canonical: https://jentic.com/apis/azure.com/seabreezemanagementclient # Microsoft Azure SeaBreezeManagementClient Jentic publishes the only available OpenAPI specification for SeaBreezeManagementClient, keeping it validated and agent-ready. The Azure Service Fabric Mesh management API provisions and operates serverless container applications composed of services, gateways, networks, secrets, and volumes. Agents declare an application with its services and dependencies, deploy it without managing a cluster, and inspect runtime topology including replicas and code packages. The API is scoped to ARM and reaches the Service Fabric Mesh control plane in any subscription. ## For AI agents Provision and operate Azure Service Fabric Mesh container applications, gateways, networks, secrets, and volumes without managing the underlying cluster. ## Scope Does not orchestrate Kubernetes, manage VM clusters, or build container images - use for Service Fabric Mesh application, network, gateway, secret, and volume management only. ## Capabilities - Declare and deploy a Service Fabric Mesh application with its services and dependencies - Provision gateways that route traffic into mesh applications - Define mesh networks that connect services across applications - Store and rotate secret values consumed by mesh services - Mount and manage persistent volumes for mesh services - Inspect running services, code packages, and replicas inside an application ## Use cases ### Serverless Container Application Deployment Platform teams use SeaBreezeManagementClient to deploy multi-service container applications without provisioning Service Fabric clusters. The application resource holds a list of services, each with code packages, replica counts, and resource requests, and the service composes networks and gateways automatically. Updates flow through ARM PUT calls so deployments fit existing IaC pipelines. Example prompt: PUT /subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.ServiceFabricMesh/applications/{appName} with services definition and poll provisioning until Succeeded ### Mesh Networking and Gateway Configuration When two mesh applications need to talk, operators define a network resource and attach gateway configurations to expose specific services externally. The networks endpoint manages the address spaces and the gateways endpoint binds protocols and ports to backing services. The two together replace the manual load balancer and VNet wiring that traditional Service Fabric clusters require. Example prompt: PUT a gateway named storefront-gw that binds HTTP port 80 to backend service storefront in the mesh application ### Secret and Volume Lifecycle for Mesh Workloads Mesh services consume database connection strings, API keys, and persistent volume mounts the same way Kubernetes pods do. The secrets and secretValues endpoints store and rotate sensitive values, and the volumes endpoint manages persistent storage that services mount. Both resource types are ARM-managed so they share the access control and tagging that govern the rest of the mesh application. Example prompt: PUT a new secretValue under secret database-password and PATCH the dependent service so it picks up the new version on next replica restart ### Agent-Driven Mesh Operations via Jentic Through Jentic, a platform agent can search for deploy service fabric mesh app, load the application PUT schema, populate it from a higher-level spec, and execute the deployment with a managed Azure OAuth token. The same flow handles networks, gateways, and secrets so a single agent can own the full mesh lifecycle. Example prompt: Search Jentic for deploy service fabric mesh app, load the application PUT schema, execute it with a two-service definition, then call list services to confirm both are reporting Healthy ## Key endpoints | Method | Path | Description | | --- | --- | --- | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ServiceFabricMesh/applications/{applicationResourceName} | Create or update a mesh application | | GET | /subscriptions/{subscriptionId}/providers/Microsoft.ServiceFabricMesh/applications | List applications in subscription | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ServiceFabricMesh/networks/{networkResourceName} | Create or update a network | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ServiceFabricMesh/gateways/{gatewayResourceName} | Create or update a gateway | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ServiceFabricMesh/secrets/{secretResourceName} | Create or update a secret | | PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ServiceFabricMesh/volumes/{volumeResourceName} | Create or update a volume | ## Key resources - **Applications** — Top-level mesh deployment unit composed of one or more services - **Services** — Individual workloads inside an application; expose code packages, replicas, and replica details - **Networks** — Address spaces connecting services and applications - **Gateways** — Inbound traffic routing into mesh applications - **Secrets** — Secret definitions and secretValue versions consumed by services - **Volumes** — Persistent storage volumes mounted by mesh services ## Why Jentic - **Setup:** Wiring SeaBreezeManagementClient by hand means registering an Azure AD app, running the OAuth2 azure_auth token exchange for the management.azure.com audience, and learning the separate schemas for applications, networks, gateways, secrets, and volumes plus their provisioning polling. Through Jentic you install once, import SeaBreezeManagementClient from the API Directory, store the Azure service principal credential once, and your agent calls it. - **Permission scoping:** SeaBreezeManagementClient puts the resource group and mesh resource name in the URL path (.../applications/{applicationResourceName}, .../secrets/{secretResourceName}), so a rule can pin your agent to one resource group. You choose the operations it may call, so you can allow inspecting running services while withholding secret writes or application deletion unless you add them. - **Credential handling:** Your Azure service principal credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'deploy a Service Fabric Mesh application' or 'expose a mesh service through a gateway', and Jentic returns the matching SeaBreeze operation with its input schema across applications, services, networks, gateways, secrets, and volumes. ## Related APIs - **Azure ContainerServiceClient** — Managed Kubernetes for container workloads instead of Service Fabric Mesh - **Azure ContainerInstanceManagementClient** — Single-container serverless workloads without orchestration - **Azure ResourceManagementClient** — Provisions the resource group and ARM context for mesh resources ## FAQ ### Why is there no official OpenAPI spec for SeaBreezeManagementClient? Microsoft Azure does not publish a unified OpenAPI specification for the Service Fabric Mesh control plane. Jentic generates and maintains this spec so that AI agents and developers can call SeaBreezeManagementClient via structured tooling. It is validated against the live Azure Resource Manager API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does SeaBreezeManagementClient use? It uses Azure Active Directory OAuth 2.0 via the azure_auth flow defined in the spec. Acquire a bearer token for https://management.azure.com/.default and pass it as Authorization: Bearer. Jentic stores the underlying service principal in its vault so the agent only sees a scoped token. ### Can I deploy a multi-service container app with this API? Yes. PUT to .../applications/{applicationResourceName} with a body that lists services, each containing code packages, replica counts, and resource requests. The platform deploys the application without you provisioning a cluster. ### How do I expose a mesh service to the internet? Define a gateway resource with PUT .../gateways/{gatewayResourceName} that maps inbound HTTP or TCP listeners to the backing service. Combine that with a network resource for internal routing. Both resources are ARM-managed so RBAC and tagging are inherited. ### What are the rate limits for the Service Fabric Mesh API? Calls count against Azure Resource Manager subscription throttling, roughly 12,000 reads and 1,200 writes per hour per subscription. The Service Fabric Mesh service itself is in preview, so capacity per region may be lower than other Azure services. ### How do I deploy a mesh application through Jentic? Search Jentic for deploy service fabric mesh app, call client.load on the application PUT operation to receive its input schema, then call client.execute with subscriptionId, resourceGroupName, applicationResourceName, and the services definition. Jentic injects the OAuth token and returns the created application. ### Can I limit what my agent is allowed to do with the SeaBreezeManagementClient API? Yes. Because you run Jentic One yourself, your own rules decide which SeaBreezeManagementClient operations and credentials the agent may use. Since the resource group and mesh resource name sit in the URL path (for example .../applications/{applicationResourceName} and .../secrets/{secretResourceName}), you can pin the agent to a single resource group and pick exactly which operations it may call. For instance, you can allow it to inspect running services and replicas while withholding secret writes, gateway changes, or application deletion until you explicitly add them.