Microsoft Azure iotDpsClient

What authentication does the iotDpsClient use?

It uses Azure Active Directory OAuth 2.0 against management.azure.com with the user_impersonation scope, the standard ARM auth. Through Jentic the AAD client secret is held in the your Jentic One instance and a scoped bearer token is injected per call so the agent never sees raw secrets.

Can I rotate DPS shared access keys with this API?

You can list keys via .../provisioningServices/{provisioningServiceName}/listkeys and inspect a single key via .../keys/{keyName}/listkeys. To rotate, update the provisioning service resource with a new authorizationPolicies array using PUT on the provisioningServices/{provisioningServiceName} endpoint.

What are the rate limits for iotDpsClient?

It runs on the Azure Resource Manager plane and inherits ARM throttling - typically 12,000 reads and 1,200 writes per hour per subscription, surfaced via x-ms-ratelimit-remaining-subscription-* headers. The DPS RP itself does not document tighter management-plane limits.

How do I provision a new DPS through Jentic?

Run pip install jentic, then search Jentic with 'create an Azure DPS instance', load the create-or-update operation, and execute with subscriptionId, resourceGroupName, provisioningServiceName, location, and a properties object that links to the target IoT Hub. Jentic returns the deployed resource.

Does this API enrol individual devices?

No. This is the management plane that creates and configures DPS instances, certificates, and keys. To create individual enrolment groups and individual enrolments and to register devices, use the DPS service-side API at {service-name}.azure-devices-provisioning.net instead.

Can I limit what my agent is allowed to do with the Microsoft Azure IoT DPS API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and this API puts the provisioning service and certificate in the URL path, so you can pin an agent to a single provisioning service. You choose the exact operations it can call, so you might allow it to list provisioning services and read or verify their certificates while withholding listing shared access keys or replacing a certificate. Your Azure AD credential stays with your Jentic One instance and is injected at execution time, never reaching the agent's prompt or logs.