure Database for MySQL Management API?

The control plane follows the standard Azure Resource Manager throttling limits, which apply per subscription and per region. Read operations are limited to 1200 requests per hour per subscription. Server creation and SKU scale operations are long-running, so callers should poll the operation status endpoint rather than retry aggressively.

### How do I add a firewall rule to a MySQL server through Jentic?

Search Jentic for create azure mysql firewall rule, load the schema for PUT under servers/{serverName}/firewallRules/{firewallRuleName}, and execute it with startIpAddress and endIpAddress. Jentic handles the AAD token exchange and returns the new rule resource.

### Does this API connect to MySQL and run queries?

No. This is the control plane only; it provisions and configures servers and their network access but does not execute SQL. Once the server and its firewall or vnet rules are in place, applications connect using the standard MySQL wire protocol on the server hostname returned by the create call.

### Can I limit what my agent is allowed to do with the Azure Database for MySQL Management API?

Yes. Because you run Jentic One yourself, your own rules decide which Microsoft.DBforMySQL operations and which Azure AD credential the agent may use. Since the subscription, resource group, and server name sit in the URL path, you can pin the agent to a single MySQL server so it can only read that server, add databases, and set firewall or virtual network rules on it. You choose the exact operations, so destructive calls like deleting a server or a database are left out unless you explicitly include them.