Microsoft Azure Azure Resource Graph Query
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth25 EndpointsREST
For Agents
Persist, share, and update named Kusto graph queries as ARM resources so an agent can manage a versioned library of Azure Resource Graph queries.
Use for: Save a new Resource Graph query as a named ARM resource, List all saved graph queries in a resource group, I want to update the KQL body of a saved graph query, Retrieve a specific saved Resource Graph query by name
Not supported: Does not execute KQL queries, query log data, or manage resource inventory directly — use for managing saved Microsoft.ResourceGraph/queries resources only.
Jentic publishes the only available OpenAPI specification for Azure Resource Graph Query, keeping it validated and agent-ready. The API stores named KQL graph queries as ARM resources under Microsoft.ResourceGraph/queries, so teams can persist, share, and version the queries that drive inventory, FinOps, and policy reports. It supports create-or-update, get, list, patch, and delete on graph query resources scoped to a resource group.
Install Jentic One Beta
Connect the Azure Resource Graph Query to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Resource Graph Query, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure Resource Graph Query API.
Create or update a named graph query resource with its KQL body, description, and tags
List every graph query in a resource group for the centralised query library
Read a graph query resource to retrieve its current KQL body and metadata
Patch a graph query to update its KQL body or description without recreating the resource
Delete a graph query when it is no longer used by any dashboard or pipeline
Tag graph queries with team or category metadata for portfolio reporting
Use Cases
Patterns agents use Azure Resource Graph Query API for, with concrete tasks.
★ Build a Versioned Query Library
Persist the KQL queries used by FinOps, security, and platform teams as Microsoft.ResourceGraph/queries resources so they can be discovered through Resource Graph itself and versioned alongside other infrastructure. PUT on /queries/{resourceName} stores the query body, displayName, and description, and tagging supports per-team grouping. The library replaces ad-hoc query strings scattered across runbooks and notebooks.
Create or update a graph query named 'untagged-resources' in resource group 'platform-rg' whose body is 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup'
Bulk-Update a Saved Query Across Tenants
When the canonical KQL for a tag compliance or FinOps report changes, push the new body to every saved graph query named identically across resource groups. PATCH on /queries/{resourceName} accepts a partial update with the new query body, leaving the resource id and tags intact so dashboards continue to reference the same query. This avoids dashboard breakage when query logic evolves.
Patch the graph query 'untagged-resources' in resource group 'platform-rg' to replace its body with the latest tag compliance KQL
Audit Saved Queries for Stale Logic
List every saved graph query in a resource group, inspect each body, and flag those whose KQL references deprecated resource types or tags. The list endpoint returns each query with its body and tags, so the audit can run end-to-end against the API rather than scraping the portal. Pair with patch to update or delete to retire stale queries in a single sweep.
List every graph query in resource group 'platform-rg' and emit a report flagging any whose body references deprecated resource types
Agent-Driven Query Library Maintenance via Jentic
An AI agent uses Jentic to keep the saved-query library in sync with policy: enumerating queries, checking each body against a canonical KQL set, and patching or deleting drift. The agent searches Jentic for 'list saved azure resource graph queries', loads the schema, and chains the response into per-query patch and delete operations. Azure AD bearer tokens are sourced from the Jentic vault per call.
Search Jentic for 'list saved azure resource graph queries', list every query in resource group 'platform-rg', and patch any whose body diverges from the canonical KQL
Key Endpoints
5 endpoints — jentic publishes the only available openapi specification for azure resource graph query, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Create or update a saved graph query
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Get a saved graph query
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Patch a saved graph query
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Delete a saved graph query
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries
List saved graph queries in a resource group
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Create or update a saved graph query
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Get a saved graph query
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Patch a saved graph query
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName}
Delete a saved graph query
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries
List saved graph queries in a resource group
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD client credentials are stored encrypted in the Jentic vault. A short-lived bearer token scoped to https://management.azure.com/ is fetched per call; raw client secrets and refresh tokens never reach the agent context.
Intent-based discovery
Agents search Jentic by intent (e.g., 'save a kql query as an ARM resource') and receive the matching Microsoft.ResourceGraph queries operation with its full input schema so the agent calls the right endpoint without browsing the ARM reference.
Time to first call
Direct integration with Microsoft.ResourceGraph queries: half a day for ARM auth and CRUD wiring. Through Jentic: under an hour from search to first successful call.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure Resource Graph Query API through Jentic.
Why is there no official OpenAPI spec for Azure Resource Graph Query?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Resource Graph Query via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Azure Resource Graph Query API use?
The API uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope on https://management.azure.com/. Through Jentic, the bearer token is fetched from the Jentic vault and injected at call time so the agent never sees the raw client secret.
Can I save a KQL query as an ARM resource for re-use?
Yes. PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries/{resourceName} with a body that includes the KQL query string and optional displayName, description, and tags. The query is then a first-class Azure resource you can reference by id.
What are the rate limits for the Azure Resource Graph Query API?
The spec does not declare per-API limits; create, read, and patch operations are throttled by Azure Resource Manager's per-subscription budget for write operations on Microsoft.ResourceGraph. On HTTP 429, honour the Retry-After header before retrying.
How do I list every saved graph query in a resource group through Jentic?
Search Jentic for 'list saved azure resource graph queries', load the schema for GET /resourceGroups/{resourceGroupName}/providers/Microsoft.ResourceGraph/queries, and execute it. Jentic injects the Azure AD bearer token automatically; the agent only supplies the subscription id and resource group.
Is the Azure Resource Graph Query API free?
Yes — saving and managing graph query resources is free. The KQL queries themselves are executed via the Resource Graph resources endpoint, which is also free subject to per-user throttling.
GET STARTED