Microsoft Azure Azure Resource Graph
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth22 EndpointsREST
For Agents
Run KQL queries across every Azure resource in scope using the Microsoft.ResourceGraph resources endpoint and return structured JSON for inventory, FinOps, and policy reporting.
Use for: Query every virtual machine across all my Azure subscriptions, I want to count Azure resources by type and region, Find all storage accounts that are missing a costCentre tag, List all Azure resources tagged environment=prod
Not supported: Does not handle log queries, metric ingestion, or resource provisioning — use for KQL queries over Azure resource inventory only.
Jentic publishes the only available OpenAPI specification for Azure Resource Graph, keeping it validated and agent-ready. Azure Resource Graph runs Kusto Query Language (KQL) queries across every Azure resource a caller has access to, returning structured JSON results. The 2019-04-01 surface exposes the resources query endpoint and the operations listing for the Microsoft.ResourceGraph provider, the foundation for cross-subscription inventory, FinOps, and policy reporting.
Install Jentic One Beta
Connect the Azure Resource Graph to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Resource Graph, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure Resource Graph API.
Run a Kusto query across every Azure subscription a caller has access to
Project specific resource fields like type, location, and tags into a tabular result set
Page large query results using $skipToken returned by the resources endpoint
Filter resources by management group or a list of subscription ids in a single request
Aggregate resource counts by type, region, or tag for inventory dashboards
List the operations exposed by the Microsoft.ResourceGraph provider for RBAC discovery
Use Cases
Patterns agents use Azure Resource Graph API for, with concrete tasks.
★ Cross-Subscription Resource Inventory
Run a single KQL query against the resources endpoint to enumerate every resource type across hundreds of subscriptions in a tenant, returning a paged JSON result. The query body accepts a list of subscriptionIds or a managementGroupId and a Kusto string, and the response includes a $skipToken for paging through large result sets. This replaces fan-out scripts that hit each subscription's Resource Manager list endpoints in turn.
POST a query 'Resources | summarize count() by type | order by count_ desc' across the caller's subscriptions and return the top 10 resource types
Tag Compliance Reporting
Use Resource Graph to find every resource missing a required tag like costCentre or environment so the report can be wired into a remediation workflow. A KQL query like 'Resources | where isnull(tags.costCentre) | project id, type, location, resourceGroup' returns the gap list across subscriptions in seconds. Pair with $skipToken for tenants with thousands of non-compliant resources.
POST the KQL query 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup' and return every untagged resource id
FinOps Cost Allocation by Resource Type
Aggregate resource counts by SKU and region as the input for a FinOps dashboard that ties spend back to deployment patterns. The resources endpoint accepts an aggregation KQL query and returns deterministic JSON, which the dashboard ingests on a schedule. Combined with Azure Cost Management, this gives finance a unit-economics view (cost per VM SKU per region) that pure billing data does not.
POST 'Resources | where type == "microsoft.compute/virtualmachines" | summarize count() by tostring(properties.hardwareProfile.vmSize), location' and return the result
Agent-Driven Cloud Discovery via Jentic
An AI agent uses Jentic to run ad-hoc KQL queries against Azure Resource Graph as part of a broader cloud automation, for example finding candidate workloads for a migration or reservation purchase. The agent searches Jentic for 'query all azure resources', loads the schema, and executes any supplied KQL string. Azure AD bearer tokens are sourced from the Jentic vault per call, so the agent never handles raw secrets.
Search Jentic for 'query all azure resources', execute 'Resources | summarize count() by subscriptionId', and emit the per-subscription resource count
Key Endpoints
2 endpoints — jentic publishes the only available openapi specification for azure resource graph, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/providers/Microsoft.ResourceGraph/resources
Run a KQL query across Azure resources in scope
GET
/providers/Microsoft.ResourceGraph/operations
List Microsoft.ResourceGraph operations
POST
/providers/Microsoft.ResourceGraph/resources
Run a KQL query across Azure resources in scope
GET
/providers/Microsoft.ResourceGraph/operations
List Microsoft.ResourceGraph operations
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD client credentials are stored encrypted in the Jentic vault. A short-lived bearer token scoped to https://management.azure.com/ is fetched per call; raw client secrets and refresh tokens never reach the agent context.
Intent-based discovery
Agents search Jentic by intent (e.g., 'query all azure resources') and receive the Microsoft.ResourceGraph resources operation with its full input schema so the agent supplies the KQL query and subscription scope without browsing the ARM reference.
Time to first call
Direct integration with Microsoft.ResourceGraph: half a day for ARM auth and pagination handling. Through Jentic: under an hour from search to first successful query.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure Resource Graph API through Jentic.
Why is there no official OpenAPI spec for Azure Resource Graph?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Resource Graph via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Azure Resource Graph API use?
The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from the Jentic vault and injected at call time so the agent never sees the raw client secret.
Can I query resources across every subscription in my tenant in one call?
Yes. POST to /providers/Microsoft.ResourceGraph/resources with a body that lists subscriptions or supplies a managementGroupId and a KQL query string. The response is paginated via $skipToken for queries that return more than the per-call result limit.
What are the rate limits for the Azure Resource Graph API?
Resource Graph applies a per-user quota measured in queries per 5 seconds, with the remaining budget returned in the x-ms-user-quota-remaining response header. Throttle locally when the remaining value approaches zero rather than waiting for HTTP 429.
How do I run a KQL query across all my Azure resources through Jentic?
Search Jentic for 'query all azure resources', load the schema for POST /providers/Microsoft.ResourceGraph/resources, supply a body with your subscriptions and KQL string, and execute. Jentic injects the Azure AD bearer token automatically.
Is the Azure Resource Graph API free?
Yes — Resource Graph queries themselves are free. Subject to per-user quota and throttling, you are not billed for the queries; only the underlying Azure resources you read about incur their own usage charges.
GET STARTED