Relay

Name: Relay API
Brand: Relay
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingoauth234 EndpointsREST

For Agents

Provision Azure Relay namespaces, create hybrid connections and WCF relays, and manage the authorization rules and access keys that clients use to connect.

Connect the Relay to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Relay, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Relay API.

Provision an Azure Relay namespace in a resource group

Create a hybrid connection that bridges on-premises services to cloud clients

Create a WCF relay endpoint to expose a WCF service via Azure

Define authorization rules at namespace, hybrid connection, or WCF relay scope

GET STARTED

Start building with Relay API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Relay, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Relay, keeping it validated and agent-ready. The API manages Azure Relay resources under Microsoft.Relay through Azure Resource Manager — namespaces that host the relay endpoints, hybrid connections that bridge on-premises services to cloud clients, and WCF relays that expose legacy WCF services. It also covers the authorization-rule and access-key surface used by clients on each side of the relay.

Use Cases

Patterns agents use Relay API for, with concrete tasks.

★ Bridge on-premises services to the cloud

Hybrid Connections in Azure Relay let an on-premises service expose itself to cloud clients without opening inbound firewall ports. The API provisions the namespace, creates the named hybrid connection, and issues the authorization rules and keys the listener and sender each need, so the connection can be set up entirely from automation.

Create namespace 'relay-hybrid-prod' and hybrid connection 'orders-onprem' with a Listen rule for the on-prem listener and a Send rule for the cloud client

Expose legacy WCF services

Workloads that still run WCF services use Azure Relay's WCF relays to expose those endpoints to remote clients without standing up a full VPN. The API supports per-namespace listings, lifecycle CRUD, and per-relay authorization rules so a fleet of WCF relays can be managed alongside the rest of the resource group.

Create a WCF relay 'orders-wcf' inside namespace 'relay-hybrid-prod' and add a Send authorization rule for the cloud client

Access key rotation

Every authorization rule on a relay namespace, hybrid connection, or WCF relay has primary and secondary keys that clients use to connect. The API exposes listKeys and regenerateKeys on each rule so rotations can be staged across the listener and sender without dropping the connection.

Regenerate the secondary key on the 'cloud-sender' authorization rule of hybrid connection 'orders-onprem'

Multi-tenant relay topology

Platform teams provisioning relay capacity for many tenants list namespaces and hybrid connections at subscription and resource-group scope to inventory the topology, then create per-tenant authorization rules with scoped Listen or Send rights so each tenant gets isolated credentials.

List all hybrid connections in namespace 'relay-shared' and create a tenant-specific Listen rule on each one

Agent-driven hybrid connectivity

An AI agent fronting a partner-onboarding portal accepts a partner identifier, provisions a per-partner hybrid connection in a shared relay namespace, mints the listener and sender authorization rules with scoped rights, and returns the connection details. Jentic isolates the AAD client secret so the agent only sees scoped bearer tokens.

Onboard partner X by creating a hybrid connection, Listen and Send rules, and returning the connection string for each side

Key Endpoints

34 endpoints — jentic publishes the only available openapi specification for relay, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Create or update a Relay namespace

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Get a specific Relay namespace

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/hybridConnections/{hybridConnectionName}

Create or update a hybrid connection

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/wcfRelays/{relayName}

Create or update a WCF relay

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}

Create or update a namespace authorization rule

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}/listKeys

List access keys for a namespace authorization rule

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}/regenerateKeys

Regenerate access keys for an authorization rule

POST

/subscriptions/{subscriptionId}/providers/Microsoft.Relay/checkNameAvailability

Check if a namespace name is available

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Create or update a Relay namespace

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Get a specific Relay namespace

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/hybridConnections/{hybridConnectionName}

Create or update a hybrid connection

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/wcfRelays/{relayName}

Create or update a WCF relay

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth 2.0 client credentials are stored encrypted in the Jentic vault. Agents receive a scoped bearer token at execute time; client secrets and the relay primary/secondary keys never linger in the agent's context.

Intent-based discovery

Agents search by intent (e.g., 'create azure hybrid connection') and Jentic returns the matching create operation with subscriptionId, resourceGroupName, namespace, and hybrid-connection parameters resolved from the spec.

Time to first call

Direct integration with the Microsoft.Relay management API, including AAD setup and authorization-rule wiring, typically takes 1-2 days. Through Jentic: under 1 hour to first successful namespace and hybrid connection creation.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Service Bus Management Client

Manages Service Bus messaging entities that often pair with Relay for reliable async patterns

Pick this when the workload needs durable queueing or pub/sub rather than synchronous request/response bridging.

Complementary

Event Hub 2018 Preview Management Client

Manages high-throughput event ingestion that complements Relay for streaming workloads

Pick this when the workload is high-volume telemetry ingestion rather than synchronous service relay.

Alternative

Notification Hubs Management Client

Push messaging service for fan-out to mobile clients rather than service-to-service bridging

Pick this when the workload is sending push notifications to many devices rather than relaying service calls.

FAQs

Specific to using Relay API through Jentic.

Why is there no official OpenAPI spec for Relay?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Relay via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Azure Relay Management API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I scope authorization rules to Listen or Send only?

Yes. PUT .../authorizationRules/{authorizationRuleName} accepts a rights array containing Listen, Send, and Manage. Listeners on the on-premises side typically need Listen, while cloud clients are issued a separate Send-only rule, with each rule's keys returned via the listKeys POST endpoint.

What are the rate limits for the Azure Relay Management API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. Namespace create operations are long-running and should be polled with backoff.

How do I create a hybrid connection through Jentic?

Search Jentic for 'create azure hybrid connection', load the schema for PUT .../namespaces/{namespaceName}/hybridConnections/{hybridConnectionName}, then execute with subscriptionId, resourceGroupName, namespaceName, hybridConnectionName, and the requiresClientAuthorization flag. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Azure Relay Management API free?

There is no per-call charge for the management API itself; you pay for the Azure Relay namespace based on the number of listeners and the messages or hours consumed by hybrid connections and WCF relays. Listing and key-management calls are not separately metered.