Microsoft Azure Azure Resource Graph
Browse all Azure APIs52
AI ReadinessFoundational (C-)52/100
Agent-ready OpenAPI document · curated by JenticCloud InfrastructureComputeoauth22 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Run KQL queries across every Azure resource in scope using the Microsoft.ResourceGraph resources endpoint and return structured JSON for inventory, FinOps, and policy reporting.
Use for: Query every virtual machine across all my Azure subscriptions, I want to count Azure resources by type and region, Find all storage accounts that are missing a costCentre tag, List all Azure resources tagged environment=prod
Not supported: Does not handle log queries, metric ingestion, or resource provisioning - use for KQL queries over Azure resource inventory only.
Jentic publishes the only available OpenAPI specification for Azure Resource Graph, keeping it validated and agent-ready. Azure Resource Graph runs Kusto Query Language (KQL) queries across every Azure resource a caller has access to, returning structured JSON results. The 2019-04-01 surface exposes the resources query endpoint and the operations listing for the Microsoft.ResourceGraph provider, the foundation for cross-subscription inventory, FinOps, and policy reporting.
Install Jentic One Beta
Connect the Azure Resource Graph to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Resource Graph, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-resource-graph" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-resource-graph" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure Resource Graph API.
Run a Kusto query across every Azure subscription a caller has access to
Project specific resource fields like type, location, and tags into a tabular result set
Page large query results using $skipToken returned by the resources endpoint
Filter resources by management group or a list of subscription ids in a single request
Aggregate resource counts by type, region, or tag for inventory dashboards
List the operations exposed by the Microsoft.ResourceGraph provider for RBAC discovery
Use Cases
Patterns agents use Azure Resource Graph API for, with concrete tasks.
★ Cross-Subscription Resource Inventory
Run a single KQL query against the resources endpoint to enumerate every resource type across hundreds of subscriptions in a tenant, returning a paged JSON result. The query body accepts a list of subscriptionIds or a managementGroupId and a Kusto string, and the response includes a $skipToken for paging through large result sets. This replaces fan-out scripts that hit each subscription's Resource Manager list endpoints in turn.
POST a query 'Resources | summarize count() by type | order by count_ desc' across the caller's subscriptions and return the top 10 resource types
Tag Compliance Reporting
Use Resource Graph to find every resource missing a required tag like costCentre or environment so the report can be wired into a remediation workflow. A KQL query like 'Resources | where isnull(tags.costCentre) | project id, type, location, resourceGroup' returns the gap list across subscriptions in seconds. Pair with $skipToken for tenants with thousands of non-compliant resources.
POST the KQL query 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup' and return every untagged resource id
FinOps Cost Allocation by Resource Type
Aggregate resource counts by SKU and region as the input for a FinOps dashboard that ties spend back to deployment patterns. The resources endpoint accepts an aggregation KQL query and returns deterministic JSON, which the dashboard ingests on a schedule. Combined with Azure Cost Management, this gives finance a unit-economics view (cost per VM SKU per region) that pure billing data does not.
POST 'Resources | where type == "microsoft.compute/virtualmachines" | summarize count() by tostring(properties.hardwareProfile.vmSize), location' and return the result
Agent-Driven Cloud Discovery via Jentic
An AI agent uses Jentic to run ad-hoc KQL queries against Azure Resource Graph as part of a broader cloud automation, for example finding candidate workloads for a migration or reservation purchase. The agent searches Jentic for 'query all azure resources', loads the schema, and executes any supplied KQL string. Azure AD bearer tokens are sourced from your Jentic One instance per call, so the agent never handles raw secrets.
Search Jentic for 'query all azure resources', execute 'Resources | summarize count() by subscriptionId', and emit the per-subscription resource count
Key Endpoints
2 endpoints — jentic publishes the only available openapi specification for azure resource graph, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/providers/Microsoft.ResourceGraph/resources
Run a KQL query across Azure resources in scope
GET
/providers/Microsoft.ResourceGraph/operations
List Microsoft.ResourceGraph operations
POST
/providers/Microsoft.ResourceGraph/resources
Run a KQL query across Azure resources in scope
GET
/providers/Microsoft.ResourceGraph/operations
List Microsoft.ResourceGraph operations
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
Azure Resource Graph
- Foundational (C-)52/100
59
Foundational Compliance59
Developer Experience & Jentic Compatibility35
AI-Readiness & Agent Experience94
Agent Usability35
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
59
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: C+Signals: 4
92%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
42%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
59
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: C+Signals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
38%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
35
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
92%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
50%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
35
Security
Trust, risk posture, and security compliance.
Grade: FSignals: 1
35%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Azure Resource Graph by hand means registering an Azure AD app, minting tokens for https://management.azure.com/, and building your own $skipToken paging loop while respecting the per-user query quota returned in x-ms-user-quota-remaining. Through Jentic you install once, import Azure Resource Graph from the API Directory, store the Azure AD credential once, and your agent calls it.
Permission scoping
This surface exposes only the resources query and an operations listing, both read-only, so limit the agent to the operations it needs, such as running a KQL query over resource inventory. The query itself reads only the subscriptions and management groups the credential already has access to, and no write or delete operation exists on this surface to add.
Credential isolation
Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and exchanged for a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'query all azure resources' or 'count Azure resources by type', and Jentic returns the Microsoft.ResourceGraph resources operation with its input schema so the agent supplies the KQL string and subscription scope without browsing the ARM reference.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure Resource Graph API through Jentic.
Why is there no official OpenAPI spec for Azure Resource Graph?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Resource Graph via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the Azure Resource Graph API use?
The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from your Jentic One instance and injected at call time so the agent never sees the raw client secret.
Can I query resources across every subscription in my tenant in one call?
Yes. POST to /providers/Microsoft.ResourceGraph/resources with a body that lists subscriptions or supplies a managementGroupId and a KQL query string. The response is paginated via $skipToken for queries that return more than the per-call result limit.
What are the rate limits for the Azure Resource Graph API?
Resource Graph applies a per-user quota measured in queries per 5 seconds, with the remaining budget returned in the x-ms-user-quota-remaining response header. Throttle locally when the remaining value approaches zero rather than waiting for HTTP 429.
How do I run a KQL query across all my Azure resources through Jentic?
Search Jentic for 'query all azure resources', load the schema for POST /providers/Microsoft.ResourceGraph/resources, supply a body with your subscriptions and KQL string, and execute. Jentic injects the Azure AD bearer token automatically.
Is the Azure Resource Graph API free?
Yes - Resource Graph queries themselves are free. Subject to per-user quota and throttling, you are not billed for the queries; only the underlying Azure resources you read about incur their own usage charges.
Can I limit what my agent is allowed to do with the Azure Resource Graph API?
Yes. Because Jentic One is self-hosted, you set the rules for which operations and credentials your agent may use, and this surface exposes only two read-only operations: running a KQL query over resource inventory and listing the Microsoft.ResourceGraph operations. You can restrict the agent to just the resources query and withhold anything else, and since no write or delete operation exists here, the agent cannot change or remove any resource. Each query also reads only the subscriptions and management groups your stored Azure AD credential already has access to, so scope is bounded by both your operation rules and the credential's own permissions.
GET STARTED