canonical: https://jentic.com/apis/azure.com/azure-sharedimagegalleryserviceclient

# Microsoft Azure SharedImageGalleryServiceClient

Jentic publishes the only available OpenAPI specification for SharedImageGalleryServiceClient, keeping it validated and agent-ready. The Azure Shared Image Gallery API (now Azure Compute Gallery) lets agents create galleries, register custom VM image and gallery application definitions, and publish versioned image and application artefacts that can be replicated across Azure regions and shared with other subscriptions or tenants. It models galleries, images, image versions, applications, and application versions under the Microsoft.Compute resource provider.

## For AI agents

Create Azure Compute Galleries, define custom VM images and gallery applications, and publish versioned artefacts replicated across regions.

## Scope

Does not provision VMs, build managed images, or manage marketplace images - use for Shared Image Gallery image and application registration and publishing only.

## Capabilities

- Create a Shared Image Gallery in a chosen Azure region
- Define a custom VM image with OS type, hyperVGeneration, and identifier
- Publish a new image version replicated across target regions
- Define a gallery application that wraps an installer or script
- Publish a new gallery application version with target regions and storage account type
- List all galleries in a subscription or resource group
- Inspect every image and version registered under a gallery

## Use cases

### Custom VM Image Distribution

Platform teams build hardened OS images and distribute them to engineering teams across regions through a central gallery. The galleries, images, and image versions endpoints accept the OS type, hyperVGeneration, source managed image ID, and target regions, so an agent can promote a baked image into the gallery and have it replicated automatically.

Example prompt: PUT a galleries/{galleryName}/images/{galleryImageName} resource with osType Windows, then PUT a versions/{galleryImageVersionName} with publishingProfile.targetRegions for westeurope and northeurope

### Gallery Application Catalogue

DevOps teams maintain a catalogue of installer scripts that can be applied on top of any VM at deploy time. The applications and application versions endpoints store the install command, remove command, and the storage location of the package, so an agent can register a new tool or update its version without rebaking VM images.

Example prompt: PUT an applications/{galleryApplicationName} resource with supportedOSType Linux, then PUT a versions/{galleryApplicationVersionName} with publishingProfile.source.fileName and target regions

### Image Inventory and Cleanup

FinOps and platform teams audit gallery contents periodically to find unused image versions and reclaim storage. The list endpoints at gallery, image, and version scope return every artefact with replication state and provisioning state, so an agent can build a report of stale versions older than a chosen date and delete them in bulk.

Example prompt: List galleries, then for each gallery list images and versions, returning galleryName, imageName, versionName, and replicationStatus.aggregatedState

### AI Agent Image Promotion

An agent built on Jentic accepts a request to promote a tested managed image into the gallery for production use. It reads the source managed image, creates the image definition if missing, publishes the new version, sets target regions, and reports back the replication state - without the user opening the Azure portal.

Example prompt: Search Jentic for publish image version to azure shared image gallery, load the schema, and PUT a galleryImageVersion with the source managed image ID and the chosen target regions

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName} | Create or update a Shared Image Gallery |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/images/{galleryImageName} | Define a custom VM image under a gallery |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/images/{galleryImageName}/versions/{galleryImageVersionName} | Publish a new image version with target regions |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/applications/{galleryApplicationName} | Define a gallery application |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/applications/{galleryApplicationName}/versions/{galleryApplicationVersionName} | Publish a new gallery application version |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.Compute/galleries | List all galleries in a subscription |

## Key resources

- **galleries** — Create and inspect Shared Image Galleries (Azure Compute Galleries) at subscription or resource group scope
- **images** — Define custom VM image definitions under a gallery
- **image versions** — Publish replicated versions of an image with target regions and storage account types
- **applications** — Define gallery application definitions that wrap installer scripts or packages
- **application versions** — Publish versions of a gallery application replicated across regions

## Why Jentic

- **Setup:** Wiring the Microsoft.Compute galleries surface by hand means registering an Azure AD app, running the OAuth2 token exchange, and polling the asyncOperation URLs that image-version publishes return while regional replication runs. Through Jentic you install once, import Shared Image Gallery from the API Directory, store the Azure AD service principal credential once, and your agent calls it.
- **Permission scoping:** The gallery puts the subscription, resource group, and gallery name in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/...), so a rule can pin your agent to one gallery and its images and applications. You choose the operations it may call, so destructive ones like deleting an image definition or an image version are not included unless you add them.
- **Credential handling:** Your Azure AD service principal credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context, including when image references carry identity-bound storage URLs.
- **Discovery method:** Agents search Jentic by intent such as 'publish an image version to an Azure Compute Gallery' or 'create a shared image gallery', and Jentic returns the matching Microsoft.Compute galleries operation with its input schema so the agent calls the right endpoint without reading the ARM reference.

## Related APIs

- **Azure Compute Management** — Provisions VMs from gallery image versions
- **Azure Image Builder** — Builds and bakes the managed image that gets pushed into the gallery
- **Amazon EC2 (AMIs)** — AWS Amazon Machine Images (AMIs) for cross-region image distribution

## FAQ

### Why is there no official OpenAPI spec for SharedImageGalleryServiceClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call SharedImageGalleryServiceClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Shared Image Gallery API use?

It uses Azure AD OAuth 2.0 with the implicit flow against https://login.microsoftonline.com/common/oauth2/authorize and the user_impersonation scope. When called through Jentic, your service principal credentials live in your Jentic One instance and the agent receives only a short-lived bearer token scoped to the subscription it is acting on.

### Can I publish a custom VM image with this API?

Yes. PUT a galleries/{galleryName}/images/{galleryImageName} resource to define the image (OS type, identifier, hyperVGeneration), then PUT a versions/{galleryImageVersionName} with the source managed image ID and a publishingProfile.targetRegions list to replicate it across regions.

### How do gallery applications differ from gallery images?

An image version captures a full VM disk; a gallery application packages an installer or script that gets applied on top of any base VM at deploy time. Use applications/{galleryApplicationName}/versions for tools and agents that should be layered onto multiple base images.

### What are the rate limits for this API?

Azure Resource Manager throttles around 12,000 reads and 1,200 writes per hour per principal at subscription scope, surfaced via x-ms-ratelimit-remaining-subscription-reads and x-ms-ratelimit-remaining-subscription-writes. Image version publishes are async - the 202 response includes an asyncOperation URL to poll for replication progress.

### How do I publish an image version through Jentic?

Search Jentic for publish image version to azure shared image gallery, load the schema for PUT /.../galleries/{galleryName}/images/{galleryImageName}/versions/{galleryImageVersionName}, and execute it with the source managed image ID and target regions. The Jentic Python SDK ships the search, load, execute pattern after pip install jentic.

### Can I share a gallery across subscriptions?

Yes - galleries support direct sharing through Azure RBAC role assignments on the gallery resource. Newer API versions add Direct Shared Gallery and Community Gallery flavours; this 2019-07-01 API exposes the core gallery surface with subscription and tenant-level visibility through ARM permissions.

### Can I limit what my agent is allowed to do with the Shared Image Gallery API?

Yes. Because you run Jentic One yourself, your own rules decide which gallery operations and credentials the agent may use. Since the subscription, resource group, and gallery name sit in the URL path, you can pin the agent to a single gallery and its images and applications, and expose only the operations you approve, such as defining an image or publishing an image version. Destructive calls like deleting an image definition or an image version stay out of the agent's reach unless you explicitly add them.