What authentication does this API use?

It uses Azure AD OAuth2 against management.azure.com, declared as the azure_auth security scheme. Through Jentic, your service principal credentials sit encrypted in the vault and are exchanged for a scoped bearer token at execution time.

Does this API onboard new servers to Arc?

No. The initial onboarding handshake is performed by the Azure Connected Machine agent on the server itself, which calls into Azure to register. This management API operates on the resulting Microsoft.HybridCompute/machines record. Use POST /subscriptions/.../machines/{name}/reconnect when a known machine has lost its agent connection and needs to refresh.

What are the rate limits?

Standard ARM throttles apply at the subscription level - about 12,000 reads and 1,200 writes per hour per subscription. Bulk extension installs across a large fleet should batch and back off on 429 responses.

How do I install a machine extension on every Arc machine through Jentic?

Run jentic.search('install extension on azure arc machine'), load the MachineExtensions_CreateOrUpdate schema, and execute it for each machine with the extension name and properties. Iterate over the list returned by Machines_ListBySubscription to cover the whole fleet.

Can I limit what my agent is allowed to do with the Azure Hybrid Compute Management API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent can use, and the machine and extension names travel in the URL path (/machines/{name} and /machines/{name}/extensions/{extensionName}), so a rule can pin the agent to listing machines and installing extensions on named Arc machines. You choose the operations it may call, so deleting an Arc machine record or triggering a reconnect is excluded unless you add it. The Azure service principal credentials stay with your instance and are exchanged for a scoped bearer token only at execution time, never entering the agent's prompt or logs.