Microsoft Azure iotDpsClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentIOTDevice Managementoauth218 EndpointsREST
For Agents
Provision Azure IoT Device Provisioning Service instances, manage CA certificates and shared access keys, and check provisioning service name availability through Azure Resource Manager.
Use for: I need to provision a new IoT DPS instance, List all provisioning services in my subscription, Upload a CA certificate to my DPS instance, Generate a verification code to prove certificate ownership
Not supported: Does not handle individual device enrolment, attestation runtime, or IoT Hub messaging — use for DPS resource and certificate management on the ARM control plane only.
Jentic publishes the only available OpenAPI specification for the Azure IoT Hub Device Provisioning Service control plane, keeping it validated and agent-ready. The Microsoft.Devices/provisioningServices resource provider creates and manages DPS instances that handle zero-touch IoT device enrolment into IoT Hubs. It exposes 18 ARM endpoints to provision DPS instances, manage CA certificates, generate and verify proof-of-possession codes, list shared access keys, and check name availability before deploy.
Install Jentic One Beta
Connect the iotDpsClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the iotDpsClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with iotDpsClient API.
Create or update an IoT Device Provisioning Service in a resource group
List provisioning services across a subscription or filtered by resource group
Upload and verify a CA certificate via generateVerificationCode and verify operations
List shared access keys for a provisioning service or a specific key by keyName
Check whether a candidate provisioning service name is available before deploy
Poll long-running operations through operationresults/{operationId}
Use Cases
Patterns agents use iotDpsClient API for, with concrete tasks.
★ Zero-Touch Device Onboarding Foundation
Manufacturers stand up a DPS instance per fleet to onboard millions of devices into IoT Hubs without per-device manual configuration. The API drives the full provisioning service lifecycle through ARM, including CA certificate upload and proof-of-possession verification, so device-side X.509 attestation works end-to-end. Setup of a new DPS instance with a verified CA is a one-day exercise.
PUT a new provisioning service named 'acme-dps' in resource group 'rg-iot' linked to IoT Hub 'acme-hub' and return the resource id.
CA Certificate Lifecycle Automation
Security teams automate CA certificate rotation by uploading the new CA, calling generateVerificationCode, signing the returned nonce with the CA private key, and posting the proof to verify. The API handles the verification handshake natively so rotation can be scripted on a schedule. A rotation cycle takes minutes once the signing tooling is in place.
Upload CA certificate 'newCA' to DPS 'acme-dps', call generateVerificationCode, then POST the signed verification body to the verify endpoint.
Multi-Region DPS Inventory
Operations teams enumerate every provisioning service across a subscription to track regional spread and feed cost and compliance dashboards. Both subscription-scoped and resource-group-scoped listing endpoints are available, so the inventory can pivot by team or environment. Pull is seconds for typical fleets.
List all provisioningServices in the subscription and emit a CSV with name, resourceGroup, and location.
Agent-Driven DPS Operations via Jentic
An AI ops agent can stand up a DPS, attach a CA, and rotate keys through Jentic without holding raw Azure AD credentials. The agent searches Jentic for 'create an Azure DPS instance', loads the operation schema, and executes against Microsoft.Devices/provisioningServices. Jentic's MAXsystem injects a scoped bearer token for management.azure.com.
Use the Jentic MCP tool azure_dps_create_service to provision DPS 'demo-dps' in resource group 'rg-iot' linked to IoT Hub 'demo-hub'.
Key Endpoints
18 endpoints — jentic publishes the only available openapi specification for the azure iot hub device provisioning service control plane, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Devices/provisioningServices
List provisioning services in the subscription
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}
Create or update a provisioning service
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}
Upload a CA certificate
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/generateVerificationCode
Generate a verification code for the certificate
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/verify
Submit the signed verification body
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/listkeys
List shared access keys for the provisioning service
POST
/subscriptions/{subscriptionId}/providers/Microsoft.Devices/checkProvisioningServiceNameAvailability
Check if a provisioning service name is available
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Devices/provisioningServices
List provisioning services in the subscription
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}
Create or update a provisioning service
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}
Upload a CA certificate
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/generateVerificationCode
Generate a verification code for the certificate
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/certificates/{certificateName}/verify
Submit the signed verification body
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{provisioningServiceName}/listkeys
List shared access keys for the provisioning service
POST
/subscriptions/{subscriptionId}/providers/Microsoft.Devices/checkProvisioningServiceNameAvailability
Check if a provisioning service name is available
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD OAuth 2.0 client secrets for management.azure.com are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped bearer tokens — raw client secrets never enter the agent's context.
Intent-based discovery
Agents search Jentic by intent (e.g. 'create an Azure DPS instance') and Jentic returns the matching Microsoft.Devices/provisioningServices operation with its parameter schema, so the agent can call the right endpoint without parsing ARM docs.
Time to first call
Direct DPS RP integration: 2-3 days to wire AAD against the management audience, walk certificate verification, and poll long-running operations. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using iotDpsClient API through Jentic.
Why is there no official OpenAPI spec for iotDpsClient?
Microsoft does not publish a maintained OpenAPI 3 specification for the Microsoft.Devices/provisioningServices control plane. Jentic generates and maintains this spec so that AI agents and developers can call iotDpsClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the iotDpsClient use?
It uses Azure Active Directory OAuth 2.0 against management.azure.com with the user_impersonation scope, the standard ARM auth. Through Jentic the AAD client secret is held in the Jentic vault (MAXsystem) and a scoped bearer token is injected per call so the agent never sees raw secrets.
Can I rotate DPS shared access keys with this API?
You can list keys via .../provisioningServices/{provisioningServiceName}/listkeys and inspect a single key via .../keys/{keyName}/listkeys. To rotate, update the provisioning service resource with a new authorizationPolicies array using PUT on the provisioningServices/{provisioningServiceName} endpoint.
What are the rate limits for iotDpsClient?
It runs on the Azure Resource Manager plane and inherits ARM throttling — typically 12,000 reads and 1,200 writes per hour per subscription, surfaced via x-ms-ratelimit-remaining-subscription-* headers. The DPS RP itself does not document tighter management-plane limits.
How do I provision a new DPS through Jentic?
Run pip install jentic, then search Jentic with 'create an Azure DPS instance', load the create-or-update operation, and execute with subscriptionId, resourceGroupName, provisioningServiceName, location, and a properties object that links to the target IoT Hub. Jentic returns the deployed resource.
Does this API enrol individual devices?
No. This is the management plane that creates and configures DPS instances, certificates, and keys. To create individual enrolment groups and individual enrolments and to register devices, use the DPS service-side API at {service-name}.azure-devices-provisioning.net instead.
GET STARTED