canonical: https://jentic.com/apis/azure.com/azure-machine-learning-model-management-service

# Microsoft Azure Azure Machine Learning Model Management Service

Jentic publishes the only available OpenAPI specification for Azure Machine Learning Model Management Service, keeping it validated and agent-ready. This API manages the registered models, images, profiles, and deployed inference services on an Azure Machine Learning workspace. Operators can register a model, build a containerised image, profile its resource requirements, deploy it as a real-time service, and retrieve scoring keys or short-lived bearer tokens for callers. The API exposes 23 endpoints under the /modelmanagement/v1.0 prefix and authenticates with Azure AD OAuth 2.0.

## For AI agents

Register Azure Machine Learning models, build container images, profile resource requirements, deploy inference services, and rotate scoring keys or bearer tokens for service callers.

## Scope

Does not train models, manage compute clusters, or move data - use for model registration, image build, profiling, and inference service lifecycle only.

## Capabilities

- Register a model artifact against a workspace and tag it for retrieval
- List models in a workspace filtered by tag, name, or framework
- Build a container image from a registered model and an inference config
- Profile a deployed image to recommend CPU, memory, and concurrency settings
- Deploy a model image as a real-time scoring service on attached compute
- Rotate primary or secondary scoring keys on a deployed inference service
- Issue a short-lived bearer token for calling a deployed service

## Use cases

### End-to-End Model Registration and Deployment

Data science teams register the trained model artifact, build an image around it with their inference script, and deploy that image as a real-time service. The POST on /models registers the artifact, POST on /assets uploads supporting files, POST on /services deploys the resulting image, and the deployed service returns a scoring URI plus listKeys for caller authentication. The full sequence is scriptable end to end without leaving this API surface.

Example prompt: Register model 'sentiment-classifier' v3 on workspace 'ml-prod', deploy it as a service named 'sentiment-svc' on attached AKS compute, and return the scoringUri and primary key.

### Resource Profiling Before Production

The POST on /images/{imageId}/profiles runs the image through a profiling job and returns recommended CPU, memory, and concurrency settings, plus measured latency at different load levels. Teams use this output to size production deployments and avoid over- or under-provisioning AKS or ACI targets.

Example prompt: Create a profile for image 'img-sentiment-v3' on workspace 'ml-prod' with name 'profile-prod' against test dataset 'profile-input', poll the operation, and return the recommended cpuCores and memoryInGB.

### Scoring Key Rotation

Deployed inference services authenticate callers with primary and secondary scoring keys, and operators rotate them on a schedule for compliance. The POST on /services/{id}/regenerateKeys accepts 'Primary' or 'Secondary' and issues a fresh value while leaving the other key intact, so clients can cut over without downtime. Pair with /services/{id}/listkeys to retrieve the new value.

Example prompt: Regenerate the secondary key on service 'sentiment-svc' in workspace 'ml-prod' and store the new value in Key Vault secret 'sentiment-secondary-key'.

### Token-Based Service Access for Agents

An AI agent through Jentic can call POST /services/{id}/token to get a short-lived bearer token instead of a long-lived scoring key. This is preferred for agent-driven inference because tokens expire and reduce blast radius if leaked. Jentic returns the token operation alongside the scoring URI so the agent can call the service end to end.

Example prompt: Issue a fresh access token for service 'sentiment-svc' in workspace 'ml-prod' and return the token plus the service scoringUri.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/models | Register a model |
| GET | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/models | List models in a workspace |
| POST | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/services | Deploy a real-time inference service |
| POST | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/services/{id}/listkeys | List scoring keys for a service |
| POST | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/services/{id}/regenerateKeys | Regenerate a service scoring key |
| POST | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/services/{id}/token | Issue a short-lived service token |
| POST | /modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/images/{imageId}/profiles | Profile an image for resource sizing |

## Key resources

- **Models** — Register, list, get, update, and delete model artifacts on a workspace
- **Assets** — Manage supporting files and metadata blobs attached to a workspace
- **Images** — Build container images from registered models and inference configs
- **Profiles** — Profile images for CPU, memory, and concurrency recommendations
- **Services** — Deploy and manage real-time inference services and their keys/tokens
- **Operations** — Track long-running operations triggered by image build and service deploy

## Why Jentic

- **Setup:** Wiring the Azure Machine Learning model management control plane by hand means registering an Azure AD app, acquiring bearer tokens for the AML resource, polling the operations endpoint through async image builds and service deploys, and managing scoring keys and short-lived service tokens yourself. Through Jentic you install once, import Azure Machine Learning Model Management Service from the API Directory, store the Azure AD service principal credentials once, and your agent calls it.
- **Permission scoping:** This surface puts the subscription, resource group, workspace, and service id in the URL path (/modelmanagement/v1.0/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.MachineLearningServices/workspaces/{workspace}/services/{id}), so a rule can pin your agent to models and services on one workspace. You choose the operations it may call, so ones like regenerateKeys or deleting a model are not included unless you add them.
- **Credential handling:** Your Azure AD service principal credentials, along with the scoring keys and service tokens this API returns, are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'deploy an Azure ML model as a real-time service' or 'issue a short-lived token for a scoring service', and Jentic returns the matching model management operation with its input schema so the agent calls the right endpoint without reading the AML docs.

## Related APIs

- **Azure Machine Learning Workspaces** — Provisions the workspace and managed identity that this API operates inside.
- **Azure Machine Learning Datastore Management Client** — Manages the datastores that supply training data and inference inputs for these models.
- **Azure Machine Learning Compute Management Client** — Provisions the AKS or ACI compute targets that deployed services run on.

## FAQ

### Why is there no official OpenAPI spec for Azure Machine Learning Model Management Service?

Microsoft Azure does not publish a single consolidated OpenAPI specification for the AML model management control plane. Jentic generates and maintains this spec so that AI agents and developers can call Azure Machine Learning Model Management Service via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does this API use?

The API uses Azure Active Directory OAuth 2.0; agents acquire a token for the Azure Machine Learning resource and pass it as a Bearer token on every call. Jentic stores the service principal credentials in its vault and injects scoped tokens at call time.

### Can I deploy a model to AKS or ACI through this API?

Yes. The POST on /workspaces/{workspace}/services accepts a compute target reference and a deployment config that targets either an attached AKS cluster or an Azure Container Instance. The deployment is asynchronous and the operations endpoint returns the final state and scoringUri.

### How do I rotate scoring keys through Jentic?

Search Jentic for 'rotate Azure ML service key', load the resulting POST operation on /workspaces/{workspace}/services/{id}/regenerateKeys, then execute it with keyType set to 'Primary' or 'Secondary'. Read the new value with the listkeys POST and store it in Key Vault.

### What is the difference between scoring keys and a service token?

Scoring keys are long-lived primary and secondary values returned by listkeys; tokens issued by /services/{id}/token are short-lived bearer credentials suited to ephemeral callers like agents. Tokens reduce blast radius if leaked, while keys are simpler for static integrations.

### What are the rate limits for this API?

Azure Machine Learning applies workspace-level throttling on control-plane operations rather than per-endpoint quotas. Long-running calls like image build and service deploy return 202 with an operation ID you poll via /operations/{id}.

### Can I limit what my agent is allowed to do with the Azure Machine Learning Model Management Service API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. The subscription, resource group, workspace, and service id all live in the URL path, so a rule can pin the agent to models and services on a single workspace. You also choose which operations it may call, so sensitive ones like regenerateKeys or deleting a model are excluded unless you explicitly add them.