What authentication does the Diagnostics API Client use?

The API uses Azure Active Directory OAuth 2.0 (azure_auth). Calls go to https://management.azure.com/ with a bearer access token obtained from Azure AD. Through Jentic, the Azure credential is held in your Jentic One instance and the agent receives a scoped access token only - the underlying client secret or certificate never enters the agent context.

Can I execute a site analysis against an Azure App Service deployment slot?

Yes. The endpoint POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{siteName}/slots/{slot}/diagnostics/{diagnosticCategory}/analyses/{analysisName}/execute runs a named analysis against a specific deployment slot, which is useful for validating staging slots before swap.

What are the rate limits for the Diagnostics API Client?

Azure Resource Manager applies subscription-scoped throttling, generally documented as 12,000 reads per hour and 1,200 writes per hour per subscription. The Diagnostics API endpoints are read-heavy (GET) plus a few execute (POST) operations and share that envelope. Inspect x-ms-ratelimit-* response headers for remaining quota.

How do I list detector responses for a site through Jentic?

Run pip install jentic, then search for list azure app service detector responses, load the Diagnostics_ListSiteDetectorResponses schema, and execute it with subscriptionId, resourceGroupName, and siteName. The response is the JSON detector collection straight from the Microsoft.Web provider.

Does this API let me change App Service configuration?

No. The Diagnostics API Client is read-and-execute only - it lists detectors, fetches detector responses, and runs named analyses. To modify App Service settings, scaling, or deployment slots, use the separate Web Apps management API on the Microsoft.Web provider.

Can I limit what my agent is allowed to do with the Diagnostics API Client?

Yes. Because you run Jentic One yourself, your own rules decide which Diagnostics operations and credentials the agent may use. Since the subscription, resource group, site, and slot ids all travel in the URL path, you can pin the agent to a single subscription, resource group, and site. The surface is read-and-execute only, so you can allow just the operations you need, such as listing detector categories, fetching detector responses, and executing named site analyses, and leave the rest off.