# Azure Authorization management API

> Azure Authorization management API on Apizie: 24 endpoints (Gets deny assignments for a resource., Gets deny assignments for a resource group., Gets all deny assignments for the subscription., Get the specified deny assignment., …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:azure-arm-authorization`
- Category: Cloud
- Status: byok
- Source: https://learn.microsoft.com/rest/api/azure/
- Page: https://zieapi.vercel.app/api/cloud/azure-arm-authorization
- OpenAPI: https://zieapi.vercel.app/api/cloud/azure-arm-authorization/openapi.json

Azure Resource Manager API for Authorization: manage these Azure resources in your subscription with a Microsoft Entra access token.

## Endpoints

### Gets deny assignments for a resource.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-list-for-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| subscriptionId | string | yes | The ID of the target subscription. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| resourceProviderNamespace | string | yes | The namespace of the resource provider. |
| parentResourcePath | string | yes | The parent resource identity. |
| resourceType | string | yes | The resource type of the resource. |
| resourceName | string | yes | The name of the resource to get deny assignments for. |
| api-version | string | no | The API version to use for this operation. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use… |

### Gets deny assignments for a resource group.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-list-for-resource-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| subscriptionId | string | yes | The ID of the target subscription. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| api-version | string | no | The API version to use for this operation. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use… |

### Gets all deny assignments for the subscription.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| subscriptionId | string | yes | The ID of the target subscription. |
| api-version | string | no | The API version to use for this operation. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use… |

### Get the specified deny assignment.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| scope | string | yes | The scope of the deny assignment. |
| denyAssignmentId | string | yes | The ID of the deny assignment to get. |
| api-version | string | no | The API version to use for this operation. |

### Gets a deny assignment by ID.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-get-by-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| denyAssignmentId | string | yes | The fully qualified deny assignment ID. For example, use the format,… |
| api-version | string | no | The API version to use for this operation. |

### Gets deny assignments for a scope.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-list-for-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| scope | string | yes | The scope of the deny assignments. |
| api-version | string | no | The API version to use for this operation. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all deny assignments at or above the scope. Use… |

### Gets provider operations metadata for all resource providers.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/provider-operations-metadata-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| $expand | string | no | Specifies whether to expand the values. |

### Gets provider operations metadata for the specified resource provider.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/provider-operations-metadata-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| resourceProviderNamespace | string | yes | The namespace of the resource provider. |
| $expand | string | no | Specifies whether to expand the values. |

### Get a role assignment by ID.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-get-by-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| roleAssignmentId | string | yes | The fully qualified ID of the role assignment including scope, resource name, and resource type. Format:… |
| tenantId | string | no | Tenant ID for cross-tenant request |

### Create or update a role assignment by ID.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-create-by-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| roleAssignmentId | string | yes | The fully qualified ID of the role assignment including scope, resource name, and resource type. Format:… |
| body | object | yes | JSON request body |

### Delete a role assignment by ID.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-delete-by-id` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| roleAssignmentId | string | yes | The fully qualified ID of the role assignment including scope, resource name, and resource type. Format:… |
| tenantId | string | no | Tenant ID for cross-tenant request |

### List all role assignments that apply to a scope.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-list-for-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The fully qualified Azure Resource manager identifier of the resource. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId… |
| tenantId | string | no | Tenant ID for cross-tenant request |
| $skipToken | string | no | The skipToken to apply on the operation. Use $skipToken={skiptoken} to return paged role assignments following the skipToken passed. Only… |

### Get a role assignment by scope and name.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The fully qualified Azure Resource manager identifier of the resource. |
| tenantId | string | no | Tenant ID for cross-tenant request |
| roleAssignmentName | string | yes | The name of the role assignment. It can be any valid GUID. |

### Create or update a role assignment by scope and name.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The fully qualified Azure Resource manager identifier of the resource. |
| roleAssignmentName | string | yes | The name of the role assignment. It can be any valid GUID. |
| body | object | yes | JSON request body |

### Delete a role assignment by scope and name.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The fully qualified Azure Resource manager identifier of the resource. |
| tenantId | string | no | Tenant ID for cross-tenant request |
| roleAssignmentName | string | yes | The name of the role assignment. It can be any valid GUID. |

### List all role assignments that apply to a subscription.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-list-for-subscription` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId… |
| tenantId | string | no | Tenant ID for cross-tenant request |

### List all role assignments that apply to a resource.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-list-for-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| resourceProviderNamespace | string | yes | The namespace of the resource provider. |
| resourceType | string | yes | The resource type of the resource. |
| resourceName | string | yes | The name of the resource to get role assignments for. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId… |
| tenantId | string | no | Tenant ID for cross-tenant request |

### List all role assignments that apply to a resource group.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-assignments-list-for-resource-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. The value must be an UUID. |
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId… |
| tenantId | string | no | Tenant ID for cross-tenant request |

### Gets all permissions the caller has for a resource group.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/permissions-list-for-resource-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. |

### Gets all permissions the caller has for a resource.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/permissions-list-for-resource` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| resourceGroupName | string | yes | The name of the resource group. The name is case insensitive. |
| resourceProviderNamespace | string | yes | The namespace of the resource provider. |
| parentResourcePath | string | yes | The parent resource identity. |
| resourceType | string | yes | The resource type of the resource. |
| resourceName | string | yes | The name of the resource to get the permissions for. |
| api-version | string | no | The API version to use for this operation. |
| subscriptionId | string | yes | The ID of the target subscription. |

### Get role definition by name (GUID).
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-definitions-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| scope | string | yes | The scope of the role definition. |
| roleDefinitionId | string | yes | The ID of the role definition. |
| api-version | string | no | The API version to use for this operation. |

### Creates or updates a role definition.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-definitions-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| scope | string | yes | The scope of the role definition. |
| roleDefinitionId | string | yes | The ID of the role definition. |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

### Deletes a role definition.
`POST https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-definitions-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| scope | string | yes | The scope of the role definition. |
| roleDefinitionId | string | yes | The ID of the role definition to delete. |
| api-version | string | no | The API version to use for this operation. |

### Get all role definitions that are applicable at scope and above.
`GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/role-definitions-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| scope | string | yes | The scope of the role definition. |
| $filter | string | no | The filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as well. |
| api-version | string | no | The API version to use for this operation. |

## Example
```
curl "https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-list-for-resource" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Azure Authorization management API?
Create a free Apizie key, then send GET https://zieapi.vercel.app/v1/cloud:azure-arm-authorization/deny-assignments-list-for-resource with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Azure Authorization management API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Azure Authorization management itself also needs your own key from azure.com.

### Can AI agents use the Azure Authorization management API?
Yes. Add the Apizie MCP server (https://zieapi.vercel.app/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:azure-arm-authorization.

### What is the status of the Azure Authorization management API?
Needs your own provider key (bring your own key)