Microsoft Azure Relay

Name: Relay API
Brand: Relay
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingoauth234 EndpointsREST

Install Jentic One Beta

Connect the Relay to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Relay, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Relay API.

Provision an Azure Relay namespace in a resource group

Create a hybrid connection that bridges on-premises services to cloud clients

Create a WCF relay endpoint to expose a WCF service via Azure

Define authorization rules at namespace, hybrid connection, or WCF relay scope

GET STARTED

Start building with Relay API

Explore with Jentic

View OpenAPI Document

For Agents

Provision Azure Relay namespaces, create hybrid connections and WCF relays, and manage the authorization rules and access keys that clients use to connect.

Use for: Provision a new Azure Relay namespace, Create a hybrid connection inside an Azure Relay namespace, Define a Listen authorization rule on a hybrid connection, Rotate the primary key on a relay authorization rule

Not supported: Does not send messages over the relay, run the on-premises listener, or expose Service Bus queues - use for the Microsoft.Relay control-plane lifecycle of namespaces, hybrid connections, WCF relays, and authorization rules only.

Use Cases

Patterns agents use Relay API for, with concrete tasks.

★ Bridge on-premises services to the cloud

Hybrid Connections in Azure Relay let an on-premises service expose itself to cloud clients without opening inbound firewall ports. The API provisions the namespace, creates the named hybrid connection, and issues the authorization rules and keys the listener and sender each need, so the connection can be set up entirely from automation.

Create namespace 'relay-hybrid-prod' and hybrid connection 'orders-onprem' with a Listen rule for the on-prem listener and a Send rule for the cloud client

Expose legacy WCF services

Workloads that still run WCF services use Azure Relay's WCF relays to expose those endpoints to remote clients without standing up a full VPN. The API supports per-namespace listings, lifecycle CRUD, and per-relay authorization rules so a fleet of WCF relays can be managed alongside the rest of the resource group.

Create a WCF relay 'orders-wcf' inside namespace 'relay-hybrid-prod' and add a Send authorization rule for the cloud client

Access key rotation

Every authorization rule on a relay namespace, hybrid connection, or WCF relay has primary and secondary keys that clients use to connect. The API exposes listKeys and regenerateKeys on each rule so rotations can be staged across the listener and sender without dropping the connection.

Regenerate the secondary key on the 'cloud-sender' authorization rule of hybrid connection 'orders-onprem'

Multi-tenant relay topology

Platform teams provisioning relay capacity for many tenants list namespaces and hybrid connections at subscription and resource-group scope to inventory the topology, then create per-tenant authorization rules with scoped Listen or Send rights so each tenant gets isolated credentials.

List all hybrid connections in namespace 'relay-shared' and create a tenant-specific Listen rule on each one

Agent-driven hybrid connectivity

An AI agent fronting a partner-onboarding portal accepts a partner identifier, provisions a per-partner hybrid connection in a shared relay namespace, mints the listener and sender authorization rules with scoped rights, and returns the connection details. Jentic isolates the AAD client secret so the agent only sees scoped bearer tokens.

Onboard partner X by creating a hybrid connection, Listen and Send rules, and returning the connection string for each side

Key Endpoints

34 endpoints — jentic publishes the only available openapi specification for relay, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Create or update a Relay namespace

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Get a specific Relay namespace

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/hybridConnections/{hybridConnectionName}

Create or update a hybrid connection

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/wcfRelays/{relayName}

Create or update a WCF relay

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}

Create or update a namespace authorization rule

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}/listKeys

List access keys for a namespace authorization rule

POST

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}/regenerateKeys

Regenerate access keys for an authorization rule

POST

/subscriptions/{subscriptionId}/providers/Microsoft.Relay/checkNameAvailability

Check if a namespace name is available

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Create or update a Relay namespace

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}

Get a specific Relay namespace

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/hybridConnections/{hybridConnectionName}

Create or update a hybrid connection

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/wcfRelays/{relayName}

Create or update a WCF relay

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Relay/namespaces/{namespaceName}/authorizationRules/{authorizationRuleName}

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD OAuth 2.0 credential is stored once, encrypted, by your own Jentic One instance and a scoped bearer token is injected at execution time. The client secret and any returned relay keys never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create an azure hybrid connection' or 'rotate a relay authorization key', and Jentic returns the matching operation with its input schema so the agent supplies the namespace, hybrid connection name, and rights without browsing the reference docs.

Time to first call

FAQs

Specific to using Relay API through Jentic.

Why is there no official OpenAPI spec for Relay?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Relay via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Azure Relay Management API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I scope authorization rules to Listen or Send only?

Yes. PUT .../authorizationRules/{authorizationRuleName} accepts a rights array containing Listen, Send, and Manage. Listeners on the on-premises side typically need Listen, while cloud clients are issued a separate Send-only rule, with each rule's keys returned via the listKeys POST endpoint.

What are the rate limits for the Azure Relay Management API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. Namespace create operations are long-running and should be polled with backoff.

How do I create a hybrid connection through Jentic?

Search Jentic for 'create azure hybrid connection', load the schema for PUT .../namespaces/{namespaceName}/hybridConnections/{hybridConnectionName}, then execute with subscriptionId, resourceGroupName, namespaceName, hybridConnectionName, and the requiresClientAuthorization flag. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Azure Relay Management API free?

There is no per-call charge for the management API itself; you pay for the Azure Relay namespace based on the number of listeners and the messages or hours consumed by hybrid connections and WCF relays. Listing and key-management calls are not separately metered.

Can I limit what my agent is allowed to do with the Azure Relay API?

Yes. Because your Jentic One instance is self-hosted, your own rules decide which operations and credentials the agent may use. Since the subscription, resource group, namespace, and resource name all travel in the URL path, a rule can pin the agent to a single namespace and only the operations it needs, such as creating hybrid connections, defining Listen or Send authorization rules, and listing keys. You choose the operations it may call, so destructive ones like deleting a WCF relay or regenerating authorization keys are excluded unless you explicitly add them.

Microsoft Azure Relay

Connect the Relay to your agent

Capabilities

Start building with Relay API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs