Microsoft Azure RemediationsClient

Name: RemediationsClient API
Brand: RemediationsClient
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth224 Endpoints

Install Jentic One Beta

Connect the RemediationsClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the RemediationsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with RemediationsClient API.

Create remediation tasks that re-evaluate non-compliant resources for a specific Azure Policy assignment

List remediation deployments to inspect which resources were touched and whether each fix succeeded

Cancel an in-progress remediation when a policy assignment needs to be rolled back

GET STARTED

Start building with RemediationsClient API

Explore with Jentic

View OpenAPI Document

For Agents

Trigger and track Azure Policy remediation tasks that automatically bring non-compliant resources into policy compliance across management groups, subscriptions, and resource groups.

Use for: I want to remediate non-compliant resources for an Azure Policy assignment, Find all in-progress remediation tasks in a subscription, Cancel a remediation that is touching the wrong resources, List the deployments triggered by a specific remediation run

Not supported: Does not define policies, evaluate compliance, or run scripts inside VMs - use for executing and tracking Azure Policy remediation tasks only.

Use Cases

Patterns agents use RemediationsClient API for, with concrete tasks.

★ Bulk Policy Compliance Drift Correction

Cloud governance teams use RemediationsClient to fix large numbers of non-compliant Azure resources after a new policy assignment is created. Instead of editing thousands of resources manually, an agent creates a remediation at subscription or management group scope and the service iterates through every non-compliant resource, applying the deployIfNotExists or modify effect defined in the policy. The remediation job reports per-resource success and failure so operators can audit the run.

Create a remediation named tag-cleanup at subscription scope for policy assignment id /subscriptions/abc/providers/Microsoft.Authorization/policyAssignments/require-tags and poll its provisioningState until Succeeded

Targeted Resource-Group Remediation

When a single resource group falls out of compliance after a misconfiguration, an agent can scope a remediation to that resource group only, avoiding side effects elsewhere in the subscription. The PUT operation on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName} accepts a policyAssignmentId and resource discovery mode, letting the agent re-evaluate only resources currently flagged non-compliant.

Submit a PUT remediation named storage-encryption-fix on resource group rg-prod with policyAssignmentId /subscriptions/abc/.../require-storage-encryption and resourceDiscoveryMode set to ReEvaluateCompliance

Audit Trail for Remediation Deployments

Compliance auditors need to see exactly which resources a remediation touched and when. The listDeployments operation returns an ordered list of deployment records for each remediation, including the target resource id, the deployment id, status, and timestamps. Agents can pull this trail to feed compliance reports or trigger alerts when deployment failures exceed a threshold.

List all deployments for remediation tag-cleanup in subscription abc and return the count of deployments where status is Failed

Agent-Driven Compliance Workflow via Jentic

Through Jentic, an autonomous compliance agent can search for the right remediation operation by intent, load the input schema for the PUT remediation call, populate it from a policy assignment, execute the remediation, and then poll the GET endpoint for completion. The Azure OAuth token is handled by Jentic's vault, so the agent never sees the raw client secret. End-to-end remediation orchestration moves from a multi-step Azure SDK integration to a few Jentic search and execute calls.

Search Jentic for remediate non-compliant azure resources, load the PUT remediation schema, execute it for a given policy assignment, then poll the resulting remediation until it reaches a terminal provisioningState

Key Endpoints

24 endpoints — jentic publishes the only available openapi specification for remediationsclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a subscription-scoped remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations

List subscription remediations

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel

Cancel an in-progress remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/listDeployments

List remediation deployments

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a resource-group-scoped remediation

DELETE

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Delete a remediation record

PUT

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a subscription-scoped remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations

List subscription remediations

POST

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel

Cancel an in-progress remediation

GET

/subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/listDeployments

List remediation deployments

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}

Create a resource-group-scoped remediation

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD OAuth 2.0 credential is stored once, encrypted, by your own Jentic One instance and a scoped bearer token for the management.azure.com audience is injected at execution time. The client secret never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'remediate non-compliant azure resources' or 'cancel an azure policy remediation', and Jentic returns the matching scope-specific operation with its input schema so the agent supplies the policy assignment id and resource discovery mode without browsing the reference docs.

Time to first call

FAQs

Specific to using RemediationsClient API through Jentic.

Why is there no official OpenAPI spec for RemediationsClient?

Microsoft Azure does not publish a unified OpenAPI specification for the Policy Insights RemediationsClient. Jentic generates and maintains this spec so that AI agents and developers can call RemediationsClient via structured tooling. It is validated against the live Azure Resource Manager API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the RemediationsClient API use?

RemediationsClient uses Azure Active Directory OAuth 2.0 via the azure_auth flow defined in the spec. You acquire a bearer token for the https://management.azure.com/.default scope and pass it as Authorization: Bearer. Through Jentic, the Azure service principal credential is held in the vault and the agent receives a scoped token rather than the raw client secret.

Can I cancel a remediation that has already started with the RemediationsClient API?

Yes. Call POST on /subscriptions/{subscriptionId}/providers/Microsoft.PolicyInsights/remediations/{remediationName}/cancel (or the equivalent management-group or resource-group path). The service moves the remediation into a Cancelling state and stops scheduling new deployments, though deployments already in flight will run to completion.

What scopes can a RemediationsClient remediation target?

The API supports four scopes: management group (/providers/Microsoft.Management/managementGroups/{id}/...), subscription (/subscriptions/{subscriptionId}/...), resource group (/subscriptions/{subscriptionId}/resourceGroups/{rg}/...), and individual resource via the same paths with a resource filter. Each scope has its own PUT, GET, DELETE, cancel, and listDeployments endpoints.

What are the rate limits for the RemediationsClient API?

Azure Resource Manager applies subscription-level throttling: roughly 1,200 reads and 1,200 writes per hour per subscription, with per-tenant ceilings on top. Throttled responses return HTTP 429 with a Retry-After header. Long-running remediation creates also count against ARM async operation limits.

How do I trigger a remediation through Jentic?

Search Jentic for remediate non-compliant azure resources, then call client.load on the matching PUT remediation operation to receive its input schema. Populate policyAssignmentId and resourceDiscoveryMode, then call client.execute. Jentic injects the OAuth token and returns the remediation resource so you can poll its provisioningState.

Can I limit what my agent is allowed to do with the RemediationsClient API?

Yes. Because you run Jentic One yourself, your own rules decide which RemediationsClient operations and credentials the agent may use. Since the scope and remediation name travel in the URL path (for example /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PolicyInsights/remediations/{remediationName}), a rule can pin the agent to a single subscription or resource group. You can grant only the operations it needs, such as creating a remediation and listing its deployments, while withholding destructive ones like cancelling an in-progress remediation or deleting a remediation record.

Microsoft Azure RemediationsClient

Connect the RemediationsClient to your agent

Capabilities

Start building with RemediationsClient API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs