canonical: https://jentic.com/apis/azure.com/azure-stack-azure-bridge

# Microsoft Azure AzureStack Azure Bridge Client

Jentic publishes the only available OpenAPI specification for AzureStack Azure Bridge Client, keeping it validated and agent-ready. The Azure Stack Azure Bridge API manages CustomerSubscription resources that link Azure Stack registrations to Azure subscriptions. Operators use it to register, list, and remove the Azure-side bridge entries that allow an on-premises Azure Stack stamp to consume marketplace items, identity, and billing from public Azure.

## For AI agents

Manage CustomerSubscription bridge entries that connect an Azure Stack registration to its parent Azure subscription.

## Scope

Does not register Azure Stack stamps, manage marketplace items, or handle public Azure subscriptions - use for CustomerSubscription bridge entries only.

## Capabilities

- List all CustomerSubscription bridge entries under an Azure Stack registration
- Create a CustomerSubscription that links an Azure Stack stamp to an Azure subscription
- Retrieve a single CustomerSubscription by name to inspect its tenant and subscription IDs
- Delete a CustomerSubscription entry to revoke the bridge between Azure Stack and Azure
- Operate against the Microsoft.AzureStack ARM resource provider for hybrid registration management

## Use cases

### Onboard a new tenant to Azure Stack

When an operator onboards a new tenant onto an Azure Stack stamp, they create a CustomerSubscription under the existing registration via PUT on the customerSubscriptions endpoint. This binds the tenant's Azure subscription to the stamp so marketplace items, identity, and billing flow through the bridge. The API replaces console-based registration and is reproducible per tenant.

Example prompt: Call PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName} with the tenant ID and subscription ID

### Audit registered customer subscriptions

Compliance teams enumerate the CustomerSubscription entries on every Azure Stack registration to confirm only sanctioned tenants are bridged. CustomerSubscriptions_List returns each entry with its tenant ID so an agent can cross-check against an authoritative tenant directory.

Example prompt: List CustomerSubscriptions on each registration and flag any tenant ID that is not present in the approved tenant list

### Revoke a tenant from Azure Stack

When a tenant offboards, an admin removes their CustomerSubscription via DELETE so the stamp no longer accepts requests for that tenant. This is the cleanest way to revoke a bridge without re-registering the entire stamp.

Example prompt: Call DELETE on the CustomerSubscription path for the offboarding tenant

### AI agent integration via Jentic

An infrastructure agent uses Jentic to manage Azure Stack bridge entries during automated tenant lifecycle workflows. The agent searches Jentic for 'register an Azure Stack customer subscription', loads the operation schema, and executes with structured input. Jentic mints AAD tokens against management.azure.com so credentials never enter the agent's prompt.

Example prompt: Use Jentic search 'register an Azure Stack customer subscription', load the schema, execute the PUT to add a new tenant

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions | List all customer subscriptions under a registration |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName} | Get a customer subscription by name |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName} | Create or update a customer subscription |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName} | Delete a customer subscription |

## Key resources

- **CustomerSubscriptions** — Bridge entries under an Azure Stack registration - supports list, get, create, and delete.

## Why Jentic

- **Setup:** Wiring the AzureStack Azure Bridge Client by hand means standing up Azure AD OAuth2 against the azure_auth flow, targeting the management.azure.com Resource Manager host, and threading subscription, resource group, and registration ids through every Microsoft.AzureStack path yourself. Through Jentic you install once, import the AzureStack Azure Bridge Client from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This API puts the registration and customer subscription ids in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AzureStack/registrations/{registrationName}/customerSubscriptions/{customerSubscriptionName}), so a rule can pin your agent to one registration's bridge entries and nothing else. You choose the operations it may call, so destructive ones like deleting a customer subscription or overwriting one with PUT are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'register an Azure Stack customer subscription' or 'list bridge entries for a registration', and Jentic returns the matching CustomerSubscriptions operation with its input schema so the agent calls the right ARM path without browsing the Microsoft.AzureStack reference.

## Related APIs

- **Azure Resource Management** — ARM is the underlying control plane that hosts the Microsoft.AzureStack registrations.
- **Azure Deployment Manager** — Coordinates staged rollouts of Azure resources that may live behind an Azure Stack bridge.
- **Azure Subscription Client** — Manages public Azure subscriptions rather than Azure Stack tenant bridges.

## FAQ

### Why is there no official OpenAPI spec for AzureStack Azure Bridge Client?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AzureStack Azure Bridge Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the AzureStack Azure Bridge Client API use?

The API uses Azure Active Directory OAuth 2.0 declared as azure_auth with the implicit flow against management.azure.com. Tokens are passed as Bearer headers. Through Jentic, the AAD client secret stays in the vault and only short-lived scoped tokens are used by the agent.

### Can I register a new Azure Stack stamp with this API?

No. This API manages CustomerSubscription bridge entries under an existing registration; it does not register the Azure Stack stamp itself. Stamp registration is handled by the broader Azure Stack registration provider - this API only attaches tenants to a registration that already exists.

### What are the rate limits for the AzureStack Azure Bridge Client API?

Azure Resource Manager applies subscription-level throttling - typically 12,000 read and 1,200 write requests per hour, surfaced via x-ms-ratelimit-remaining headers. The Azure Stack bridge API does not document additional limits beyond ARM.

### How do I add a customer subscription through Jentic?

Run pip install jentic, then use the async client to search 'register an Azure Stack customer subscription', load CustomerSubscriptions_CreateOrUpdate, and execute with subscriptionId, resourceGroup, registrationName, customerSubscriptionName, and a body containing the tenant ID.

### Can the bridge entries be filtered by tenant?

Server-side filtering is not part of the spec - list every CustomerSubscription under a registration with CustomerSubscriptions_List and filter client-side by the tenantId returned in each entry.

### Can I limit what my agent is allowed to do with the Microsoft Azure Stack Bridge API?

Yes. Because you run Jentic One yourself, your own rules decide which CustomerSubscription operations the agent may call, so you can grant read-only listing and lookups while withholding the PUT that creates or overwrites an entry and the DELETE that removes one. Since the registration and customer subscription IDs live in the URL path, a rule can also pin the agent to a single Azure Stack registration's bridge entries and nothing else. The Azure AD credential the agent uses at execution time is scoped the same way, so an operation is available only when you have explicitly allowed it.