canonical: https://jentic.com/apis/windows.net/graphrbacmanagementclient

# Windows GraphRbacManagementClient

The Graph RBAC Management Client. The API exposes 56 endpoints secured with oauth2 authentication.

## For AI agents

Programmatically applications_create, applications_list. Covers 56 operations with oauth2 authentication.

## Scope

Does not handle payments, communications, or crm - use for hr and recruiting only.

## Capabilities

- Applications_Create
- Applications_List
- Applications_Get
- Applications_Patch
- Applications_Delete
- Applications_AddOwner
- Applications_RemoveOwner

## Use cases

### HR and Recruiting Operations

Use the GraphRbacManagementClient to perform hr recruiting operations programmatically. The API provides 56 endpoints covering core functionality including applications_create, applications_list, applications_get.

Example prompt: Call POST /{tenantID}/applications to applications_create

### Automated Applications Management

Automate applications operations by combining multiple GraphRbacManagementClient endpoints. Agents can applications_list and then applications_get in a single workflow.

Example prompt: Call GET /{tenantID}/applications to applications_list, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call GraphRbacManagementClient endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle oauth2 tokens manually.

Example prompt: Search Jentic for 'applications_create', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/{tenantID}/applications` | Applications_Create |
| GET | `/{tenantID}/applications` | Applications_List |
| GET | `/{tenantID}/applications/{applicationObjectId}` | Applications_Get |
| PATCH | `/{tenantID}/applications/{applicationObjectId}` | Applications_Patch |
| DELETE | `/{tenantID}/applications/{applicationObjectId}` | Applications_Delete |
| POST | `/{tenantID}/applications/{applicationObjectId}/$links/owners` | Applications_AddOwner |
| DELETE | `/{tenantID}/applications/{applicationObjectId}/$links/owners/{ownerObjectId}` | Applications_RemoveOwner |
| GET | `/{tenantID}/applications/{applicationObjectId}/keyCredentials` | Applications_ListKeyCredentials |

## Key resources

- **Applications** — Operations for applications
- **Deletedapplications** — Operations for deletedApplications
- **Domains** — Operations for domains
- **Getobjectsbyobjectids** — Operations for getObjectsByObjectIds
- **Groups** — Operations for groups

## Why Jentic

- **Setup:** Wiring the GraphRbacManagementClient by hand means running the Azure Active Directory OAuth2 flow against login.microsoftonline.com, targeting graph.windows.net, and threading the tenant id through every path yourself. Through Jentic you install once, import the GraphRbacManagementClient from the API Directory, store the OAuth client once, and your agent calls it.
- **Permission scoping:** GraphRbac puts the tenant and application ids in the URL path (/{tenantID}/applications/{applicationObjectId}), so a rule can pin your agent to reading applications within one tenant. You choose the operations it may call, so destructive ones like application deletion or removing an owner are not included unless you add them.
- **Credential handling:** Your Azure AD OAuth client is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list applications in a tenant' or 'read an application's key credentials', and Jentic returns the matching GraphRbac operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Greenhouse** — Alternative hr recruiting API
- **Lever** — Alternative hr recruiting API
- **Workday** — Complementary hr recruiting API

## FAQ

### What authentication does the GraphRbacManagementClient use?

The GraphRbacManagementClient uses OAuth 2.0 for authorization. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I applications_create with the GraphRbacManagementClient?

Yes. Use the POST /{tenantID}/applications endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the GraphRbacManagementClient?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I applications_create through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'applications_create'. Jentic returns the matching GraphRbacManagementClient operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the GraphRbacManagementClient have?

The GraphRbacManagementClient exposes 56 endpoints covering applications, deletedapplications, domains operations.

### Can I limit what my agent is allowed to do with the GraphRbacManagementClient API?

Yes. Jentic One is self-hosted, so your own rules decide which GraphRbac operations and OAuth credentials the agent may use. Because the tenant and application ids sit in the URL path (/{tenantID}/applications/{applicationObjectId}), you can pin the agent to reading applications within a single tenant, and you choose exactly which operations it may call. Destructive calls such as application deletion or removing an owner stay out of reach unless you explicitly grant them.