RemediationsClient

Name: RemediationsClient API
Brand: RemediationsClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth224 EndpointsREST

For Agents

Trigger and track Azure Policy remediation tasks that automatically bring non-compliant resources into policy compliance across management groups, subscriptions, and resource groups.

Connect the RemediationsClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the RemediationsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with RemediationsClient API.

Create remediation tasks that re-evaluate non-compliant resources for a specific Azure Policy assignment

List remediation deployments to inspect which resources were touched and whether each fix succeeded

Cancel an in-progress remediation when a policy assignment needs to be rolled back

Scope remediation runs to a management group, subscription, resource group, or single resource

GET STARTED

Start building with RemediationsClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for RemediationsClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for RemediationsClient, keeping it validated and agent-ready. The Azure Policy Insights RemediationsClient API creates and manages remediation tasks that bring non-compliant Azure resources back into compliance with assigned policies. Agents can launch remediations at management group, subscription, resource group, or individual resource scope, list deployments triggered by a remediation, and cancel in-progress remediation jobs. The service operates against the Azure Resource Manager control plane and integrates with Azure Policy assignments to drive bulk drift correction.

Use Cases

Patterns agents use RemediationsClient API for, with concrete tasks.

★ Bulk Policy Compliance Drift Correction

Cloud governance teams use RemediationsClient to fix large numbers of non-compliant Azure resources after a new policy assignment is created. Instead of editing thousands of resources manually, an agent creates a remediation at subscription or management group scope and the service iterates through every non-compliant resource, applying the deployIfNotExists or modify effect defined in the policy. The remediation job reports per-resource success and failure so operators can audit the run.

Create a remediation named tag-cleanup at subscription scope for policy assignment id /subscriptions/abc/providers/Microsoft.Authorization/policyAssignments/require-tags and poll its provisioningState until Succeeded

Targeted Resource-Group Remediation

When a single resource group falls out of compliance after a misconfiguration, an agent can scope a remediation to that resource group only, avoiding side effects elsewhere in the subscription. The PUT operation on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName} accepts a policyAssignmentId and resource discovery mode, letting the agent re-evaluate only resources currently flagged non-compliant.

Submit a PUT remediation named storage-encryption-fix on resource group rg-prod with policyAssignmentId /subscriptions/abc/.../require-storage-encryption and resourceDiscoveryMode set to ReEvaluateCompliance

Audit Trail for Remediation Deployments

Compliance auditors need to see exactly which resources a remediation touched and when. The listDeployments operation returns an ordered list of deployment records for each remediation, including the target resource id, the deployment id, status, and timestamps. Agents can pull this trail to feed compliance reports or trigger alerts when deployment failures exceed a threshold.

List all deployments for remediation tag-cleanup in subscription abc and return the count of deployments where status is Failed

Agent-Driven Compliance Workflow via Jentic

Through Jentic, an autonomous compliance agent can search for the right remediation operation by intent, load the input schema for the PUT remediation call, populate it from a policy assignment, execute the remediation, and then poll the GET endpoint for completion. The Azure OAuth token is handled by Jentic's vault, so the agent never sees the raw client secret. End-to-end remediation orchestration moves from a multi-step Azure SDK integration to a few Jentic search and execute calls.

Search Jentic for remediate non-compliant azure resources, load the PUT remediation schema, execute it for a given policy assignment, then poll the resulting remediation until it reaches a terminal provisioningState

Key Endpoints

24 endpoints — jentic publishes the only available openapi specification for remediationsclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a subscription-scoped remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations

List subscription remediations

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel

Cancel an in-progress remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/listDeployments

List remediation deployments

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a resource-group-scoped remediation

DELETE

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Delete a remediation record

PUT

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a subscription-scoped remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations

List subscription remediations

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel

Cancel an in-progress remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/listDeployments

List remediation deployments

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a resource-group-scoped remediation

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure service principal credentials and OAuth 2.0 tokens are stored encrypted in the Jentic vault. Agents receive scoped bearer tokens for the management.azure.com audience only — the underlying client secret never enters the agent context.

Intent-based discovery

Agents search by intent such as remediate non-compliant azure resources or cancel azure policy remediation, and Jentic returns the matching RemediationsClient operation with its full input schema, so the agent can call the right scope-specific endpoint without browsing Azure docs.

Time to first call

Direct integration: 1-3 days to wire up MSAL, ARM async polling, and per-scope path logic. Through Jentic: under an hour to search, load the schema, and execute a remediation.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure PolicyClient

Defines the policy assignments that RemediationsClient acts on

Use this first to assign or update the policy whose non-compliant resources you then remediate

Complementary

Azure Resource Management Client

ARM control plane for the resources a remediation will modify

Use to inspect or pre-stage the resources that a remediation will touch

Alternative

Azure RunCommandsClient

Run imperative scripts on VMs instead of policy-driven remediation

Choose when fixes need to run inside a VM rather than via ARM resource modification

FAQs

Specific to using RemediationsClient API through Jentic.

Why is there no official OpenAPI spec for RemediationsClient?

Microsoft Azure does not publish a unified OpenAPI specification for the Policy Insights RemediationsClient. Jentic generates and maintains this spec so that AI agents and developers can call RemediationsClient via structured tooling. It is validated against the live Azure Resource Manager API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the RemediationsClient API use?

RemediationsClient uses Azure Active Directory OAuth 2.0 via the azure_auth flow defined in the spec. You acquire a bearer token for the https://management.azure.com/.default scope and pass it as Authorization: Bearer. Through Jentic, the Azure service principal credential is held in the vault and the agent receives a scoped token rather than the raw client secret.

Can I cancel a remediation that has already started with the RemediationsClient API?

Yes. Call POST on /subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel (or the equivalent management-group or resource-group path). The service moves the remediation into a Cancelling state and stops scheduling new deployments, though deployments already in flight will run to completion.

What scopes can a RemediationsClient remediation target?

The API supports four scopes: management group (/providers/Microsoft.Management/managementGroups/{id}/...), subscription (/subscriptions/{subscriptionId}/...), resource group (/subscriptions/{subscriptionId}/resourceGroups/{rg}/...), and individual resource via the same paths with a resource filter. Each scope has its own PUT, GET, DELETE, cancel, and listDeployments endpoints.

What are the rate limits for the RemediationsClient API?

Azure Resource Manager applies subscription-level throttling: roughly 1,200 reads and 1,200 writes per hour per subscription, with per-tenant ceilings on top. Throttled responses return HTTP 429 with a Retry-After header. Long-running remediation creates also count against ARM async operation limits.

How do I trigger a remediation through Jentic?

Search Jentic for remediate non-compliant azure resources, then call client.load on the matching PUT remediation operation to receive its input schema. Populate policyAssignmentId and resourceDiscoveryMode, then call client.execute. Jentic injects the OAuth token and returns the remediation resource so you can poll its provisioningState.