Microsoft Azure ExpressRouteCrossConnection REST APIs
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingoauth212 EndpointsREST
For Agents
Manage Azure ExpressRoute cross connections and their peerings, and read the live ARP, route, and route-summary tables from peering devices.
Use for: List all ExpressRoute cross connections in subscription 1111-2222-3333-4444, Get the cross connection named cc-london-1 in resource group network-rg, Update the tags on cross connection cc-london-1 to set environment=prod, Create a peering on cross connection cc-london-1 for AzurePrivatePeering
Not supported: Does not provision ExpressRoute circuits, virtual network gateways, or VNets, and does not establish BGP sessions itself — use only to manage provider-facing cross connections, their peerings, and read the live ARP and route tables on peering devices.
Jentic publishes the only available OpenAPI specification for the Azure ExpressRoute Cross Connection REST APIs, keeping it validated and agent-ready. This API manages ExpressRoute cross connections that providers create on behalf of customers to extend on-premises networks into Azure over a private circuit. It exposes operations to read cross connections, update tags, configure peerings, and inspect the live ARP table, route table, and route table summary on a peering device.
Install Jentic One Beta
Connect the ExpressRouteCrossConnection REST APIs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the ExpressRouteCrossConnection REST APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with ExpressRouteCrossConnection REST APIs.
List ExpressRoute cross connections in a subscription or resource group
Read the configuration of a specific ExpressRoute cross connection
Update tags on an ExpressRoute cross connection
Configure peerings (primary, secondary, Microsoft) on a cross connection
Fetch the currently advertised ARP table for a peering device
Fetch the currently advertised routes table and route table summary for a peering device
Use Cases
Patterns agents use ExpressRouteCrossConnection REST APIs for, with concrete tasks.
★ Provisioning Cross Connections for Customers
Connectivity providers configure ExpressRoute cross connections on behalf of their enterprise customers to land circuits into Azure regions. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName} updates the cross connection definition; the matching list endpoints support inventory automation across many customer subscriptions.
Update cross connection cc-london-1 in resource group network-rg with the production tag and verify the response shows the new tags
Configure Peerings on a Cross Connection
Network engineers configure peerings (typically AzurePrivatePeering or MicrosoftPeering) on a cross connection so that on-premises routers can exchange BGP sessions with Azure. The peerings sub-resource supports list, get, create or update, and delete so engineers can iterate on VLAN ids, ASNs, and IP allocations without recreating the parent cross connection.
Create AzurePrivatePeering on cross connection cc-london-1 with peer ASN 65001 and primary peer subnet 192.168.10.0/30
Diagnose BGP State on a Peering Device
When a peering session misbehaves, NetOps inspect the live ARP table, advertised routes, and routes summary directly from the peering device. POST endpoints under peerings/{peeringName}/arpTables, routeTables, and routeTablesSummary return the current state, which is far more actionable than the static configuration when troubleshooting BGP next-hop or MAC issues.
Fetch the ARP table for peering AzurePrivatePeering on device primary for cross connection cc-london-1 and report any missing neighbour
Agent-Driven Cross Connection Audit
An AI agent running monthly network audits can list every cross connection, read each peering, and pull the live route table summary through Jentic. Intent search returns the cross connection and peering operations with their schemas, while the AAD token used to call ARM is held in the Jentic vault so the agent never sees the service principal secret.
Search Jentic for 'list Azure ExpressRoute cross connections', execute against the production subscription, and emit a report of peering states and route table summaries
Key Endpoints
12 endpoints — jentic publishes the only available openapi specification for the azure expressroute cross connection rest apis, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Network/expressRouteCrossConnections
List cross connections in a subscription
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}
Create or update a cross connection
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}
Update cross connection tags
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName}
Create or update a peering
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName}/arpTables/{devicePath}
Read the live ARP table on a peering device
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName}/routeTablesSummary/{devicePath}
Read the route table summary on a peering device
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Network/expressRouteCrossConnections
List cross connections in a subscription
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}
Create or update a cross connection
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}
Update cross connection tags
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName}
Create or update a peering
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName}/arpTables/{devicePath}
Read the live ARP table on a peering device
POST
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName}/routeTablesSummary/{devicePath}
Read the route table summary on a peering device
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD OAuth 2.0 tokens are minted and rotated inside the Jentic vault (MAXsystem). Service principal client secrets stay encrypted; agents call Microsoft.Network with a short-lived scoped token only.
Intent-based discovery
Agents search by intent (e.g., 'list Azure ExpressRoute cross connections') and Jentic returns the matching ExpressRouteCrossConnections operation with its input schema, so the agent does not have to memorise the long ARM path layout.
Time to first call
Direct ARM integration: 1-3 days for AAD app registration, token acquisition, and async polling of POST table reads. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using ExpressRouteCrossConnection REST APIs through Jentic.
Why is there no official OpenAPI spec for ExpressRouteCrossConnection REST APIs?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call ExpressRouteCrossConnection REST APIs via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the ExpressRoute Cross Connection API use?
The API uses Azure Active Directory OAuth 2.0 bearer tokens (the azure_auth scheme) on management.azure.com. Through Jentic, the AAD service principal secret is stored in the MAXsystem vault and exchanged for a short-lived bearer token per call.
Can I configure a peering on an ExpressRoute cross connection with this API?
Yes. Call PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/expressRouteCrossConnections/{crossConnectionName}/peerings/{peeringName} with the peering body (peer ASN, VLAN id, primary and secondary peer subnets) to create or update peerings such as AzurePrivatePeering.
How do I read the live ARP and routes table for a peering?
Call POST under the peering with arpTables/{devicePath}, routeTables/{devicePath}, or routeTablesSummary/{devicePath}. The devicePath identifies the primary or secondary device; the response is the current advertised state, which is what you want for BGP troubleshooting.
What are the rate limits for the ExpressRoute Cross Connection API?
Azure Resource Manager applies subscription-level throttling. Mutation calls are throttled more strictly than reads; on HTTP 429 back off using the Retry-After header. ARP and routes table reads are POST operations against the device and may take several seconds to return.
How do I audit ExpressRoute cross connections through Jentic?
Run pip install jentic, then search Jentic with 'list Azure ExpressRoute cross connections'. Load ExpressRouteCrossConnections_List, execute against your subscription, and chain into ExpressRouteCrossConnectionPeerings_List for each. Credentials are sourced from the vault on every call.
GET STARTED