canonical: https://jentic.com/apis/azure.com/azure-domainregistration-provider # Microsoft Azure DomainRegistrationProvider API Client Jentic publishes the only available OpenAPI specification for DomainRegistrationProvider API Client, keeping it validated and agent-ready. The Azure DomainRegistrationProvider API Client exposes the operations metadata for the Microsoft.DomainRegistration resource provider - the namespace that powers Azure App Service custom domain registration and the Domains API. It exposes a single endpoint that returns the list of available CSM operations, used for RBAC role definition, audit, and feature discovery against the provider. ## For AI agents List the available CSM operations exposed by the Microsoft.DomainRegistration resource provider so an agent can plan RBAC roles or feature-gate based on supported actions. ## Scope Does not register, renew, or modify domains, and does not manage DNS records - use only to enumerate operations exposed by the Microsoft.DomainRegistration provider. ## Capabilities - Retrieve the full operations catalogue for the Microsoft.DomainRegistration provider - Discover which actions on Microsoft.DomainRegistration require RBAC permissions - Drive role-definition tooling that needs the provider operations list - Feature-detect support for new domain registration capabilities at runtime ## Use cases ### Custom RBAC Role Authoring Defining a custom Azure role that allows only domain renewal but not domain deletion requires the exact action strings from Microsoft.DomainRegistration. By calling DomainRegistrationProvider_ListOperations a tool can pull the full operations catalogue, filter for domain renew operations, and emit a Bicep or ARM role definition that grants only those actions. This avoids over-privileging service principals that automate domain renewals. Example prompt: Call DomainRegistrationProvider_ListOperations and return only the operations whose name contains domains/renew. ### Provider Feature Discovery Azure resource providers add new operations over time. Tooling that wraps the Domains API needs a way to detect when new actions become available - for example, a new validate operation. Calling the provider operations list lets a control plane discover supported actions at runtime and surface only the ones the current API version exposes. Example prompt: Compare the output of DomainRegistrationProvider_ListOperations across two API versions and emit a diff of added or removed operation names. ### Compliance Audit of Domain Permissions Compliance teams need to verify that no service principal holds blanket permissions on Microsoft.DomainRegistration. By cross-referencing role assignments against the operations catalogue, an audit tool can flag wildcard grants and recommend tightening to specific operations such as domains/read and domains/renew/action only. Example prompt: Pull the operations list and verify that no role assignment in subscription X holds the wildcard Microsoft.DomainRegistration/* on any scope. ### AI Agent RBAC Planning via Jentic An IAM agent integrated through Jentic can answer a question like what permissions does a service principal need to renew an Azure domain by searching Jentic for list azure domain registration operations, calling DomainRegistrationProvider_ListOperations, and returning only the relevant action strings. This makes least-privilege role definition a one-prompt task. Example prompt: Through Jentic, search for list azure domain registration operations, load DomainRegistrationProvider_ListOperations, execute it, and return the action names that mention domain. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /providers/Microsoft.DomainRegistration/operations | List CSM operations supported by Microsoft.DomainRegistration | ## Key resources - **Provider Operations** — List the CSM operations supported by the Microsoft.DomainRegistration resource provider ## Why Jentic - **Setup:** Wiring the Microsoft.DomainRegistration operations endpoint by hand means acquiring Azure AD OAuth 2.0 bearer tokens, constructing the ARM URL under management.azure.com, and parsing the operations catalogue yourself. Through Jentic you install once, import the DomainRegistrationProvider API Client from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** This API exposes a single read-only endpoint, GET /providers/Microsoft.DomainRegistration/operations, that lists the provider's operation metadata and touches no resource, so limit the agent to that one list operation and it can only enumerate the catalogue and nothing else. - **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected as a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list azure domain registration operations', and Jentic returns the DomainRegistrationProvider list-operations call with its empty input schema so the agent runs it directly without crawling ARM docs. ## Related APIs - **Domains API Client** — The actual domain CRUD and renewal operations on Microsoft.DomainRegistration - **DNS Management Client** — Manages DNS zones and records for the domains registered via the Domains API - **Domain Services Resource Provider** — Manages Azure AD Domain Services rather than domain name registration ## FAQ ### Why is there no official OpenAPI spec for DomainRegistrationProvider API Client? Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DomainRegistrationProvider API Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the DomainRegistrationProvider API Client use? It uses Azure Active Directory OAuth 2.0 (azure_auth) against https://management.azure.com/. The principal needs read access at the appropriate scope. Through Jentic, the underlying client secret stays in your Jentic One instance and the agent receives only a scoped bearer token. ### What does DomainRegistrationProvider_ListOperations return? GET /providers/Microsoft.DomainRegistration/operations returns the catalogue of CSM operations the provider supports, each with a name like Microsoft.DomainRegistration/domains/read and a display object describing the operation in natural language. Use this list to build custom RBAC roles or audit role assignments. ### What are the rate limits for the DomainRegistrationProvider API Client? Standard Azure Resource Manager subscription-scoped read throttling applies (broadly 12,000 reads per hour). Because this API exposes a single read endpoint with a small response payload, throttling is rarely the binding constraint. ### How do I list provider operations through Jentic? Run pip install jentic, search for list azure domain registration operations, load DomainRegistrationProvider_ListOperations, and execute it with no parameters. The response is the array of operation definitions ready to drop into a role-definition tool. ### Does this API let me register or renew domains? No. This API only lists provider operations metadata. To purchase, renew, or manage Azure-bought domains use the separate Domains API Client (azure.com/domains-api-client) on the same Microsoft.DomainRegistration provider. ### Can I limit what my agent is allowed to do with the Domain Registration Provider API Client? Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and this API exposes only a single read-only call, DomainRegistrationProvider_ListOperations (GET /providers/Microsoft.DomainRegistration/operations). Scope the agent to that one list operation and it can only enumerate the provider's operation metadata, nothing else, since the endpoint touches no resource and cannot register, renew, or modify domains. Your Azure AD credential stays in your own instance and is injected as a short-lived, scoped bearer token only at execution time.