PrivateDnsManagementClient

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingoauth217 EndpointsREST

For Agents

Provision and manage Azure Private DNS zones, link them to virtual networks, and create or update DNS record sets for private name resolution inside Azure.

Connect the PrivateDnsManagementClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PrivateDnsManagementClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with PrivateDnsManagementClient API.

Provision a Private DNS zone in a resource group

Link a Private DNS zone to one or more Azure virtual networks

Create or update DNS record sets of any standard type inside a zone

List record sets in a zone, optionally filtered by record type

GET STARTED

Start building with PrivateDnsManagementClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for PrivateDnsManagementClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for PrivateDnsManagementClient, keeping it validated and agent-ready. The API manages Azure Private DNS zones under Microsoft.Network — the private name resolution surface used to resolve hostnames inside Azure virtual networks without exposing them publicly. It covers the zone lifecycle, virtual network links that bind zones to VNETs, and the full set of record sets (A, AAAA, CNAME, MX, PTR, SOA, SRV, TXT) that hold the records inside each zone.

Use Cases

Patterns agents use PrivateDnsManagementClient API for, with concrete tasks.

★ Private name resolution inside Azure VNETs

Teams that run internal services in Azure need to resolve hostnames privately without exposing them to the public internet. The API provisions a Private DNS zone, links it to the consuming virtual networks, and lets services register A and CNAME records that other workloads in the same VNET can resolve directly.

Create the Private DNS zone 'corp.internal' in resource group 'network-rg' and link it to virtual network 'vnet-prod' with auto-registration enabled

Service discovery via DNS record sets

Microservices in a private VNET often use DNS for service discovery. The API supports the full set of record types (A, AAAA, CNAME, MX, PTR, SRV, TXT) so agents can register endpoints, rotate them on deploy, and remove them on teardown without touching public DNS.

Add an A record 'orders' pointing to 10.20.30.40 in the 'corp.internal' Private DNS zone with a 60-second TTL

VNET link lifecycle management

When a new environment VNET is provisioned, it needs to be linked to existing Private DNS zones so workloads can resolve internal hostnames. When the VNET is decommissioned, those links should be torn down. The API exposes per-link create, get, update, delete, and listing endpoints to manage this lifecycle programmatically.

List all virtual network links on the 'corp.internal' Private DNS zone and delete any pointing to VNETs in resource group 'sandbox-rg'

Agent-driven DNS automation

An AI agent fronting a platform engineering portal accepts service registration requests and creates or updates the matching Private DNS records, links new VNETs to the zone on demand, and cleans up records when services are retired. Jentic isolates the Azure AD client secret so the agent only sees scoped bearer tokens.

Given a service name and target IP, create the A record in the appropriate Private DNS zone and verify the record is resolvable

Key Endpoints

17 endpoints — jentic publishes the only available openapi specification for privatednsmanagementclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}

Create or update a Private DNS zone

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}

Get a specific Private DNS zone

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}

Delete a Private DNS zone

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/ALL

List all record sets in a zone

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}

Create or update a virtual network link

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}

Delete a virtual network link

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Network/privateDnsZones

List all Private DNS zones in a subscription

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}

Create or update a Private DNS zone

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}

Get a specific Private DNS zone

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}

Delete a Private DNS zone

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/ALL

List all record sets in a zone

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth 2.0 client credentials are stored encrypted in the Jentic vault. Agents receive a scoped bearer token at execute time; client secrets and refresh tokens never reach the agent's context.

Intent-based discovery

Agents search by intent (e.g., 'create azure private dns A record') and Jentic returns the matching record-set operation with the zone name, record-type segment, and record body parameters resolved from the spec.

Time to first call

Direct integration with the Microsoft.Network Private DNS API, including AAD setup and VNET-link async polling, typically takes 1-2 days. Through Jentic: under 1 hour to first successful zone or record-set change.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

DNS Management Client

Manages public Azure DNS zones rather than private VNET-scoped zones

Pick this when records need to resolve from the public internet rather than only inside Azure virtual networks.

Complementary

Storage Management Client

Provisions Azure Storage accounts that often need private endpoints anchored in a Private DNS zone

Pick this when the agent also needs to create the storage account whose private endpoint will register an A record in the zone.

Complementary

SQL Management Client

Provisions Azure SQL servers and private endpoints that resolve via Private DNS

Pick this when the agent also provisions Azure SQL resources whose private endpoints land in the zone.

FAQs

Specific to using PrivateDnsManagementClient API through Jentic.

Why is there no official OpenAPI spec for PrivateDnsManagementClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PrivateDnsManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Azure Private DNS Management API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I link a Private DNS zone to multiple virtual networks?

Yes. Each VNET link is its own resource at PUT .../privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}, so you can attach the same zone to many virtual networks and choose per-link whether auto-registration of VM A records is enabled.

What are the rate limits for the Private DNS Management API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. VNET link operations are long-running and should be polled with backoff.

How do I add an A record through Jentic?

Search Jentic for 'create azure private dns A record', load the schema for PUT .../privateDnsZones/{privateZoneName}/A/{relativeRecordSetName}, then execute with subscriptionId, resourceGroupName, the zone name, the relative record name, and the ARecords array. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Private DNS Management API free?

There is no per-call charge for the management API itself; you pay for the Private DNS zones (per zone per month) and DNS queries served by the zone. Reads against the management plane are not separately metered.