canonical: https://jentic.com/apis/azure.com/azure-machine-learning-datastore-management-client

# Microsoft Azure Azure Machine Learning Datastore Management Client

Jentic publishes the only available OpenAPI specification for Azure Machine Learning Datastore Management Client, keeping it validated and agent-ready. This API manages datastores attached to an Azure Machine Learning workspace - registered references to Azure Blob, Azure File, Azure Data Lake, SQL, and PostgreSQL data sources that training jobs and pipelines mount instead of hard-coding storage credentials. Operators can register a datastore, list every datastore on a workspace, set or read the workspace default, and remove datastores that are no longer used.

## For AI agents

Register and manage Azure Machine Learning datastores - abstractions over Blob, File, Data Lake, SQL, and PostgreSQL storage that ML jobs reference instead of raw connection strings.

## Scope

Does not move data, train models, or provision compute - use for registering and managing datastore references on an Azure Machine Learning workspace only.

## Capabilities

- Register a new datastore against an Azure Machine Learning workspace
- List every datastore registered to a workspace
- Retrieve a single datastore by name including its credential type
- Update an existing datastore's connection or credential properties
- Set the workspace default datastore for unqualified path references
- Delete a datastore that is no longer in use

## Use cases

### Workspace Bootstrap with Standard Datastores

Data science teams bootstrap a new Azure Machine Learning workspace with a known set of datastores so notebooks and pipelines can mount training data without supplying credentials. The POST on the workspace's datastores endpoint registers a datastore with a name, type (AzureBlob, AzureDataLake, AzureFile, AzureSqlDatabase, or AzurePostgreSql), and the underlying credential reference. Idempotent re-registration keeps environments aligned across dev, staging, and prod.

Example prompt: Register a datastore named 'training-data' of type AzureBlob on workspace 'ml-prod' in resource group 'rg-ml', pointing at storage account 'mlstoreprod' container 'training' using SAS auth.

### Default Datastore Promotion

Promoting a datastore to default lets pipelines reference paths without naming the datastore explicitly, which is useful when a team migrates from one storage account to another. The PUT on /workspaces/{workspaceName}/default/{name} updates the workspace pointer atomically; the previous default remains registered and can still be referenced by name.

Example prompt: Set datastore 'training-data-v2' as the default on workspace 'ml-prod' in resource group 'rg-ml' and confirm via the GET default endpoint.

### Credential Rotation on Datastores

When the underlying storage account rotates a SAS token or key, the datastore record needs the new credential reference or jobs will start failing on mount. The PUT on a named datastore replaces the credential payload in place without re-registering, which preserves dependent dataset and pipeline references that hold the datastore name.

Example prompt: Update datastore 'training-data' on workspace 'ml-prod' to use a new SAS token retrieved from Key Vault secret 'training-store-sas'.

### Agent-Driven Datastore Inventory

An AI agent through Jentic can enumerate datastores across every Machine Learning workspace, flag any that point at decommissioned storage accounts, and delete or update them in bulk. Jentic returns the datastore CRUD operations with full schemas so the agent does not need to interpret the AML control plane docs.

Example prompt: List datastores across every workspace in subscription '00000000-0000-0000-0000-000000000000' and delete any whose storageAccountName equals 'mlstore-deprecated'.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/datastores | Register a new datastore |
| GET | /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/datastores | List datastores on a workspace |
| GET | /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/datastores/{name} | Get a datastore by name |
| PUT | /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/default/{name} | Set the workspace default datastore |
| GET | /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/default | Get the workspace default datastore |
| DELETE | /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/datastores/{name} | Delete a datastore |

## Key resources

- **Datastores** — Register, list, get, update, and delete datastores on a workspace
- **Default datastore** — Read and set the workspace-level default datastore pointer

## Why Jentic

- **Setup:** Wiring the Azure Machine Learning datastore control plane by hand means registering an Azure AD app, acquiring bearer tokens for the AML resource, and shaping a different credential block per storage type (Blob, File, Data Lake, SQL, or PostgreSQL) on every register call. Through Jentic you install once, import Azure Machine Learning Datastore Management Client from the API Directory, store the Azure AD service principal credentials once, and your agent calls it.
- **Permission scoping:** This surface puts the subscription, resource group, workspace, and datastore name in the URL path (/datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/datastores/{name}), so a rule can pin your agent to datastores on one workspace. You choose the operations it may call, so ones like deleting a datastore or changing the workspace default are not included unless you add them.
- **Credential handling:** Your Azure AD service principal credentials, plus the storage SAS tokens and account keys carried in datastore bodies, are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'register an Azure Machine Learning datastore' or 'set the workspace default datastore', and Jentic returns the matching datastore operation with its input schema, including the per-storage-type credential variants, so the agent calls the right endpoint without reading the AML docs.

## Related APIs

- **Azure Machine Learning Workspaces** — Provisions the workspace that hosts the datastores managed here.
- **Azure Machine Learning Model Management Service** — Manages models, images, and services that consume data registered via these datastores.
- **Azure Machine Learning Compute Management Client** — Provisions compute targets where training jobs mount these datastores.

## FAQ

### Why is there no official OpenAPI spec for Azure Machine Learning Datastore Management Client?

Microsoft Azure does not publish a single consolidated OpenAPI specification for the AML datastore control plane. Jentic generates and maintains this spec so that AI agents and developers can call Azure Machine Learning Datastore Management Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does this API use?

The API uses Azure Active Directory OAuth 2.0; agents acquire a token for the Azure Machine Learning resource and pass it as a Bearer token. Jentic stores the service principal credentials in its vault and injects scoped tokens at call time, so client secrets never enter the agent context.

### Which storage types can I register as a datastore?

The datastore body supports Azure Blob, Azure File, Azure Data Lake (Gen 1 and Gen 2), Azure SQL Database, and Azure PostgreSQL. Each type accepts its own credential block - SAS, account key, service principal, or username/password - set on POST and updatable via PUT.

### How do I register a datastore through Jentic?

Search Jentic for 'register an Azure Machine Learning datastore', load the resulting POST operation on /datastore/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{workspaceName}/datastores, then execute it with the workspace name and storage configuration. Install with pip install jentic and run the async search-load-execute flow.

### What is the workspace default datastore used for?

When a job or dataset references a path without naming a datastore explicitly, AML resolves it against the default. The GET on /workspaces/{workspaceName}/default returns it; the PUT on /default/{name} promotes a datastore to default.

### What are the rate limits for this API?

Azure Machine Learning applies workspace-level throttling on control-plane datastore operations rather than a fixed per-endpoint rate. Datastore CRUD is light enough that quotas rarely bind in practice; the spec does not declare narrower limits.

### Can I limit what my agent is allowed to do with the Azure Machine Learning Datastore Management Client?

Yes. Because you run Jentic One yourself, your own rules decide which datastore operations and credentials the agent may use. This API carries the subscription, resource group, workspace, and datastore name in the URL path, so you can pin the agent to the datastores on a single workspace and choose exactly which operations it may call, for example allowing it to register and list datastores while excluding the delete-datastore and set-workspace-default operations. Anything you do not add stays off limits to the agent.