Resource Manager basics

Create, read, tag and list resource groups and lock them, through Azure Resource Manager on the emulator; deleting a group fails in Vera 1.2.2.

Plan: Free63 of 64 operations implemented across 3 APIs, 1 failed in testing

Deleting a resource group fails in Vera 1.2.2, even an empty one, and whether a lock stops a deletion wasn't established.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

The service pages create most of their Azure resources in a resource group, in the emulator’s one local subscription. This page covers the supporting APIs the service pages build on: subscriptions, resource groups and management locks. They’re Free, and they aren’t counted as a service of their own.

Connect

Start Vera as in Get started. Then open Bash in a terminal of its own (on macOS, whose terminal starts zsh, type bash first), go to an empty scratch directory and run this; it needs curl and Python 3. It fetches the emulator's own certificate, so every request checks TLS, and defines arm, which this page's commands use. The bearer token vera-local is a dummy local credential, not your license key.

export VERA_CA_CERT="$PWD/vera-ca.pem"
curl --fail --silent --show-error --noproxy '*' --insecure \
  https://localhost:8543/_vera/ca.pem --output "$VERA_CA_CERT"
curl --fail --silent --show-error --noproxy '*' \
  --cacert "$VERA_CA_CERT" https://localhost:8543/_vera/health; echo

export AZ_BASE='https://localhost:8543'
export SUB='00000000-0000-0000-0000-000000000001'
export TENANT='00000000-0000-0000-0000-0000000000a1'
export TOKEN='vera-local'

62 more lines: show the full setup
# arm METHOD /path API_VERSION [body.json]
# Prints the response body once any operation it started has finished, or,
# if that response had no body, the finished operation's response, such as
# a RunCommand result. A finished operation can hold a failed result: read it.
arm() (
  set -eu
  method=$1; path=$2; version=$3
  work=$(mktemp -d)
  trap 'rm -rf "$work"' EXIT
  case "$path" in /*) ;; *) printf 'Expected a relative /path\n' >&2; exit 1;; esac
  case "$AZ_BASE" in https://localhost:8543|https://127.0.0.1:8543) ;; *) printf 'This recipe requires the local emulator\n' >&2; exit 1;; esac
  args=(--fail-with-body --silent --show-error --noproxy '*' --max-time 20
        --cacert "$VERA_CA_CERT" -H "Authorization: Bearer $TOKEN"
        -H 'Content-Type: application/json')
  body=()
  if [ "$#" -ge 4 ]; then body=(--data-binary "@$4"); fi
  code=$(curl "${args[@]}" -X "$method" ${body[@]+"${body[@]}"} -D "$work/headers" \
    -o "$work/body" -w '%{http_code}' "$AZ_BASE$path?api-version=$version") || {
      cat "$work/body" >&2; exit 1;
    }
  poll_url=$(python3 - "$work/headers" "$AZ_BASE" <<'PY'
import sys,urllib.parse
headers={}
for line in open(sys.argv[1]):
    if ':' in line:
        key,value=line.split(':',1); headers[key.lower()]=value.strip()
url=headers.get('azure-asyncoperation') or headers.get('operation-location') or headers.get('location') or ''
if url:
    url=urllib.parse.urljoin(sys.argv[2],url); p=urllib.parse.urlsplit(url)
    if p.scheme!='https' or p.hostname not in ('localhost','127.0.0.1') or p.port!=8543:
        raise SystemExit('Refusing a non-local operation URL')
print(url)
PY
  ) || exit 1
  if [ -n "$poll_url" ] && [ "$method" != GET ] && [ "$method" != HEAD ]; then
    done_ok=false
    for attempt in $(seq 1 30); do
      code=$(curl "${args[@]}" -D "$work/poll-headers" -o "$work/poll-body" -w '%{http_code}' "$poll_url") || {
        cat "$work/poll-body" >&2; exit 1;
      }
      state=$(python3 - "$work/poll-body" "$code" <<'PY'
import sys,json
raw=open(sys.argv[1]).read(); code=int(sys.argv[2]); value=json.loads(raw) if raw.strip() else {}
status=str(value.get('status') or value.get('properties',{}).get('provisioningState') or '').lower()
if status in ('failed','canceled','cancelled') or value.get('error'):
    print(raw,file=sys.stderr);raise SystemExit('Operation failed')
if status in ('succeeded','completed') or (not status and code in (200,204)):
    print('done')
else: print('pending')
PY
      ) || exit 1
      if [ "$state" = done ]; then done_ok=true; break; fi
      sleep 1
    done
    if [ "$done_ok" != true ]; then printf 'Operation polling timed out\n' >&2; exit 1; fi
    if [ -s "$work/poll-body" ] && ! grep -q '[^[:space:]]' "$work/body" 2>/dev/null; then
      cp "$work/poll-body" "$work/body"
    fi
  fi
  cat "$work/body"
  printf '\n'
)

