canonical: https://jentic.com/apis/azure.com/deviceservices

# Microsoft Azure DeviceServices

Jentic publishes the only available OpenAPI specification for DeviceServices, keeping it validated and agent-ready. The API manages Windows IoT Device Services under Microsoft.WindowsIoT - the resource type that backs Windows IoT device fleets in Azure. It covers the create, read, update, and delete lifecycle of device service resources at subscription and resource-group scope plus the dedicated name-availability check needed before provisioning.

## For AI agents

Provision, list, update, and delete Windows IoT device services in an Azure subscription, and check device-service name availability before creating a new one.

## Scope

Does not enrol or manage individual IoT devices, deliver firmware updates, or stream telemetry - use for the Microsoft.WindowsIoT device service resource lifecycle only.

## Capabilities

- Provision a Windows IoT device service in a resource group
- List Windows IoT device services at subscription or resource-group scope
- Retrieve a specific device service and inspect its configuration
- Update tags and configuration on an existing device service
- Delete a Windows IoT device service
- Check whether a device service name is available before provisioning

## Use cases

### Windows IoT fleet onboarding

A team standing up a fleet of Windows IoT devices first provisions a Microsoft.WindowsIoT/deviceServices resource that anchors the fleet in Azure. The API lets an automation flow check the desired name, provision the resource in the target region, and tag it with project metadata before devices are enrolled.

Example prompt: Create a Windows IoT device service named 'fleet-prod-eu' in resource group 'iot-rg' in West Europe with project tag 'fleet=prod'

### Self-service name validation

Before a portal lets an operator pick a device service name, it calls the name-availability check. This avoids a failed provisioning call and gives the operator immediate feedback on whether the chosen name is unique within the Microsoft.WindowsIoT namespace.

Example prompt: Check whether the Windows IoT device service name 'fleet-prod-eu' is available and return the conflict reason if it is taken

### Decommissioning idle device services

When a Windows IoT project ends, the device service resource should be decommissioned so it stops accruing capacity. A cleanup job lists device services across the subscription, filters by an end-of-life tag, and deletes the matching resources without manual portal steps.

Example prompt: List device services in the subscription with tag 'lifecycle=eol' and delete each one after confirming the deletion criteria

### Agent-driven IoT provisioning

An AI agent fronting a self-service IoT portal accepts a fleet provisioning request, searches Jentic for the device service create operation, validates the name, and provisions the resource. Jentic isolates the operator's Azure credentials so the agent never sees the underlying client secret.

Example prompt: Provision a device service for the fleet name supplied by the user, falling back to a numbered suffix if the desired name is not available

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.WindowsIoT/deviceServices | List Windows IoT device services in a subscription |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.WindowsIoT/deviceServices | List device services in a resource group |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.WindowsIoT/deviceServices/{deviceName} | Create or update a Windows IoT device service |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.WindowsIoT/deviceServices/{deviceName} | Get a specific device service |
| PATCH | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.WindowsIoT/deviceServices/{deviceName} | Update a device service |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.WindowsIoT/deviceServices/{deviceName} | Delete a device service |
| POST | /subscriptions/{subscriptionId}/providers/Microsoft.WindowsIoT/checkDeviceServiceNameAvailability | Check device service name availability |

## Key resources

- **Services** — Windows IoT device service resources at subscription and resource-group scope
- **Name Availability** — Pre-provisioning check for whether a device service name is available
- **Operations** — List Microsoft.WindowsIoT provider operations

## Why Jentic

- **Setup:** Wiring the Microsoft.WindowsIoT device services API by hand means acquiring Azure AD OAuth 2.0 bearer tokens, assembling the ARM URLs under management.azure.com, and polling the long-running provisioning operation yourself. Through Jentic you install once, import DeviceServices from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The device service id travels in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.WindowsIoT/deviceServices/{deviceName}), so a rule can pin your agent to one subscription and resource group. You choose the operations it may call, so destructive ones like deleting a device service are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected as a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'provision a windows iot device service' or 'check device service name availability', and Jentic returns the matching operation with its resource-group, device-name, location, and SKU input schema so the agent calls the right endpoint without reading the ARM reference.

## Related APIs

- **DevSpacesManagement** — Manages Dev Spaces controllers for Kubernetes-based development
- **DeploymentScriptsClient** — Runs ARM Deployment Scripts that may bootstrap IoT device services
- **DevTestLabsClient** — Provisions DevTest Labs environments rather than Windows IoT fleets

## FAQ

### Why is there no official OpenAPI spec for DeviceServices?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DeviceServices via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Windows IoT Device Services API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory. Through Jentic, the AAD client secret or managed identity refresh token is held in the encrypted vault and a short-lived access token is supplied at execute time so the bearer token never appears in the agent's context.

### Can I check whether a device service name is available before creating it?

Yes. POST /subscriptions/{subscriptionId}/providers/Microsoft.WindowsIoT/checkDeviceServiceNameAvailability accepts a candidate name and returns whether it is available, plus a reason and message when it is not. Call it before issuing PUT to avoid name-collision errors.

### What are the rate limits for the Windows IoT Device Services API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. Provisioning is a long-running operation and should be polled with backoff.

### How do I provision a device service through Jentic?

Search Jentic for 'create windows iot device service', load the schema for PUT .../deviceServices/{deviceName}, then execute with your subscriptionId, resourceGroupName, location, and SKU. The pip install jentic Python SDK uses the async search, load, execute pattern.

### Is the Windows IoT Device Services API free?

There is no per-call charge for the management API itself; you pay for the Windows IoT Core Services subscription and consumption based on the SKU you select on the device service resource. Reads against the management plane are not separately metered.

### Can I limit what my agent is allowed to do with the Windows IoT Device Services API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. The subscription and resource group travel in the resource path, so you can pin the agent to a single subscription and resource group, and you pick exactly which operations it may call, meaning destructive ones like deleting a device service are excluded unless you add them. That lets you allow name-availability checks and reads while withholding create, update, or delete.