Microsoft Azure Azure Log Analytics Query Packs
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentAnalyticsBusiness Intelligenceoauth25 EndpointsREST
For Agents
Manage saved KQL queries inside Azure Log Analytics Query Packs — create, update, delete, list, and search reusable queries that operate against workspaces and Application Insights resources.
Use for: I need to save a KQL query into a Query Pack, List all queries inside a specific Query Pack, Search Query Packs for queries tagged with a solution name, Update the body of an existing saved query
Not supported: Does not execute KQL queries, manage workspaces, or ingest logs — use for storing, organising, and discovering saved queries inside Query Packs only.
Jentic publishes the only available OpenAPI specification for Azure Log Analytics Query Packs, keeping it validated and agent-ready. The Query Packs API manages saved KQL queries inside microsoft.insights/queryPacks containers, letting teams version, organise, and search reusable queries that target Log Analytics workspaces or Application Insights resources. It exposes per-query CRUD plus a search endpoint that filters queries by tag, kind, or related solution. All requests authenticate with Azure AD OAuth 2.0 against Azure Resource Manager.
Install Jentic One Beta
Connect the Azure Log Analytics Query Packs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Log Analytics Query Packs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure Log Analytics Query Packs API.
Save a KQL query into a microsoft.insights/queryPacks container
List every query stored inside a specific Query Pack
Search queries within a Query Pack by tag, related solution, or kind
Update an existing saved query's body, tags, or display name
Delete a saved query from a Query Pack
Retrieve a single query by its queryId for execution
Use Cases
Patterns agents use Azure Log Analytics Query Packs API for, with concrete tasks.
★ Centralised KQL Query Library
Platform teams curate a shared library of KQL queries inside a Query Pack so analysts and incident responders reuse the same logic across workspaces. The PUT on a query inside a pack stores the KQL body alongside tags, a display name, and related solutions, and the search endpoint surfaces matching queries to consumers without duplicating them per workspace.
Save a KQL query named 'Failed sign-ins last 24h' into Query Pack 'qp-security' in resource group 'rg-observability', tagged 'category:identity', with the body 'SigninLogs | where ResultType != 0 | summarize count() by UserPrincipalName'.
Query Discovery via Tag Search
Analysts call the POST search endpoint inside a Query Pack with a body that filters on tags, related solutions, or query kind, and receive only the matching queries. This is faster than enumerating every query in a large pack and supports building UI pickers or chat-driven query selection.
Search Query Pack 'qp-security' for queries tagged 'category:identity' and return their queryId, displayName, and body.
Query Versioning and Cleanup
As detection rules evolve, queries in a pack drift out of date. The PUT on a query is idempotent and replaces the body in place, while DELETE removes obsolete entries. Pair this with a CI workflow that pushes the canonical KQL from a Git repository into the pack on every merge to main.
Update query ID 'fb02-...-9c' in Query Pack 'qp-security' with a new body and bump its tag 'version' from 'v3' to 'v4'.
Agent-Driven Query Retrieval
An AI agent through Jentic can search a Query Pack for the right saved KQL by intent (e.g., 'find failed sign-ins'), retrieve the query body, and pass it to the Log Analytics Query API for execution. Jentic returns the search and get operations with full schemas, so the agent does not have to hardcode KQL.
Search Query Pack 'qp-security' for the first query tagged 'incident:failed-signins', read its body, and return it for downstream execution.
Key Endpoints
5 endpoints — jentic publishes the only available openapi specification for azure log analytics query packs, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}
Save or replace a KQL query in a Query Pack
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}
Retrieve a single saved query
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries
List all queries inside a Query Pack
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/search
Search queries inside a pack by tag or kind
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}
Delete a query from a pack
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}
Save or replace a KQL query in a Query Pack
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}
Retrieve a single saved query
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries
List all queries inside a Query Pack
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/search
Search queries inside a pack by tag or kind
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/{queryId}
Delete a query from a pack
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Your Azure AD service principal credentials are stored once, encrypted, by your own Jentic One instance and injected as a bearer token scoped to management.azure.com at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'search saved KQL queries in an Azure Query Pack' or 'save a KQL query into a pack', and Jentic returns the matching microsoft.insights/queryPacks operation with its input schema so the agent calls the right endpoint without reading the provider docs.
Time to first call
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure Log Analytics Query Packs API through Jentic.
Why is there no official OpenAPI spec for Azure Log Analytics Query Packs?
Microsoft Azure does not publish a single consolidated OpenAPI specification for the microsoft.insights/queryPacks Resource Provider surface. Jentic generates and maintains this spec so that AI agents and developers can call Azure Log Analytics Query Packs via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does this API use?
The API uses Azure Active Directory OAuth 2.0; agents acquire a token for the https://management.azure.com/ resource and pass it as a Bearer token. Jentic stores the service principal credentials in its vault and injects scoped tokens at call time.
Does this API execute KQL queries?
No. Query Packs only store saved query metadata and bodies. To run a query you call the Log Analytics Query API at api.loganalytics.io/v1/workspaces/{workspaceId}/query (data plane) or the Application Insights query endpoint, passing the KQL body retrieved from the pack.
How do I search for queries in a Query Pack through Jentic?
Search Jentic for 'search queries inside a Query Pack', load the resulting POST operation on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/queryPacks/{queryPackName}/queries/search, then execute it with a filter body that names the tags or related solutions you want.
What metadata can I attach to a saved query?
Each query supports displayName, description, body (the KQL), tags as a string-to-array map, related solutions, and related categories. These are returned by the GET on a single query and are used as filters in the search endpoint.
What are the rate limits for this API?
Azure Resource Manager applies subscription-level throttling — typically 12,000 reads and 1,200 writes per hour per subscription. There is no separate per-Query-Pack quota declared in the spec.
GET STARTED