What authentication does the StreamAnalyticsManagementClient use?

All endpoints require Azure Active Directory OAuth 2.0, declared as the azure_auth security scheme with the user_impersonation scope against https://login.microsoftonline.com. Through Jentic, Azure tokens are held in the vault and injected at call time so the agent never sees the raw bearer token.

Can I test a function before deploying it?

Yes. POST /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.StreamAnalytics/streamingjobs/{jobName}/functions/{functionName}/test runs the function against a supplied sample payload and returns the result, so a pipeline can validate behaviour before promoting the change.

What are the rate limits for the StreamAnalyticsManagementClient?

Calls go through Azure Resource Manager, which throttles writes per subscription (typically 1,200 writes per hour) and reads more generously. Function create-or-update is synchronous on the management plane; the streaming job picks up new function definitions on the next start.

How do I bind an Azure ML model as a function through Jentic?

Run pip install jentic, search Jentic for 'add an azure ml function to stream analytics', call retrieve-default-definition with the ML web service URL, then load the create-or-update function operation and submit the returned definition. Jentic handles the Azure AD token exchange.

Does this API manage Stream Analytics inputs and outputs?

No. This spec covers only functions on a streaming job (UDFs and ML bindings). Inputs, outputs, transformation queries, and the streaming job lifecycle live under separate Microsoft.StreamAnalytics endpoints not included here.

Can I limit what my agent is allowed to do with the Azure Stream Analytics Management Client API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, so you choose whether it can only list and get functions on a streaming job or also create, patch, delete, and test them. Since the subscription, resource group, streaming job, and function names all travel in the URL path, a rule can pin the agent to functions on one job in one resource group. Destructive operations like deleting a function or overwriting it with PUT stay unavailable to the agent unless you explicitly grant them, and your Azure AD OAuth token is injected at call time so the agent never handles it directly.