Microsoft Azure Azure Resource Graph Query

Name: Azure Resource Graph Query API
Brand: Azure Resource Graph Query
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureComputeoauth25 EndpointsREST

For Agents

Persist, share, and update named Kusto graph queries as ARM resources so an agent can manage a versioned library of Azure Resource Graph queries.

Install Jentic One Beta

Connect the Azure Resource Graph Query to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Resource Graph Query, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure Resource Graph Query API.

Create or update a named graph query resource with its KQL body, description, and tags

List every graph query in a resource group for the centralised query library

Read a graph query resource to retrieve its current KQL body and metadata

GET STARTED

Start building with Azure Resource Graph Query API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Azure Resource Graph Query API for, with concrete tasks.

★ Build a Versioned Query Library

Persist the KQL queries used by FinOps, security, and platform teams as Microsoft.ResourceGraph/queries resources so they can be discovered through Resource Graph itself and versioned alongside other infrastructure. PUT on /queries/{resourceName} stores the query body, displayName, and description, and tagging supports per-team grouping. The library replaces ad-hoc query strings scattered across runbooks and notebooks.

Create or update a graph query named 'untagged-resources' in resource group 'platform-rg' whose body is 'Resources | where isnull(tags.costCentre) | project id, type, resourceGroup'

Bulk-Update a Saved Query Across Tenants

When the canonical KQL for a tag compliance or FinOps report changes, push the new body to every saved graph query named identically across resource groups. PATCH on /queries/{resourceName} accepts a partial update with the new query body, leaving the resource id and tags intact so dashboards continue to reference the same query. This avoids dashboard breakage when query logic evolves.

Patch the graph query 'untagged-resources' in resource group 'platform-rg' to replace its body with the latest tag compliance KQL

Audit Saved Queries for Stale Logic

List every saved graph query in a resource group, inspect each body, and flag those whose KQL references deprecated resource types or tags. The list endpoint returns each query with its body and tags, so the audit can run end-to-end against the API rather than scraping the portal. Pair with patch to update or delete to retire stale queries in a single sweep.

List every graph query in resource group 'platform-rg' and emit a report flagging any whose body references deprecated resource types

Agent-Driven Query Library Maintenance via Jentic

An AI agent uses Jentic to keep the saved-query library in sync with policy: enumerating queries, checking each body against a canonical KQL set, and patching or deleting drift. The agent searches Jentic for 'list saved azure resource graph queries', loads the schema, and chains the response into per-query patch and delete operations. Azure AD bearer tokens are sourced from the Jentic vault per call.

Search Jentic for 'list saved azure resource graph queries', list every query in resource group 'platform-rg', and patch any whose body diverges from the canonical KQL

Key Endpoints

5 endpoints — jentic publishes the only available openapi specification for azure resource graph query, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

PUT