Azure API Management

Azure API Management (APIM) is a fully managed service for publishing, securing, transforming, and monitoring APIs. In a serverless architecture, APIM sits in front of your Azure Functions, Logic Apps, and other backend services, providing a unified API gateway with security policies, rate limiting, caching, and a developer portal.

---

Why API Management?

Without an API gateway, each backend service exposes its own endpoint with its own authentication, rate limiting, and documentation. This leads to:

• Inconsistent security across services
• No centralised monitoring of API usage
• Duplicated cross-cutting concerns (authentication, CORS, caching)
• No developer experience — consumers must discover and learn each API individually
• Difficulty versioning APIs without breaking clients

APIM solves these problems by providing a single entry point that applies consistent policies to all backend APIs.

---

Architecture

APIM consists of three main components:

API Gateway

The runtime component that processes API calls:

• Receives incoming requests
• Applies inbound policies (authentication, rate limiting, transformation)
• Routes to the backend service
• Applies outbound policies (response transformation, caching)
• Returns the response to the caller

Management Plane

The administrative interface for configuring APIs:

• Azure Portal — visual configuration
• Azure CLI / PowerShell — scripting
• ARM templates / Bicep — Infrastructure as Code
• REST API — programmatic management

Developer Portal

A customisable website for API consumers:

• API documentation (auto-generated from OpenAPI specs)
• Interactive API console (try APIs directly)
• API key management
• Code samples in multiple languages

---

APIM Tiers

Tier	Use Case	Gateway	Developer Portal	SLA
Consumption	Serverless, pay-per-call	Shared	No	99.95%
Developer	Dev/test	Dedicated	Yes	No SLA
Basic	Small production	Dedicated	Yes	99.95%
Standard	Medium production	Dedicated	Yes	99.95%
Premium	Enterprise, multi-region	Dedicated	Yes	99.99%

The Consumption tier is the natural fit for serverless architectures — it scales automatically, charges per API call, and requires no infrastructure management.

---

Core Concepts

APIs

An API in APIM is a collection of operations (endpoints). You can import APIs from:

• OpenAPI (Swagger) specifications
• Azure Functions — direct import
• Azure Logic Apps — direct import
• Azure App Service — direct import
• Manual definition — define operations by hand

Products

A product is a package of one or more APIs offered to developers:

• Open products — no subscription required
• Protected products — require a subscription key
• Products can have approval workflows, quotas, and rate limits

Subscriptions

Subscriptions grant access to APIs through subscription keys:

# API call with subscription key in header
curl -H "Ocp-Apim-Subscription-Key: abc123..." \
    https://my-apim.azure-api.net/api/users