iotHubClient

Name: iotHubClient API
Brand: iotHubClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIOTDevice Managementoauth232 EndpointsREST

For Agents

Provision Azure IoT Hubs, manage CA certificates and shared access keys, configure and test message routing, and trigger failover via Azure Resource Manager.

Connect the iotHubClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the iotHubClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with iotHubClient API.

Create or update an Azure IoT Hub in a resource group

Manage CA certificates with verification code generation and verify operations

List shared access keys for an IoT Hub or a single key by keyName

Test routing rules with $testall and $testnew before saving them

GET STARTED

Start building with iotHubClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for iotHubClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for the Azure IoT Hub control plane (2019-07-01-preview), keeping it validated and agent-ready. The Microsoft.Devices/IotHubs resource provider creates and manages IoT Hub instances, their CA certificates, shared access keys, message routing, failover behaviour, and quota usage. It exposes 32 ARM endpoints to provision hubs, manage routing rules with $testall and $testnew dry-run paths, check routing endpoint health, list quota usage, and trigger manual failover.

Use Cases

Patterns agents use iotHubClient API for, with concrete tasks.

★ Standing Up a New IoT Hub Region

Platform teams provision IoT Hubs in new regions by checking name availability, creating the hub with the desired sku and capacity, and listing keys to seed downstream services. The API drives the full lifecycle through ARM, so a Terraform-style script can stand up a region in minutes once quotas are in place.

Check name availability for 'acme-eus2-hub', then PUT a new IoT Hub in resource group 'rg-iot' using the S1 sku and capacity 2.

Routing Rule Validation Before Deploy

Before saving a new IoT Hub routing rule, operators dry-run it against the existing or candidate route set using the $testall and $testnew paths. This catches misconfigured queries that would otherwise drop messages once activated. The dry-run loop runs in seconds and is the safe default for any routing change.

POST a candidate route with condition "$body.tempC > 80" to the $testnew endpoint on iotHub 'acme-hub' and confirm a positive match against a sample message.

Disaster Recovery Failover Drill

Run periodic disaster recovery drills by calling the failover endpoint on a non-production IoT Hub to confirm the paired region promotes correctly. The API exposes failover as a single POST under /IotHubs/{iotHubName}/failover so the drill is a one-line script. Combined with routingEndpointsHealth checks, this becomes a repeatable resilience test.

POST to /subscriptions/{subscriptionId}/resourceGroups/rg-iot/providers/Microsoft.Devices/IotHubs/dr-test-hub/failover and poll for completion.

Quota and Health Inventory

Operators pull /usages by subscription and /IotHubStats and /routingEndpointsHealth per hub to feed capacity and SLA dashboards. The endpoints surface free capacity, daily message counts, and per-endpoint health so capacity planning is data-driven. Refresh runs in seconds for typical estates.

Get IotHubStats for 'acme-hub' and append the dailyMessageCount to a metrics CSV.

Agent-Driven IoT Hub Operations via Jentic

An AI ops agent can provision hubs, rotate keys, and trigger failover through Jentic without holding Azure AD secrets. The agent searches Jentic for 'create an Azure IoT Hub', loads the operation schema, and executes against Microsoft.Devices/IotHubs. Jentic's MAXsystem injects a scoped bearer token for management.azure.com.

Use the Jentic MCP tool azure_iothub_create_hub to provision IoT Hub 'demo-hub' in resource group 'rg-iot' with sku S1 and capacity 1.

Key Endpoints

32 endpoints — jentic publishes the only available openapi specification for the azure iot hub control plane (2019-07-01-preview), keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Devices/IotHubs

List IoT Hubs in the subscription

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{resourceName}

Create or update an IoT Hub

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{iotHubName}/failover

Trigger manual failover to the paired region

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{iotHubName}/routing/routes/$testnew

Test a candidate routing rule

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{resourceName}/IotHubKeys/{keyName}/listkeys

List a single shared access key

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{resourceName}/certificates/{certificateName}

Upload a CA certificate

POST

/subscriptions/{subscriptionId}/providers/Microsoft.Devices/checkNameAvailability

Check if a hub name is available

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Devices/IotHubs

List IoT Hubs in the subscription

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{resourceName}

Create or update an IoT Hub

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{iotHubName}/failover

Trigger manual failover to the paired region

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{iotHubName}/routing/routes/$testnew

Test a candidate routing rule

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/IotHubs/{resourceName}/IotHubKeys/{keyName}/listkeys

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth 2.0 client secrets for management.azure.com are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped bearer tokens — raw client secrets never enter the agent's context.

Intent-based discovery

Agents search Jentic by intent (e.g. 'create an Azure IoT Hub' or 'failover an azure iot hub') and Jentic returns the matching Microsoft.Devices/IotHubs operation with its parameter schema.

Time to first call

Direct IoT Hub RP integration: 2-4 days to wire AAD, walk routing dry-runs, and poll long-running create or failover operations. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure IoT Device Provisioning Service

DPS routes devices into IoT Hubs created by this API.

Use DPS when the next step is zero-touch device onboarding into the hubs you provision here.

Alternative

Azure IoT Central

IoT Central is a SaaS app shell over IoT Hub for users who want a UI rather than raw hub management.

Choose IoT Central when the team needs a managed app experience instead of operating IoT Hub directly.

Complementary

Azure Key Vault

Key Vault stores the connection strings and CA private keys used by IoT Hub workloads.

Use Key Vault when hub credentials must be HSM-backed and rotated under policy.

FAQs

Specific to using iotHubClient API through Jentic.

Why is there no official OpenAPI spec for iotHubClient?

Microsoft does not publish a maintained OpenAPI 3 specification for the Microsoft.Devices/IotHubs control plane. Jentic generates and maintains this spec so that AI agents and developers can call iotHubClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the iotHubClient use?

It uses Azure Active Directory OAuth 2.0 against management.azure.com with the user_impersonation scope, the standard ARM auth. Through Jentic the AAD client secret is held in the Jentic vault (MAXsystem) and a scoped bearer token is injected per call so the agent never sees raw secrets.

Can I dry-run a routing rule before saving it?

Yes. POST a candidate route to .../IotHubs/{iotHubName}/routing/routes/$testnew to evaluate a single new rule against a sample message, or to .../$testall to evaluate the full route set. This is the safe way to validate routing changes before deploy.

What are the rate limits for iotHubClient?

It runs on the Azure Resource Manager plane and inherits ARM throttling — typically 12,000 reads and 1,200 writes per hour per subscription, surfaced via x-ms-ratelimit-remaining-subscription-* headers. The IoT Hub RP itself does not document tighter management-plane limits.

How do I trigger a hub failover through Jentic?

Run pip install jentic, then search Jentic with 'failover an azure iot hub', load the failover operation, and execute with subscriptionId, resourceGroupName, and iotHubName. Jentic returns the operation handle so you can poll completion.

Does this API send messages to or from devices?

No. This is the management plane that creates and configures IoT Hub resources. To send cloud-to-device messages, register devices, or read device twins, use the IoT Hub service-side API at {iot-hub-name}.azure-devices.net instead.