The health check answers {"cloud": "azure", "generation_status": "generated", "status": "ok"}. Requests go only to the emulator at https://localhost:8543: the helper refuses any other address, including the Azure-looking URLs some responses hold. When you've finished, close the terminal and delete the scratch directory; that removes only these local files, not what you created in the emulator.

The examples use API version 2022-12-01 for subscriptions, 2025-04-01 for resource groups and 2020-05-01 for locks, as tested with this build.

Example

Create a resource group with a tag, read it, change its tags and list the groups:

cat > group.json <<'JSON'
{"location":"eastus","tags":{"purpose":"docs"}}
JSON
RG_PATH="/subscriptions/$SUB/resourceGroups/vera-docs-basics"
arm PUT "$RG_PATH" 2025-04-01 group.json
arm GET "$RG_PATH" 2025-04-01

cat > group-tags.json <<'JSON'
{"tags":{"purpose":"updated"}}
JSON
arm PATCH "$RG_PATH" 2025-04-01 group-tags.json
arm GET "/subscriptions/$SUB/resourcegroups" 2025-04-01

Then put a CanNotDelete lock on the group, read it, list the group’s locks and delete the lock:

cat > lock.json <<'JSON'
{"properties":{"level":"CanNotDelete","notes":"Local documentation example"}}
JSON
LOCK_PATH="$RG_PATH/providers/Microsoft.Authorization/locks/docs-lock"
arm PUT "$LOCK_PATH" 2020-05-01 lock.json
arm GET "$LOCK_PATH" 2020-05-01
arm GET "$RG_PATH/providers/Microsoft.Authorization/locks" 2020-05-01
arm DELETE "$LOCK_PATH" 2020-05-01

Each command prints the response body. In testing, the requests answered as follows:

Request	API version	Answer
List or read subscriptions	2022-12-01	200, with the local subscription and tenant
List a subscription’s locations	2022-12-01	200, with location metadata
Create, read, update and list resource groups	2025-04-01	201, 200, 200 and 200, keeping the location and tags
Check that a group exists (`HEAD`)	2025-04-01	204
Create, read, list and delete a lock	2020-05-01	201, 200, 200 and 200; reading it after deletion, 404

The group stays: don’t delete it while you’re using the emulator, for the reason below.

Deleting resource groups

Deleting a resource group fails in Vera 1.2.2, including an empty group. The DELETE returns HTTP 202, but its operation returns HTTP 500 InternalServerError, and the group remains in Deleting. This is the operation’s error:

{"error":{"code":"InternalServerError","message":"The generated backend raised RuntimeError."}}

That check sent the DELETE to the REST API. In Vera 1.2.0 preview, deleting a group failed with az group delete and the Python SDK too, and while a deletion was pending, unrelated requests could fail; they worked again once no deletion was pending. Those weren’t rerun on Vera 1.2.2. It’s an emulator failure, not a plan limit: the Vera 1.2.2 check ran with full access.

So:

Delete resources individually, as the service pages do, and leave their resource group.
Don’t delete a group while other requests are running against the same emulator.
To clear everything, recreate the emulator, which clears its local state, as in Stop and start again. There’s no reset command.

