canonical: https://jentic.com/apis/azure.com/webapps-api-client

# Microsoft Azure WebApps API Client

The Azure WebApps API Client is the management plane for Azure App Service web apps, function apps, and API apps. It exposes 349 operations across 252 resource paths under the Microsoft.Web/sites provider, covering site lifecycle, deployment slots, configuration, app settings, custom hostnames, SSL bindings, source control, backups, scaling, host name bindings, and diagnostics. Use it to script the full lifecycle of an App Service site, from creation and configuration through to backup, slot swaps, and decommissioning.

## For AI agents

Provision, configure, deploy, and operate Azure App Service web apps, function apps, and deployment slots through the Azure Resource Manager control plane.

## Scope

Does not handle App Service Plans, application code deployment, or in-app database queries - use for App Service site lifecycle and configuration only.

## Capabilities

- Provision App Service web apps, function apps, and API apps in any region under a subscription
- Manage deployment slots and perform slot swaps for blue-green releases
- Configure app settings, connection strings, and runtime configuration without redeploying
- Bind custom hostnames and SSL certificates to a site for production traffic
- Trigger and restore from backups, and inspect backup history per site
- Manage source control integration with GitHub, Bitbucket, and Azure Repos for continuous deployment

## Use cases

### Blue-green releases with slot swaps

Deploy new application versions to a staging deployment slot, run smoke tests, then perform a slot swap into production using the WebApps slot endpoints. The API exposes the full slot lifecycle so an automation runner can promote builds without downtime, and rolls back simply by swapping again.

Example prompt: Swap the staging slot into production for site app-checkout-prod in resource group prod-rg and confirm the long-running operation completes.

### Bulk configuration of App Service apps

Iterate over every web app in a subscription and apply standardised app settings, connection strings, or always-on flags. The list-by-subscription and update-application-settings endpoints make it possible to enforce platform policy across hundreds of sites in a single automation run, instead of clicking through the portal.

Example prompt: List all web apps in resource group prod-rg and update each one to set httpsOnly=true and minTlsVersion=1.2.

### Custom domain and TLS automation

Add a verified custom hostname to an App Service site, attach an uploaded SSL certificate, and turn on HTTPS-only mode. The hostNameBindings and sslStates endpoints let agents take a domain from request to live TLS in a scripted workflow, with verification calls to check DNS readiness before binding.

Example prompt: Bind hostname checkout.example.com to site app-checkout-prod, attach the existing SSL certificate, and set httpsOnly to true.

### Agent-driven App Service operations

Let an AI agent restart hung sites, retrieve diagnostic logs, and check site health through Jentic-mediated calls to the WebApps API. Surface common ops actions as agent tools so on-call engineers can ask the agent to act instead of chasing portal links.

Example prompt: Search Jentic for 'restart azure app service web app', load the operation schema, and execute it for site app-checkout-prod in resource group prod-rg.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/providers/Microsoft.Web/sites | List all web apps in a subscription |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites | List web apps in a resource group |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name} | Get a web app by name |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/applySlotConfig | Apply slot configuration to a site |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/backup | Trigger an on-demand backup |
| POST | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/analyzeCustomHostname | Validate a custom hostname before binding |

## Key resources

- **Sites** — Create, read, update, and delete App Service web/function/API apps
- **Slots** — Manage deployment slots and perform slot swaps
- **Configuration** — Set app settings, connection strings, and site config
- **HostNameBindings** — Bind custom domains to a site
- **SslStates** — Attach and manage SSL/TLS bindings
- **Backups** — Trigger, list, and restore site backups
- **SourceControl** — Configure GitHub, Bitbucket and Azure Repos integration

## Why Jentic

- **Setup:** Managing App Service sites by hand means acquiring Azure Active Directory OAuth 2.0 tokens, targeting the management.azure.com ARM control plane, and finding the right call among hundreds of Microsoft.Web/sites paths while threading subscription, resource group, and site names yourself. Through Jentic you install once, import WebApps API Client from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** This API carries the subscription, resource group, and site name in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}), so a rule can pin your agent to one site or resource group and nothing else. You choose the operations it may call, so anything that deletes a site or swaps a production slot is not included unless you add it.
- **Credential handling:** Your Azure AD token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'back up an Azure web app' or 'get an App Service site configuration', and Jentic returns the matching WebApps operation with its input schema so the agent calls the right endpoint without paging through the full site surface.

## Related APIs

- **App Service Plans API Client** — Manage the App Service plan that hosts web apps
- **App Service Environments API Client** — Manage isolated, single-tenant App Service Environments
- **Deleted Web Apps API Client** — Inspect and restore web apps that have been deleted

## FAQ

### What authentication does the WebApps API Client use?

The API uses Azure Active Directory OAuth 2.0 via the implicit flow scheme `azure_auth`, scoped to user_impersonation against https://management.azure.com. Through Jentic the OAuth token stays in the vault and only short-lived scoped bearer tokens are exposed to the agent.

### Can I swap deployment slots with this API?

Yes. The applySlotConfig and slotsswap operations under /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name} support promoting a staging slot into production as a long-running operation. Poll the returned operation URL until it reports succeeded.

### What are the rate limits for the WebApps API?

The spec does not declare explicit rate limits. Calls go through Azure Resource Manager, which enforces standard ARM throttling per subscription and per region. Read the x-ms-ratelimit-remaining-subscription-reads and -writes headers to track quota.

### How do I list every web app in my subscription through Jentic?

Search Jentic for 'list azure app service web apps', load the schema for GET /subscriptions/{subscriptionId}/providers/Microsoft.Web/sites, and execute it. Install with `pip install jentic` and use the async search/load/execute pattern.

### Can this API deploy my application code?

Indirectly. The API configures source control integration via the sourcecontrols endpoints and manages deployment slots, but it does not push code itself. Code is published via Git, container registry pulls, ZIP deploy, or run-from-package - the WebApps API arranges the configuration around those flows.

### Does this API manage App Service Plans?

No. App Service Plans (the underlying compute SKU and scale unit) are managed by the separate appserviceplans-api-client API. Use this WebApps API for sites and slots, and the App Service Plans API for the plan they run on.

### Can I limit what my agent is allowed to do with the Microsoft Azure WebApps API?

Yes. Because you run Jentic One yourself, your own rules decide which WebApps operations and credentials the agent may use. Since the subscription, resource group, and site name travel in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}), you can pin the agent to a single site or resource group and nothing else. You also choose the exact operations it can call, so destructive actions like deleting a site or swapping a production slot are excluded unless you explicitly add them.