Microsoft Azure ExpressRouteCrossConnection REST APIs

What authentication does the ExpressRoute Cross Connection API use?

The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on management.azure.com. Through Jentic, the AAD service principal secret is stored in your Jentic One instance and exchanged for a short-lived bearer token per call.

Can I configure a peering on an ExpressRoute cross connection with this API?

Yes. Call PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName} with the peering body (peer ASN, VLAN id, primary and secondary peer subnets) to create or update peerings such as AzurePrivatePeering.

How do I read the live ARP and routes table for a peering?

Call POST under the peering with arpTables/{devicePath}, routeTables/{devicePath}, or routeTablesSummary/{devicePath}. The devicePath identifies the primary or secondary device; the response is the current advertised state, which is what you want for BGP troubleshooting.

What are the rate limits for the ExpressRoute Cross Connection API?

Azure Resource Manager applies subscription-level throttling. Mutation calls are throttled more strictly than reads; on HTTP 429 back off using the Retry-After header. ARP and routes table reads are POST operations against the device and may take several seconds to return.

How do I audit ExpressRoute cross connections through Jentic?

Run pip install jentic, then search Jentic with 'list Azure ExpressRoute cross connections'. Load ExpressRouteCrossConnections_List, execute against your subscription, and chain into ExpressRouteCrossConnectionPeerings_List for each. Credentials are sourced from the vault on every call.

Can I limit what my agent is allowed to do with the Microsoft Azure ExpressRoute Cross Connection API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. The subscription, resource group, and cross connection name all sit in the ARM URL path, so a rule can pin the agent to a single cross connection and its peerings. You also choose which operations are enabled, so read-only calls like listing cross connections or fetching the ARP and route tables can be allowed while mutating calls such as peering create-or-update and peering delete stay excluded unless you add them.