Microsoft Azure EventGridManagementClient

What authentication does the EventGridManagementClient use?

It uses Azure Active Directory OAuth 2.0 (azure_auth) against https://management.azure.com/. The principal needs at least EventGrid Contributor or Contributor on the target resource group. Through Jentic the underlying client secret stays in your Jentic One instance and the agent only sees a scoped bearer token.

Can I create an event subscription on any Azure resource?

Event Subscriptions can target any Azure resource that emits events through Event Grid (storage accounts, resource groups, custom topics, domains, etc.). PUT on the event subscription endpoint accepts the source resource scope in the URL and the destination (webhook, Azure Function, Service Bus queue, hybrid connection, storage queue) in the body.

What are the rate limits for the EventGridManagementClient?

Standard Azure Resource Manager subscription-scoped throttling applies (broadly 12,000 reads per hour and 1,200 writes per hour). Event Grid itself enforces per-topic publish-rate limits separately on the data plane - confirm topic capacity before designing high-throughput publishers.

How do I subscribe a webhook to topic events through Jentic?

Run pip install jentic, search for create an azure event subscription, load EventSubscriptions_CreateOrUpdate, supply scope (the topic resource ID), eventSubscriptionName, and a destination object with endpointType=WebHook and the webhook URL, then execute. The response is the subscription with its provisioningState.

Does this API publish events to a topic?

No. EventGridManagementClient is a control-plane API for managing topics, domains, and subscriptions. Publishing events is a data-plane operation against the topic endpoint URL using the access key returned by Topics_ListSharedAccessKeys.

Can I limit what my agent is allowed to do with the Microsoft Azure Event Grid Management Client API?

Yes. Because you self-host Jentic One, your own rules decide which Event Grid operations and credentials the agent may use. Since the subscription, resource group, and topic or domain name live in the ARM URL path, you can pin the agent to a single topic or domain, and you choose the exact operations it may call, so destructive ones like Topics_Delete or Domains_RegenerateKey are excluded unless you add them. Your Azure AD client secret and any shared access keys returned by ListSharedAccessKeys stay inside your own instance and never reach the agent's prompt or logs.