canonical: https://jentic.com/apis/azure.com/certificate-registration-provider-api

# Microsoft Azure CertificateRegistrationProvider API Client

Jentic publishes the only available OpenAPI specification for CertificateRegistrationProvider API Client, keeping it validated and agent-ready. The Microsoft.CertificateRegistration resource provider exposes its operations metadata so callers can enumerate the App Service certificate registration capabilities available in their subscription. It is the discovery surface for the App Service Certificate flow used to purchase, validate, and renew SSL certificates managed by Azure.

## For AI agents

Discover the available operations on the Microsoft.CertificateRegistration resource provider used by App Service certificates.

## Scope

Does not purchase certificates, validate domains, or renew SSL bindings - use only to enumerate operations on the Microsoft.CertificateRegistration provider.

## Capabilities

- Enumerate the operations exposed by the Microsoft.CertificateRegistration resource provider
- Discover operation IDs that support App Service certificate purchase and validation flows
- Query the resource provider against the Azure Resource Manager endpoint
- Return operation display names and descriptions for catalogue or documentation generation

## Use cases

### Discover App Service certificate operations

Platform engineers call the operations endpoint to enumerate the capabilities of the Microsoft.CertificateRegistration provider before integrating App Service certificates into their tooling. The response feeds into capability matrices and lets automation decide which certificate-management flows are usable.

Example prompt: Call GET /providers/Microsoft.CertificateRegistration/operations and return the list of operation names plus display strings

### Capability inventory for App Service certificates

Tooling that catalogues Azure capabilities pulls this operations list to decide whether to surface App Service certificate workflows in self-service portals. It also catches gaps when a provider has not been registered in the subscription, prompting an automated registration step.

Example prompt: Call Operations_List, store the response keyed by subscription, and flag subscriptions where the provider returns an empty operation set

### AI agent integration via Jentic

An infrastructure agent uses Jentic to introspect Azure capabilities before attempting any certificate purchase flow. The agent searches Jentic for 'list Azure certificate registration operations', loads the schema, and executes the call. Jentic handles AAD auth so the agent never holds an ARM bearer token directly.

Example prompt: Use Jentic search 'list Azure certificate registration operations' and execute Operations_List against management.azure.com

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /providers/Microsoft.CertificateRegistration/operations | List all operations available on the certificate registration provider |

## Key resources

- **Operations** — Provider-level operations endpoint listing all operations exposed by Microsoft.CertificateRegistration.

## Why Jentic

- **Setup:** Wiring the CertificateRegistrationProvider API Client by hand means configuring Azure AD OAuth2 against management.azure.com and constructing the Microsoft.CertificateRegistration operations path yourself. Through Jentic you install once, import the CertificateRegistrationProvider API Client from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This API exposes a single read operation, GET /providers/Microsoft.CertificateRegistration/operations, that enumerates the provider's available operations, so limit the agent to that operation. It does not purchase or renew certificates, so no write or destructive action is reachable unless you add such operations.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list Azure certificate registration operations', and Jentic returns the Operations_List operation with its input schema so the agent calls the right ARM endpoint without browsing the Microsoft.CertificateRegistration reference.

## Related APIs

- **Azure Certificates API Client** — Manages App Service certificate resources at the subscription and resource group level.
- **Azure App Service Certificate Orders** — Handles purchase and renewal orders for App Service certificates.
- **Azure Key Vault Management** — Manages certificates as Key Vault secrets rather than App Service certificate registrations.

## FAQ

### Why is there no official OpenAPI spec for CertificateRegistrationProvider API Client?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call CertificateRegistrationProvider API Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the CertificateRegistrationProvider API Client use?

The API uses Azure Active Directory OAuth 2.0 declared as azure_auth with the implicit flow against management.azure.com. Tokens are presented as Bearer headers. Through Jentic, the AAD client secret stays in the vault and the agent only ever sees scoped, short-lived tokens.

### Can I purchase an App Service certificate with this API?

No. This client only exposes the operations metadata for Microsoft.CertificateRegistration. Purchase, domain validation, and renewal of App Service certificates are handled by additional operations under the same resource provider that are not part of this spec.

### What are the rate limits for the CertificateRegistrationProvider API Client?

Azure Resource Manager applies subscription-level throttling, typically 12,000 read and 1,200 write requests per hour, surfaced via x-ms-ratelimit-remaining headers. The certificate registration discovery endpoint is read-only and falls under that read budget.

### How do I list certificate registration operations through Jentic?

Run pip install jentic, then use the async client to search 'list Azure certificate registration operations', load Operations_List, and execute. Jentic returns the array of operation names registered on the Microsoft.CertificateRegistration provider.

### How does this differ from the certificates-api-client?

This client is a discovery surface for the App Service certificate registration provider. The certificates-api-client manages App Service certificate resources directly inside a subscription. Use this for capability discovery and the certificates-api-client to read or list provisioned certificates.

### Can I limit what my agent is allowed to do with the Microsoft Azure Certificate Registration API?

Yes. Because Jentic One is self-hosted, you control which operations and credentials your agent may use, and your own rules decide what it can call. This API exposes a single read operation, GET /providers/Microsoft.CertificateRegistration/operations, which enumerates the provider's available operations, so you can restrict the agent to that one call. It cannot purchase, validate, or renew certificates, so no write or destructive action is reachable unless you explicitly add such operations.