Limitations

Locks are stored, not shown to work. A lock is kept and can be read, listed and deleted. In Vera 1.2.0 preview, a deletion of a locked group was accepted and then failed like any other, so whether a lock stops a deletion wasn’t established.
One subscription and tenant. The emulator has one local subscription, 00000000-0000-0000-0000-000000000001, in tenant 00000000-0000-0000-0000-0000000000a1. Its locations are names, not real Azure regions.
Only the example above and the group deletion check were run on Vera 1.2.2. Generic resource operations, moves, template exports, provider registration, tags and locks at other scopes weren’t run as examples. The API coverage marks them from a review of Vera 1.2.0’s source, in which a test request against the reviewed source exercised each one; their notes give the limits.

API coverage

Every operation of the APIs on this page, from their pinned public definitions, and whether Vera 1.2.0 implements it. Only the API surfaces in this release are listed, and each operation once. Implementation availability was reviewed against the Vera 1.2.0 source on 6 November 2026. Source inspection identifies a local implementation and its known limits; it doesn't mean every operation or API version was tested with a request. Each note names its evidence: a Local observation without a build or date is from Vera 1.2.0 preview, on 5 November 2026, and one from a later build, such as Vera 1.2.0-rc.3 or Vera 1.2.2, names that build and its date. No response was compared with Azure's. What the statuses mean

Management locks 2020-05-01Plan: Free

17 of 17 implemented

Version 2020-05-01, from the Azure REST API specifications at commit 21bbf1b.

AuthorizationOperations

1 of 1 implemented

Operation	Status	Notes
AuthorizationOperations_List	Implemented	Source inspection: Lists the authorization and lock operations the emulator registers. A test request against the reviewed source succeeded.

ManagementLocks

16 of 16 implemented

Operation	Status	Notes
ManagementLocks_CreateOrUpdateAtResourceGroupLevel	Implemented	Local observation: A `CanNotDelete` lock on a resource group was stored (HTTP 201). Whether a lock stops a deletion wasn't established, since group deletion failed in Vera 1.2.0 preview.
ManagementLocks_CreateOrUpdateAtResourceLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_CreateOrUpdateAtSubscriptionLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_CreateOrUpdateByScope	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_DeleteAtResourceGroupLevel	Implemented	Local observation: Deleting the lock answered HTTP 200, and reading it afterwards answered 404.
ManagementLocks_DeleteAtResourceLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_DeleteAtSubscriptionLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_DeleteByScope	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_GetAtResourceGroupLevel	Implemented	Local observation: Read the stored lock (HTTP 200); after it was deleted, 404.
ManagementLocks_GetAtResourceLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_GetAtSubscriptionLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_GetByScope	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_ListAtResourceGroupLevel	Implemented	Local observation: Listed the group's stored lock (HTTP 200).
ManagementLocks_ListAtResourceLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_ListAtSubscriptionLevel	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.
ManagementLocks_ListByScope	Implemented	Source inspection: Local lock records, with scope checks, listing, filtering, creation and deletion; whether a lock stops a change isn't established. A test request against the reviewed source succeeded.

Resource groups and resources 2025-04-01Plan: Free

39 of 40 implemented · 1 failed in testing

Version 2025-04-01, from the Azure REST API specifications at commit 21bbf1b.

Operations

1 of 1 implemented

Operation	Status	Notes
Operations_List	Implemented	Source inspection: Lists the emulator's own operation descriptions. A test request against the reviewed source succeeded.

ProviderResourceTypes

1 of 1 implemented

Operation	Status	Notes
ProviderResourceTypes_List	Implemented	Source inspection: Lists the emulator's provider resource types, not Azure's full region and capability inventory. A test request against the reviewed source succeeded.

Providers

8 of 8 implemented

Operation	Status	Notes
Providers_Get	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_GetAtTenantScope	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_List	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_ListAtTenantScope	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_ProviderPermissions	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_Register	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_RegisterAtManagementGroupScope	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.
Providers_Unregister	Implemented	Source inspection: Reads and changes local provider-registration records. A test request against the reviewed source succeeded.

