API Management

APIM centralizes cross-cutting API concerns so every back end doesn't reimplement them.

Azure API Management (APIM) is a gateway plus management plane for APIs. You import APIs (OpenAPI, Functions, App Service, Container Apps, SOAP, GraphQL), and clients call the gateway instead of the back end.

Building blocks:

APIs and operations, grouped into products that consumers subscribe to, receiving subscription keys.
Policies: XML pipelines run in four sections, inbound, backend, outbound and on-error, at global, product, API or operation scope. <base /> controls where the parent scope's policies run.
Developer portal: generated documentation and self-service sign-up.

Common policies: validate-jwt (or validate-azure-ad-token) to require Entra tokens, rate-limit-by-key and quota-by-key for throttling, set-header and rewrite-uri, cache-lookup/cache-store, set-backend-service and backend pools with circuit breakers. APIM's managed identity can call back ends with authentication-managed-identity, so no back-end secrets.

Tiers matter: Consumption (serverless, per call), Developer (no SLA), Basic/Standard/Premium (classic), and the faster-provisioning v2 tiers. Premium adds multi-region gateways, zones and full VNet injection; self-hosted gateways run in your own Kubernetes. APIM is also used as an AI gateway for token limits and load balancing across Azure OpenAI deployments.

Example

<policies>
  <inbound>
    <base />
    <validate-azure-ad-token tenant-id="{{tenant-id}}">
      <audiences><audience>api://orders-api</audience></audiences>
    </validate-azure-ad-token>
    <rate-limit-by-key calls="100" renewal-period="60"
        counter-key="@(context.Subscription.Id)" />
    <set-backend-service backend-id="orders-backend" />
    <authentication-managed-identity resource="api://orders-backend" />
  </inbound>
  <backend><base /></backend>
  <outbound>
    <base />
    <set-header name="X-Powered-By" exists-action="delete" />
  </outbound>
  <on-error><base /></on-error>
</policies>

Remember

Gateway in front, policies in inbound/backend/outbound/on-error
Products and subscriptions package APIs for consumers
Validate Entra tokens and rate-limit per caller at the gateway
Pick the tier for SLA, VNet and multi-region needs

Watch out for

Forgetting <base />, which silently skips policies defined at a broader scope such as global CORS or auth.

Check yourself

Where does a policy that strips a response header belong?
What does removing <base /> from an API-level inbound section do?

Official docs: learn.microsoft.com/en-us/azure/api-management/api-management-key-concepts

Example

Remember

Watch out for

Check yourself

Builds on

Unlocks