iotDpsClient

Name: iotDpsClient API
Brand: iotDpsClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIOTDevice Managementoauth218 EndpointsREST

For Agents

Provision Azure IoT Device Provisioning Service instances, manage CA certificates and shared access keys, and check provisioning service name availability through Azure Resource Manager.

Connect the iotDpsClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the iotDpsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with iotDpsClient API.

Create or update an IoT Device Provisioning Service in a resource group

List provisioning services across a subscription or filtered by resource group

Upload and verify a CA certificate via generateVerificationCode and verify operations

List shared access keys for a provisioning service or a specific key by keyName

GET STARTED

Start building with iotDpsClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for iotDpsClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for the Azure IoT Hub Device Provisioning Service control plane, keeping it validated and agent-ready. The Microsoft.Devices/provisioningServices resource provider creates and manages DPS instances that handle zero-touch IoT device enrolment into IoT Hubs. It exposes 18 ARM endpoints to provision DPS instances, manage CA certificates, generate and verify proof-of-possession codes, list shared access keys, and check name availability before deploy.

Use Cases

Patterns agents use iotDpsClient API for, with concrete tasks.

★ Zero-Touch Device Onboarding Foundation

Manufacturers stand up a DPS instance per fleet to onboard millions of devices into IoT Hubs without per-device manual configuration. The API drives the full provisioning service lifecycle through ARM, including CA certificate upload and proof-of-possession verification, so device-side X.509 attestation works end-to-end. Setup of a new DPS instance with a verified CA is a one-day exercise.

PUT a new provisioning service named 'acme-dps' in resource group 'rg-iot' linked to IoT Hub 'acme-hub' and return the resource id.

CA Certificate Lifecycle Automation

Security teams automate CA certificate rotation by uploading the new CA, calling generateVerificationCode, signing the returned nonce with the CA private key, and posting the proof to verify. The API handles the verification handshake natively so rotation can be scripted on a schedule. A rotation cycle takes minutes once the signing tooling is in place.

Upload CA certificate 'newCA' to DPS 'acme-dps', call generateVerificationCode, then POST the signed verification body to the verify endpoint.

Multi-Region DPS Inventory

Operations teams enumerate every provisioning service across a subscription to track regional spread and feed cost and compliance dashboards. Both subscription-scoped and resource-group-scoped listing endpoints are available, so the inventory can pivot by team or environment. Pull is seconds for typical fleets.

List all provisioningServices in the subscription and emit a CSV with name, resourceGroup, and location.

Agent-Driven DPS Operations via Jentic

An AI ops agent can stand up a DPS, attach a CA, and rotate keys through Jentic without holding raw Azure AD credentials. The agent searches Jentic for 'create an Azure DPS instance', loads the operation schema, and executes against Microsoft.Devices/provisioningServices. Jentic's MAXsystem injects a scoped bearer token for management.azure.com.

Use the Jentic MCP tool azure_dps_create_service to provision DPS 'demo-dps' in resource group 'rg-iot' linked to IoT Hub 'demo-hub'.

Key Endpoints

18 endpoints — jentic publishes the only available openapi specification for the azure iot hub device provisioning service control plane, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Devices/provisioningServices

List provisioning services in the subscription

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}

Create or update a provisioning service

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}

Upload a CA certificate

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/generateVerificationCode

Generate a verification code for the certificate

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/verify

Submit the signed verification body

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/listkeys

List shared access keys for the provisioning service

POST

/subscriptions/{subscriptionId}/providers/Microsoft.Devices/checkProvisioningServiceNameAvailability

Check if a provisioning service name is available

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Devices/provisioningServices

List provisioning services in the subscription

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}

Create or update a provisioning service

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}

Upload a CA certificate

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/generateVerificationCode

Generate a verification code for the certificate

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth 2.0 client secrets for management.azure.com are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped bearer tokens — raw client secrets never enter the agent's context.

Intent-based discovery

Agents search Jentic by intent (e.g. 'create an Azure DPS instance') and Jentic returns the matching Microsoft.Devices/provisioningServices operation with its parameter schema, so the agent can call the right endpoint without parsing ARM docs.

Time to first call

Direct DPS RP integration: 2-3 days to wire AAD against the management audience, walk certificate verification, and poll long-running operations. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure IoT Hub

DPS routes devices into IoT Hubs created by the IoT Hub control plane.

Use IoT Hub when the next step after DPS provisioning is configuring the target hub the devices land in.

Complementary

Azure IoT Central

IoT Central applications can be the target for DPS-onboarded devices.

Use IoT Central when the IoT workload is a SaaS app shell rather than raw IoT Hub messaging.

Complementary

Azure Key Vault

Key Vault stores the CA certificate private keys used in DPS proof-of-possession flows.

Use Key Vault when CA private keys must be HSM-backed during DPS verification.

FAQs

Specific to using iotDpsClient API through Jentic.

Why is there no official OpenAPI spec for iotDpsClient?

Microsoft does not publish a maintained OpenAPI 3 specification for the Microsoft.Devices/provisioningServices control plane. Jentic generates and maintains this spec so that AI agents and developers can call iotDpsClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the iotDpsClient use?

It uses Azure Active Directory OAuth 2.0 against management.azure.com with the user_impersonation scope, the standard ARM auth. Through Jentic the AAD client secret is held in the Jentic vault (MAXsystem) and a scoped bearer token is injected per call so the agent never sees raw secrets.

Can I rotate DPS shared access keys with this API?

You can list keys via .../provisioningServices/{provisioningServiceName}/listkeys and inspect a single key via .../keys/{keyName}/listkeys. To rotate, update the provisioning service resource with a new authorizationPolicies array using PUT on the provisioningServices/{provisioningServiceName} endpoint.

What are the rate limits for iotDpsClient?

It runs on the Azure Resource Manager plane and inherits ARM throttling — typically 12,000 reads and 1,200 writes per hour per subscription, surfaced via x-ms-ratelimit-remaining-subscription-* headers. The DPS RP itself does not document tighter management-plane limits.

How do I provision a new DPS through Jentic?

Run pip install jentic, then search Jentic with 'create an Azure DPS instance', load the create-or-update operation, and execute with subscriptionId, resourceGroupName, provisioningServiceName, location, and a properties object that links to the target IoT Hub. Jentic returns the deployed resource.

Does this API enrol individual devices?

No. This is the management plane that creates and configures DPS instances, certificates, and keys. To create individual enrolment groups and individual enrolments and to register devices, use the DPS service-side API at {service-name}.azure-devices-provisioning.net instead.