Microsoft Azure AzureStack Azure Bridge Client

What authentication does the AzureStack Azure Bridge Client API use?

The API uses Azure Active Directory OAuth 2.0 declared as azure_auth with the implicit flow against management.azure.com. Tokens are passed as Bearer headers. Through Jentic, the AAD client secret stays in the vault and only short-lived scoped tokens are used by the agent.

Can I register a new Azure Stack stamp with this API?

No. This API manages CustomerSubscription bridge entries under an existing registration; it does not register the Azure Stack stamp itself. Stamp registration is handled by the broader Azure Stack registration provider - this API only attaches tenants to a registration that already exists.

What are the rate limits for the AzureStack Azure Bridge Client API?

Azure Resource Manager applies subscription-level throttling - typically 12,000 read and 1,200 write requests per hour, surfaced via x-ms-ratelimit-remaining headers. The Azure Stack bridge API does not document additional limits beyond ARM.

How do I add a customer subscription through Jentic?

Run pip install jentic, then use the async client to search 'register an Azure Stack customer subscription', load CustomerSubscriptions_CreateOrUpdate, and execute with subscriptionId, resourceGroup, registrationName, customerSubscriptionName, and a body containing the tenant ID.

Can the bridge entries be filtered by tenant?

Server-side filtering is not part of the spec - list every CustomerSubscription under a registration with CustomerSubscriptions_List and filter client-side by the tenantId returned in each entry.

Can I limit what my agent is allowed to do with the Microsoft Azure Stack Bridge API?

Yes. Because you run Jentic One yourself, your own rules decide which CustomerSubscription operations the agent may call, so you can grant read-only listing and lookups while withholding the PUT that creates or overwrites an entry and the DELETE that removes one. Since the registration and customer subscription IDs live in the URL path, a rule can also pin the agent to a single Azure Stack registration's bridge entries and nothing else. The Azure AD credential the agent uses at execution time is scoped the same way, so an operation is available only when you have explicitly allowed it.