Microsoft Azure DeviceServices

What authentication does the Windows IoT Device Services API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory. Through Jentic, the AAD client secret or managed identity refresh token is held in the encrypted vault and a short-lived access token is supplied at execute time so the bearer token never appears in the agent's context.

Can I check whether a device service name is available before creating it?

Yes. POST /subscriptions/{subscriptionId}/providers/Microsoft.WindowsIoT/checkDeviceServiceNameAvailability accepts a candidate name and returns whether it is available, plus a reason and message when it is not. Call it before issuing PUT to avoid name-collision errors.

What are the rate limits for the Windows IoT Device Services API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. Provisioning is a long-running operation and should be polled with backoff.

How do I provision a device service through Jentic?

Search Jentic for 'create windows iot device service', load the schema for PUT .../deviceServices/{deviceName}, then execute with your subscriptionId, resourceGroupName, location, and SKU. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Windows IoT Device Services API free?

There is no per-call charge for the management API itself; you pay for the Windows IoT Core Services subscription and consumption based on the SKU you select on the device service resource. Reads against the management plane are not separately metered.

Can I limit what my agent is allowed to do with the Windows IoT Device Services API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. The subscription and resource group travel in the resource path, so you can pin the agent to a single subscription and resource group, and you pick exactly which operations it may call, meaning destructive ones like deleting a device service are excluded unless you add them. That lets you allow name-availability checks and reads while withholding create, update, or delete.