canonical: https://jentic.com/apis/azure.com/azure-ml-web-services-management-client

# Microsoft Azure Azure ML Web Services Management Client

Jentic publishes the only available OpenAPI specification for Azure ML Web Services Management Client, keeping it validated and agent-ready. The API manages Azure Machine Learning web services published from ML Studio (classic), supporting create-or-update, get, patch, delete, region-blob creation, and key retrieval under the Microsoft.MachineLearning provider. It is the control surface for deploying inference endpoints, rotating their access keys, and listing every web service in a resource group or subscription.

## For AI agents

Deploy, patch, and inspect Azure Machine Learning web services and retrieve their access keys so an agent can manage classic ML inference endpoints programmatically.

## Scope

Does not handle model training, dataset management, or modern Azure ML online endpoints - use for ML Studio (classic) web service deployment, key, and inventory operations only.

## Capabilities

- Create or update an Azure ML web service with its package, properties, and runtime configuration
- Patch a deployed web service to update properties without a full redeploy
- Retrieve the primary and secondary access keys for an Azure ML web service
- List every Azure ML web service in a subscription or scoped to a resource group
- Create a regional blob upload location for staging a web service package before deployment
- Delete an Azure ML web service when its inference endpoint is decommissioned

## Use cases

### Deploy an ML Studio Web Service from CI

Trigger an Azure ML web service deployment from a continuous integration pipeline once a new model package has been built. The PUT on /webServices/{webServiceName} accepts the package payload, properties, and the runtime tier, and the operation returns a long-running operation handle so the pipeline can poll until the service is ready. This avoids manual ML Studio publishing and keeps deployments versioned alongside code.

Example prompt: Create or update the Azure ML web service 'fraud-scorer-v3' in resource group 'ml-rg' with the latest package payload and poll until provisioningState is Succeeded

### Rotate Web Service Access Keys

Periodically rotate the primary and secondary access keys for an Azure ML web service so that consumer applications can switch between keys with no downtime. The listKeys action returns both keys for a single web service, allowing the caller to update downstream consumers before regenerating. This is critical for SOC 2 and ISO 27001 controls that require regular credential rotation on production inference endpoints.

Example prompt: Call POST listKeys on web service 'fraud-scorer-v3' in resource group 'ml-rg' and return both primary and secondary keys for downstream rotation

### Inventory and Tag Web Services for Cost Allocation

List every Azure ML web service in a subscription and patch tags on each so that cost reports can attribute inference spend to the correct cost centre. The subscription-scoped GET returns paginated web services across all resource groups, and PATCH on /webServices/{webServiceName} applies tag updates without modifying the deployed package. This produces a complete inventory in seconds rather than walking resource groups by hand.

Example prompt: List every Azure ML web service in subscription '00000000-0000-0000-0000-000000000000' and patch each one to add the tag costCentre=ml-platform

### Agent-Driven ML Endpoint Audit via Jentic

An AI agent uses Jentic to discover every Azure ML web service in a tenant, fetch each endpoint's keys via listKeys, and emit an audit report covering deployment age, location, and access key rotation status. The agent searches Jentic for 'list azure ml web services', loads the schema, and chains the call into per-service listKeys requests. Azure AD bearer tokens are sourced from your Jentic One instance per call.

Example prompt: Search Jentic for 'list azure ml web services', list every web service in the subscription, then call listKeys on each and emit an audit report ranking endpoints by last-modified date

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName} | Create or update a web service |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName} | Get a web service |
| PATCH | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName} | Patch a web service |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName} | Delete a web service |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName}/listKeys | List access keys for a web service |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.MachineLearning/webServices | List web services in a subscription |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName}/CreateRegionalBlob | Create a regional blob for package staging |

## Key resources

- **WebServices** — Create, read, update, patch, and delete Azure ML web service deployments under Microsoft.MachineLearning.
- **WebServices Keys** — Retrieve primary and secondary access keys for a deployed web service via the listKeys action.
- **Regional Blob** — Generate a regional blob upload URL for staging a web service package before deployment.
- **Operations** — List the operations supported by the Microsoft.MachineLearning provider for the web services API surface.

## Why Jentic

- **Setup:** Wiring the Azure ML Web Services client by hand means registering an Azure AD app, minting tokens for https://management.azure.com/, and polling the long-running deployment operations while handling ARM throttling and key retrieval yourself. Through Jentic you install once, import Azure ML Web Services Management Client from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The web service id travels in the URL path (/webServices/{webServiceName}/...), so a rule can pin your agent to one web service: it can read that service and list its keys and nothing else. You choose the operations it may call, so destructive ones like deleting a web service are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list azure ml web services' or 'rotate an ML web service access key', and Jentic returns the matching Microsoft.MachineLearning operation with its input schema so the agent calls the right endpoint without browsing the ARM reference.

## Related APIs

- **Azure ML Commitment Plans Management Client** — Manages the commitment plans that web services attach to for committed-capacity pricing.
- **Azure Machine Learning Workspaces** — Modern Azure ML workspaces API - the successor surface for current Azure ML deployments.
- **Azure Machine Learning Model Management Service** — Registers and versions models that can be deployed as web services.

## FAQ

### Why is there no official OpenAPI spec for Azure ML Web Services Management Client?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure ML Web Services Management Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure ML Web Services Management Client use?

The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from your Jentic One instance and injected at call time so the agent never sees the raw client secret.

### How do I retrieve the access keys for a deployed Azure ML web service?

POST to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearning/webServices/{webServiceName}/listKeys. The response contains both primary and secondary keys, which you can rotate by updating consumers and then regenerating one key at a time.

### What are the rate limits for the Azure ML Web Services Management Client?

The spec does not declare per-API limits; calls are throttled by Azure Resource Manager's per-subscription budget for read and write operations on Microsoft.MachineLearning. Honour the Retry-After header on HTTP 429 before retrying.

### How do I deploy a new ML web service through Jentic?

Search Jentic for 'deploy an azure ml web service', load the schema for PUT /webServices/{webServiceName}, supply your package payload, and execute. Jentic injects the Azure AD bearer token automatically so the agent only handles the deployment payload.

### Is the Azure ML Web Services API free?

Control plane calls are free. The deployed web services bill against either pay-as-you-go transactions and compute or against an attached Azure ML commitment plan; both are charged at standard Azure ML rates.

### Can I limit what my agent is allowed to do with the Azure ML Web Services Management Client API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and the web service id travels in the URL path, so a rule can pin the agent to a single web service. You choose the exact operations it may call, so you can grant read-only access such as getting a web service and calling listKeys while excluding destructive ones like deleting or patching a web service unless you add them. The stored Azure AD credential is exchanged for a short-lived bearer token at call time and never enters the agent's prompt or logs.