What authentication does the BatchManagement API use?

The API uses Azure Active Directory OAuth 2.0 declared as azure_auth with the implicit flow. Tokens are presented as Bearer headers against management.azure.com. Through Jentic, the AAD client secret stays in the vault and the agent only ever sees scoped, short-lived tokens.

Can I submit Batch jobs and tasks with this API?

No. This is the management plane - it provisions Batch accounts, pools, applications, and certificates. Job and task submission happens on the Batch service data plane (batch.<region>.azure.com), which is a separate API.

What are the rate limits for the BatchManagement API?

Azure Resource Manager applies subscription-level throttling, typically 12,000 read and 1,200 write requests per hour, surfaced via x-ms-ratelimit-remaining headers. Batch also has per-region core quotas returned by Location_GetQuotas.

How do I provision a Batch pool through Jentic?

Run pip install jentic, then use the async client to search 'provision an Azure Batch pool', load Pool_Create, and execute with subscriptionId, resourceGroupName, accountName, poolName, and a body specifying the VM size, image, and target node count. Jentic returns the pool resource once provisioning starts.

Can I rotate Batch account keys without downtime?

Yes. The standard pattern is to regenerate the secondary key first via BatchAccount_RegenerateKey, update consumers to use it, then rotate the primary key. Both keys remain valid until each individual rotation completes.

Can I limit what my agent is allowed to do with the Azure Batch Management API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and this API puts the subscription, resource group, Batch account, and pool ids in the URL path, so a rule can pin the agent to one Batch account and its pools. You choose exactly which operations it can call, so read-only work like listing pools or checking quotas via Location_GetQuotas can be allowed while destructive calls such as BatchAccount_RegenerateKey or disabling pool auto-scale are left out. Your Azure AD credential is stored encrypted by your own instance and injected only at execution time, so the agent never sees it directly.