For Agents
Manage CustomerSubscription bridge entries that connect an Azure Stack registration to its parent Azure subscription.
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AzureStack Azure Bridge Client, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
What an agent can do with AzureStack Azure Bridge Client API.
List all CustomerSubscription bridge entries under an Azure Stack registration
Create a CustomerSubscription that links an Azure Stack stamp to an Azure subscription
Retrieve a single CustomerSubscription by name to inspect its tenant and subscription IDs
Delete a CustomerSubscription entry to revoke the bridge between Azure Stack and Azure
GET STARTED
Use for: I need to register a new Azure Stack customer subscription against my registration, List every customer subscription on a given Azure Stack registration, Retrieve a customer subscription by name to verify its tenant ID, Remove a customer subscription that is no longer authorised
Not supported: Does not register Azure Stack stamps, manage marketplace items, or handle public Azure subscriptions — use for CustomerSubscription bridge entries only.
Jentic publishes the only available OpenAPI document for AzureStack Azure Bridge Client, keeping it validated and agent-ready.
Jentic publishes the only available OpenAPI specification for AzureStack Azure Bridge Client, keeping it validated and agent-ready. The Azure Stack Azure Bridge API manages CustomerSubscription resources that link Azure Stack registrations to Azure subscriptions. Operators use it to register, list, and remove the Azure-side bridge entries that allow an on-premises Azure Stack stamp to consume marketplace items, identity, and billing from public Azure.
Operate against the Microsoft.AzureStack ARM resource provider for hybrid registration management
Patterns agents use AzureStack Azure Bridge Client API for, with concrete tasks.
★ Onboard a new tenant to Azure Stack
When an operator onboards a new tenant onto an Azure Stack stamp, they create a CustomerSubscription under the existing registration via PUT on the customerSubscriptions endpoint. This binds the tenant's Azure subscription to the stamp so marketplace items, identity, and billing flow through the bridge. The API replaces console-based registration and is reproducible per tenant.
Call PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName} with the tenant ID and subscription ID
Audit registered customer subscriptions
Compliance teams enumerate the CustomerSubscription entries on every Azure Stack registration to confirm only sanctioned tenants are bridged. CustomerSubscriptions_List returns each entry with its tenant ID so an agent can cross-check against an authoritative tenant directory.
List CustomerSubscriptions on each registration and flag any tenant ID that is not present in the approved tenant list
Revoke a tenant from Azure Stack
When a tenant offboards, an admin removes their CustomerSubscription via DELETE so the stamp no longer accepts requests for that tenant. This is the cleanest way to revoke a bridge without re-registering the entire stamp.
Call DELETE on the CustomerSubscription path for the offboarding tenant
AI agent integration via Jentic
An infrastructure agent uses Jentic to manage Azure Stack bridge entries during automated tenant lifecycle workflows. The agent searches Jentic for 'register an Azure Stack customer subscription', loads the operation schema, and executes with structured input. Jentic mints AAD tokens against management.azure.com so credentials never enter the agent's prompt.
Use Jentic search 'register an Azure Stack customer subscription', load the schema, execute the PUT to add a new tenant
4 endpoints — jentic publishes the only available openapi specification for azurestack azure bridge client, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions
List all customer subscriptions under a registration
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}
Get a customer subscription by name
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}
Create or update a customer subscription
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}
Delete a customer subscription
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions
List all customer subscriptions under a registration
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}
Get a customer subscription by name
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}
Create or update a customer subscription
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}
Delete a customer subscription
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD OAuth 2.0 tokens are minted and rotated inside the Jentic vault. Agents receive scoped, short-lived tokens for management.azure.com — client secrets never enter agent context.
Intent-based discovery
Agents search Jentic by intent, e.g. 'register an Azure Stack customer subscription', and Jentic returns CustomerSubscriptions_CreateOrUpdate with its input schema.
Time to first call
Direct integration: 1-2 days for AAD auth and ARM polling. Through Jentic: under 1 hour — search, load schema, execute.
Alternatives and complements available in the Jentic catalogue.
Azure Resource Management
ARM is the underlying control plane that hosts the Microsoft.AzureStack registrations.
Use Resource Management to manage the parent registration resource group; use the bridge API for the tenant entries inside it.
Azure Deployment Manager
Coordinates staged rollouts of Azure resources that may live behind an Azure Stack bridge.
Pick Deployment Manager for region-by-region rollouts; pick the bridge API for tenant onboarding.
Azure Subscription Client
Manages public Azure subscriptions rather than Azure Stack tenant bridges.
Use the Subscription API for public Azure subscription operations; use the bridge API for hybrid Azure Stack scenarios.
Specific to using AzureStack Azure Bridge Client API through Jentic.
Why is there no official OpenAPI spec for AzureStack Azure Bridge Client?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AzureStack Azure Bridge Client via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the AzureStack Azure Bridge Client API use?
The API uses Azure Active Directory OAuth 2.0 declared as azure_auth with the implicit flow against management.azure.com. Tokens are passed as Bearer headers. Through Jentic, the AAD client secret stays in the vault and only short-lived scoped tokens are used by the agent.
Can I register a new Azure Stack stamp with this API?
No. This API manages CustomerSubscription bridge entries under an existing registration; it does not register the Azure Stack stamp itself. Stamp registration is handled by the broader Azure Stack registration provider — this API only attaches tenants to a registration that already exists.
What are the rate limits for the AzureStack Azure Bridge Client API?
Azure Resource Manager applies subscription-level throttling — typically 12,000 read and 1,200 write requests per hour, surfaced via x-ms-ratelimit-remaining headers. The Azure Stack bridge API does not document additional limits beyond ARM.
How do I add a customer subscription through Jentic?
Run pip install jentic, then use the async client to search 'register an Azure Stack customer subscription', load CustomerSubscriptions_CreateOrUpdate, and execute with subscriptionId, resourceGroup, registrationName, customerSubscriptionName, and a body containing the tenant ID.
Can the bridge entries be filtered by tenant?
Server-side filtering is not part of the spec — list every CustomerSubscription under a registration with CustomerSubscriptions_List and filter client-side by the tenantId returned in each entry.