canonical: https://jentic.com/apis/azure.com/azure-mediaservicesmanagementclient # Microsoft Azure MediaServicesManagementClient Jentic publishes the only available OpenAPI specification for MediaServicesManagementClient, keeping it validated and agent-ready. The Azure Media Services management API provisions and operates Media Services accounts that back video encoding, packaging, and streaming workloads. Use it to create accounts, list and update existing ones, manage the storage keys that bind the account to its backing storage, and verify name availability before provisioning. Authentication is via Azure Active Directory OAuth 2.0 on Azure Resource Manager. ## For AI agents Provision and operate Azure Media Services accounts: create accounts, rotate access keys, sync storage keys, and manage backing storage relationships. Useful for automating video pipeline infrastructure. ## Scope Does not encode video, package streams, or manage assets and jobs - use for control-plane Media Services account lifecycle and key management only. ## Capabilities - Create or update an Azure Media Services account in a chosen region with a backing storage account - List Media Services accounts within a resource group to inventory video infrastructure - Retrieve a Media Services account to inspect its storage relationship and tags - Regenerate Media Services account access keys to rotate credentials - Synchronise storage account keys after rotation so Media Services keeps streaming uninterrupted - Check whether a candidate Media Services account name is available before provisioning - Delete a Media Services account when the video workload is decommissioned ## Use cases ### Provision Media Services for a new video product Engineering teams use the API to provision an Azure Media Services account at the start of a new video product, attaching it to a backing storage account that will hold the source assets and streaming outputs. A single PUT call creates the account in the chosen region with the desired tags and storage reference, and downstream pipelines can then create assets and jobs through the data-plane API. Example prompt: PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName} with location and storageAccounts list, then verify with the matching GET. ### Rotate Media Services access keys on a schedule Security policy often mandates account key rotation on a fixed cadence. The API supports listing the current access keys, regenerating one, and then updating downstream consumers with the new key. Combine with the storage sync endpoint to ensure the Media Services account stays in lockstep with backing storage keys when those rotate too. Example prompt: POST /.../listKeys to capture the existing key, POST /.../regenerateKey with the keyType to rotate, then update consumers with the new key value from the response. ### Reconnect Media Services after storage key rotation When the backing storage account rotates its keys, the linked Media Services account loses access until it picks up the new keys. The syncStorageKeys POST forces Media Services to re-fetch the storage credentials, restoring streaming and encoding throughput without requiring a recreate. Run it as the final step of any storage rotation playbook. Example prompt: POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName}/syncStorageKeys with the storageAccountId in the body. ### Agent-driven Media Services lifecycle Through Jentic, an AI agent can react to a video product launch checklist and provision a complete Media Services account, attach storage, set tags, and emit the keys to a downstream pipeline. The agent searches Jentic for 'create azure media services account', loads the operation, and chains the calls. Jentic injects the Azure AD bearer token at execution time so the agent never sees raw credentials. Example prompt: Use Jentic search 'create azure media services account', load MediaService_Create, supply location and storage account ID, and execute, then chain MediaService_ListKeys. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName} | Create a Media Services account | | PATCH | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName} | Update a Media Services account | | GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices | List Media Services accounts in a resource group | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName}/listKeys | List Media Services account keys | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName}/regenerateKey | Regenerate a Media Services key | | POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName}/syncStorageKeys | Sync backing storage keys | | POST | /subscriptions/{subscriptionId}/providers/Microsoft.Media/CheckNameAvailability | Check Media Services name availability | ## Key resources - **MediaService** — Create, list, get, update, and delete Azure Media Services accounts; manage and regenerate access keys; sync backing storage keys. - **Operations** — Enumerate Microsoft.Media resource provider operations available to Media Services tooling. ## Why Jentic - **Setup:** Wiring MediaServicesManagementClient by hand means implementing Azure AD OAuth 2.0, minting an ARM-scoped bearer token for management.azure.com, polling asynchronous provisioning operations, and managing the storage account binding and key sync yourself. Through Jentic you install once, import MediaServicesManagementClient from the API Directory, store the Azure AD credential once, and your agent calls it. - **Permission scoping:** The API puts the subscription, resource group, and media service name in the URL path, so a rule can pin your agent to one Media Services account: it can read the account and sync storage keys for that account and nothing else. You choose the operations it may call, so destructive ones like deleting the account or regenerating its keys are not included unless you add them. - **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived ARM-scoped bearer token at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create an Azure Media Services account' or 'sync Media Services storage keys', and Jentic returns the matching MediaService operation with its input schema so the agent supplies the location and storage account and executes. ## Related APIs - **Storage Management Client** — Provision and rotate keys on the Azure Storage accounts that back Media Services. - **Resource Management Client** — Provision the resource group that contains a Media Services account. - **Compute Management Client** — Run custom video encoding on VMs instead of using managed Media Services. - **Management Lock Client** — Apply CanNotDelete locks on production Media Services accounts. ## FAQ ### Why is there no official OpenAPI spec for MediaServicesManagementClient? Microsoft Azure does not publish a standalone OpenAPI specification for the Media Services management resource provider. Jentic generates and maintains this spec so that AI agents and developers can call MediaServicesManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Media Services Management API use? The API uses Azure Active Directory OAuth 2.0 via the azure_auth scheme on https://management.azure.com/. Through Jentic, your Azure AD application credentials are stored encrypted in your Jentic One instance and exchanged for a short-lived bearer token at execution time. ### Can I provision a Media Services account with this API? Yes. Call PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Media/mediaservices/{mediaServiceName} with location and a storageAccounts list referencing the backing Azure Storage account. The new account is ready to receive data-plane calls once provisioning succeeds. ### What are the rate limits for the Media Services Management API? The control-plane endpoints inherit standard Azure Resource Manager throttle quotas, surfaced through x-ms-ratelimit-remaining-* response headers. Bulk creation or rotation operations should respect those headers and back off when remaining quota approaches zero. ### How do I rotate Media Services keys through Jentic? Search Jentic for 'rotate azure media services keys', load MediaService_RegenerateKey, supply the keyType (primary or secondary) in the body, and execute. The response returns the new key, which the agent can then push to downstream consumers. ### Does this API also encode or stream video? No. This is the management plane for the account itself. Data-plane operations such as creating assets, jobs, encoding presets, and streaming endpoints are handled via the Media Services data plane, which is separate from this resource provider API. ### What happens if I forget to sync storage keys after rotation? Streaming and encoding workloads will start to fail with authorisation errors against the backing storage account. Calling POST /.../syncStorageKeys forces Media Services to re-fetch the latest storage keys, immediately restoring access without recreating the account. ### Can I limit what my agent is allowed to do with the Media Services Management API? Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use, and the subscription, resource group, and media service name sit in the URL path so you can pin the agent to a single Media Services account. You choose the exact operations it may call, so you can allow it to read the account and sync storage keys while excluding destructive ones like deleting the account or regenerating its keys. The Azure AD credential stays encrypted in your instance and is exchanged for a short-lived token at execution time, so the agent never sees the raw secret.