canonical: https://jentic.com/apis/azure.com/azure-deployment-manager # Microsoft Azure AzureDeploymentManager Jentic publishes the only available OpenAPI specification for AzureDeploymentManager, keeping it validated and agent-ready. The Azure Deployment Manager (ADM) API orchestrates safe, staged rollouts of Azure resources across regions using artifact sources, service topologies, and step-by-step rollouts. It coordinates pre and post deployment health checks, manual intervention gates, and wait steps so multi-region updates can be staged, monitored, and cancelled if a region fails. Use it to model service topologies, define rollout steps, and track or cancel in-flight rollouts via the Azure Resource Manager. ## For AI agents Orchestrate staged, multi-region Azure resource rollouts - define artifact sources, service topologies, and rollout steps, then start, restart, or cancel rollouts. ## Scope Does not handle compute provisioning, ARM template authoring, or CI/CD pipeline triggers - use for staged multi-region rollout orchestration only. ## Capabilities - Define artifact sources that point to ARM template repositories for staged rollouts - Model service topologies and service units that describe what gets deployed where - Author rollout steps including health checks and wait steps for safe progression - Start, monitor, cancel, or restart in-flight rollouts across multiple Azure regions - List operational metadata for Microsoft.DeploymentManager via the Azure Resource Manager - Coordinate manual approval gates between rollout regions before continuing deployment ## Use cases ### Multi-region staged service rollout Coordinate the rollout of a global service across regions with the Azure Deployment Manager. Operators define a service topology, a sequence of rollout steps with health checks and wait gates, then call PUT on /rollouts/{rolloutName} to start. ADM advances region-by-region and stops automatically if a step fails, giving release engineers a safe alternative to ad-hoc ARM template runs. Example prompt: Create an ArtifactSource pointing at an SAS-protected ARM template, define a two-region ServiceTopology, and start a Rollout with a 15-minute wait step between regions ### Rollback when a region fails When a deployment step reports unhealthy in a target region, an on-call agent can call POST /rollouts/{rolloutName}/cancel to stop progression, inspect the failed step via Steps_Get, and trigger remediation. This lets agents implement automated guard rails on top of ADM rollouts rather than rolling back manually through the portal. Example prompt: List active rollouts in a resource group, find the one with status Failed, and call Rollouts_Cancel to halt further region progression ### Manage service topology as code Platform teams describe their global services as ServiceTopologies, ServiceUnits, and Steps so each release reuses the same shape. Agents query and update these resources via the ARM API, keeping the topology version-controlled alongside application code rather than maintained as portal clicks. Example prompt: Update a ServiceUnit to point at a new ARM template version and trigger Rollouts_CreateOrUpdate to roll the change out ### AI agent integration via Jentic Release engineering agents use Jentic to discover Azure Deployment Manager operations by intent rather than hand-coding ARM calls. The agent searches Jentic for 'orchestrate an Azure rollout', loads the operation schema for Rollouts_CreateOrUpdate, and executes with structured input. Jentic handles the OAuth2 token exchange against the azure_auth flow so the agent never sees the raw bearer token. Example prompt: Use Jentic search to find Rollouts_CreateOrUpdate, load its schema, and execute a rollout with a generated ARM template artifact source ## Key endpoints | Method | Path | Description | | --- | --- | --- | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/rollouts/{rolloutName} | Create or update a rollout | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/rollouts/{rolloutName}/cancel | Cancel an in-flight rollout | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/rollouts/{rolloutName}/restart | Restart a paused rollout | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/serviceTopologies/{serviceTopologyName} | Create or update a service topology | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/artifactSources/{artifactSourceName} | Create or update an artifact source | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/steps/{stepName} | Create or update a rollout step | ## Key resources - **ArtifactSources** — Pointers to ARM template repositories used as the source of truth for a rollout. - **ServiceTopologies** — Top-level description of the services being deployed and how they map to regions. - **Services / ServiceUnits** — Logical groupings under a topology that define the actual deployable artifacts per region. - **Steps** — Reusable rollout steps such as wait steps and health check steps that compose into a rollout. - **Rollouts** — An execution of a topology - supports get, create, delete, cancel, and restart operations. ## Why Jentic - **Setup:** Wiring the AzureDeploymentManager API by hand means registering an Azure AD app for OAuth2 bearer auth against management.azure.com, building the long Microsoft.DeploymentManager paths for artifact sources, topologies, steps, and rollouts, and polling ARM for rollout state across regions. Through Jentic you install once, import AzureDeploymentManager from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** The rollout sits in the URL path (/rollouts/{rolloutName}, with /cancel and /restart subpaths), so a rule can pin your agent to one rollout. You choose the operations it may call, so cancelling or restarting a rollout is not included unless you add them, leaving an agent that can only create or read. - **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'orchestrate a staged azure resource rollout' or 'cancel a failing rollout', and Jentic returns the matching Microsoft.DeploymentManager operation, for example Rollouts_CreateOrUpdate, with its input schema so the agent calls the right endpoint without browsing the ARM reference. ## Related APIs - **Azure Resource Management** — Resource Management is the underlying ARM control plane that Deployment Manager builds on for resource provisioning. - **Azure CDN Management** — Manage CDN profiles and endpoints that often ship as part of a multi-region rollout. - **Azure Batch Management** — Batch Management handles compute pools and account lifecycle rather than orchestrated rollouts. ## FAQ ### Why is there no official OpenAPI spec for AzureDeploymentManager? Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AzureDeploymentManager via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the AzureDeploymentManager API use? The API uses Azure Active Directory OAuth 2.0 with the implicit flow declared as the azure_auth security scheme. Tokens are presented as Bearer tokens against management.azure.com. Through Jentic, the OAuth exchange and token rotation are handled in the vault - agents call the operation by name and never see the raw access token. ### Can I cancel a rollout that is already running with this API? Yes. Call POST on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DeploymentManager/rollouts/{rolloutName}/cancel (operationId Rollouts_Cancel). The rollout stops at the current step and you can later call the matching restart endpoint to resume. ### What are the rate limits for the AzureDeploymentManager API? Azure Resource Manager applies subscription-level throttling - typically 12,000 read and 1,200 write requests per hour per subscription, returned via x-ms-ratelimit-remaining headers. Deployment Manager does not document additional limits beyond ARM. ### How do I start a staged rollout through Jentic? Run pip install jentic, then use the async client to search 'orchestrate an Azure rollout', load the Rollouts_CreateOrUpdate operation, and execute with your ServiceTopology and ArtifactSource references. Jentic returns the rollout resource so you can poll its status. ### Does the API support ARM templates other than those stored in storage accounts? ArtifactSources currently support SAS-protected Azure storage accounts as the artifact root. Other source types are not described in the spec, so use a storage-backed ArtifactSource as the input to your rollout. ### Can I limit what my agent is allowed to do with the Azure Deployment Manager API? Yes. Because you run Jentic One yourself, your own rules decide which Deployment Manager operations the agent may call and which Azure AD credential it uses. Since the rollout name lives in the URL path, such as /rollouts/{rolloutName} with its /cancel and /restart subpaths, you can pin the agent to a single rollout and choose exactly which operations it is allowed to run. You can leave out Rollouts_Cancel and the restart endpoint so the agent can only create or read rollouts, topologies, and artifact sources rather than halt or resume them.