ResourceGroups

6 of 7 implemented · 1 failed in testing

Operation	Status	Notes
ResourceGroups_CheckExistence	Implemented	Local observation: `HEAD` answered 204 for an existing group, and the Python SDK's `check_existence` returned `True`.
ResourceGroups_CreateOrUpdate	Implemented	Local observation: Created a group (HTTP 201) that kept its location and tags. Creating one with the Python SDK 24.0.0 and the Azure CLI 2.92.0 worked too.
ResourceGroups_Delete	Failed in testing	Local observation: Vera 1.2.2, 8 November 2026 — deleting a group through the REST API, including an empty group, answered HTTP 202, but its operation answered HTTP 500 `InternalServerError`, "The generated backend raised RuntimeError.", and the group remained in `Deleting`. Deletion with the CLI or SDK wasn't rerun. Earlier, in Vera 1.2.0 preview, the operation answered 500 `InternalServerError`, "Generated asynchronous backend failed.", with `az group delete` too, and while a deletion was pending, unrelated requests could fail. It's an emulator failure, not a plan limit: see Deleting resource groups, above.
ResourceGroups_ExportTemplate	Implemented	Source inspection: Exports the resources stored in the local group as a template; no deployment runs. A test request against the reviewed source succeeded.
ResourceGroups_Get	Implemented	Local observation: Read the created group (HTTP 200). Without an `api-version` the request answered 400 `MissingApiVersionParameter`, with an invalid one 400 `InvalidApiVersionParameter`, and without the bearer token 401 `AuthenticationFailed`.
ResourceGroups_List	Implemented	Local observation: Listed the local groups (HTTP 200).
ResourceGroups_Update	Implemented	Local observation: `PATCH` kept the updated tags (HTTP 200), and `az group update` worked too.

Resources

14 of 14 implemented

Operation	Status	Notes
Resources_CheckExistence	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_CheckExistenceById	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_CreateOrUpdate	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_CreateOrUpdateById	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_Delete	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_DeleteById	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_Get	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_GetById	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_List	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_ListByResourceGroup	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_MoveResources	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_Update	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_UpdateById	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.
Resources_ValidateMoveResources	Implemented	Source inspection: Creates, reads, updates, lists, moves and deletes local resource records, with validation; moving a record doesn't move a running workload. A test request against the reviewed source succeeded.

Operation	Status	Notes
Tags_CreateOrUpdate	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_CreateOrUpdateAtScope	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_CreateOrUpdateValue	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_Delete	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_DeleteAtScope	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_DeleteValue	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_GetAtScope	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_List	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.
Tags_UpdateAtScope	Implemented	Source inspection: Stores and returns tag names, values and scoped tags, with merge, replace and delete. A test request against the reviewed source succeeded.

Subscriptions 2022-12-01Plan: Free

7 of 7 implemented

Version 2022-12-01, from the Azure REST API specifications at commit 21bbf1b.

Operations

1 of 1 implemented

Operation	Status	Notes
Operations_List	Implemented	Source inspection: Lists the emulator's own operation descriptions. A test request against the reviewed source succeeded.

Subscriptions

4 of 4 implemented

Operation	Status	Notes
Subscriptions_CheckZonePeers	Implemented	Source inspection: Computes zone-peer mappings from the emulator's fixed region model, not Azure's physical zones. A test request against the reviewed source succeeded.
Subscriptions_Get	Implemented	Local observation: Read the local subscription, in state `Enabled` (HTTP 200).
Subscriptions_List	Implemented	Local observation: Listed the local subscription, `00000000-0000-0000-0000-000000000001`, in tenant `00000000-0000-0000-0000-0000000000a1` (HTTP 200).
Subscriptions_ListLocations	Implemented	Local observation: Returned location metadata (HTTP 200). These are names, not real Azure regions.

Tenants

1 of 1 implemented

Operation	Status	Notes
Tenants_List	Implemented	Source inspection: Returns the emulator's local tenant. A test request against the reviewed source succeeded.

subscriptions_arm

1 of 1 implemented

Operation	Status	Notes
checkResourceName	Implemented	Source inspection: Checks the name against a fixed local list of reserved words, not Azure's full reserved-name check. A test request against the reviewed source succeeded.

Resource Manager basics

Connect

Example

Deleting resource groups

Limitations

API coverage

Management locks 2020-05-01Plan: Free

AuthorizationOperations

ManagementLocks

Resource groups and resources 2025-04-01Plan: Free

Operations

ProviderResourceTypes

Providers

ResourceGroups

Resources

Tags

Subscriptions 2022-12-01Plan: Free

Operations

Subscriptions

Tenants

subscriptions_arm