Azure API Management (APIM): A Complete Guide for Modern API Management

In today's cloud-native world, APIs are the backbone of application integration. Organizations expose APIs to mobile applications, web applications, partners, and internal systems. As the number of APIs grows, managing security, performance, monitoring, and scalability becomes increasingly challenging.

This is where Azure API Management (APIM) comes in.

Azure API Management is a fully managed service on Microsoft Azure that enables organizations to publish, secure, transform, monitor, and scale APIs through a centralized platform.

What is Azure API Management?

Azure API Management (APIM) acts as a central gateway between API consumers and backend services.

Instead of allowing clients to directly access backend APIs, all requests pass through APIM, where security controls and policies can be applied.

Client Apps
     │
     ▼
Azure APIM Gateway
     │
     ▼
Backend Services
(API Apps, Function Apps,
Microservices, Databases)

APIM provides a secure and controlled entry point for all API traffic while simplifying API governance and management.

Core Components of Azure APIM

1. API Gateway (Runtime Layer)

The API Gateway is the heart of Azure API Management. Every API request enters the gateway before reaching backend services.

Responsibilities of the API Gateway

• Receives incoming API requests
• Authenticates users and applications
• Applies policies
• Routes requests to backend services
• Transforms requests and responses
• Monitors API traffic and performance

Common Gateway Functions

Authentication

Supports:

• Microsoft Entra ID
• OAuth 2.0
• JWT Tokens
• Subscription Keys

<validate-jwt />

Rate Limiting (Throttling)

Protects backend services from excessive traffic.

<rate-limit calls="100"
            renewal-period="60" />

This policy limits consumers to 100 requests per minute.

Request and Response Transformation

Modify payloads without changing backend code.

• Add headers
• Remove headers
• Rewrite URLs
• Modify responses

The API Gateway serves as a powerful reverse proxy for all API traffic.

2. Management Plane

The Management Plane is used by administrators, developers, and DevOps teams to manage API configurations.

Key Capabilities

• Create APIs
• Configure Backend Services
• Manage API Products
• Apply Policies
• Configure Security
• Manage Versions and Revisions

This layer allows organizations to govern APIs consistently across teams and environments.

3. Developer Portal

The Developer Portal provides a self-service experience for developers consuming APIs.

Features

API Documentation

Automatically generates API documentation.

Interactive Testing

Developers can test APIs directly from the portal.

Try It
 ↓
Execute API
 ↓
View Response

Subscription Management

Developers can:

• Request access
• Generate subscription keys
• Manage API subscriptions

The Developer Portal significantly improves developer onboarding and API adoption.

4. Analytics and Monitoring

Understanding API usage is critical for business and operational success. Azure APIM provides powerful monitoring capabilities.

Metrics Tracked

API Usage

• Request volume
• Popular APIs
• Consumer activity

Performance

• Response times
• Latency
• Throughput

Errors

• HTTP 4xx errors
• HTTP 5xx errors
• Backend failures

Azure Integration

• Azure Monitor
• Application Insights
• Log Analytics

This provides end-to-end visibility into API behavior.

How Azure APIM Works

The request lifecycle is simple and powerful.

Client Application
         │
         ▼
Azure API Management Gateway
         │
      Policies
         │
         ▼
Backend Service
         │
         ▼
Response Returned

The gateway becomes the single point of entry for all API traffic.

What Are APIM Policies?

One of the most powerful features of Azure API Management is Policies.

Policies are XML-based rules that execute during the API request and response pipeline.

Common Policy Types

Rate Limiting

<rate-limit calls="100"
            renewal-period="60" />

Protects APIs from abuse and excessive traffic.

JWT Validation

<validate-jwt />

Validates user identity before processing requests.

URL Rewrite

<rewrite-uri />

Changes request paths dynamically.

Response Caching

<cache-store />

Reduces backend workload and improves performance.

Header Management

<set-header />

Adds or removes HTTP headers.

Authentication Policies

Enforces authentication standards consistently across APIs.

Policies provide centralized control without requiring changes to backend code.

APIM Policy Execution Pipeline

Policies are executed in the following order:

Inbound
   ↓
Backend
   ↓
Outbound
   ↓
On-Error

Inbound

Processes requests before reaching the backend.

Backend

Controls communication with the backend service.

Outbound

Processes responses before returning them to clients.

On-Error

Handles exceptions and failures gracefully.

What is APIM Self-Hosted Gateway?

Azure APIM also provides a Self-Hosted Gateway.

Unlike the managed gateway running in Azure, the Self-Hosted Gateway can be deployed anywhere.

Deployment Options

• On-Premises Data Centers
• Kubernetes Clusters
• Private Clouds
• Hybrid Environments

Benefits

• Consistent API policies
• Local traffic processing
• Reduced latency
• Hybrid cloud support

Azure Management Plane
          │
          ▼
Self-Hosted Gateway
          │
          ▼
On-Prem Backend APIs

This is particularly useful for organizations with strict networking or compliance requirements.

Can APIM Integrate with Azure Key Vault?

Yes. Azure API Management integrates seamlessly with Azure Key Vault to securely manage sensitive information.

Common Use Cases

Secrets

• API Keys
• Client Secrets
• Tokens

Certificates

Manage TLS/SSL certificates securely.

Connection Strings

Protect database connection details.

Backend Credentials

Secure authentication between APIM and backend services.

By leveraging Azure Key Vault, organizations eliminate hard-coded credentials and strengthen security.

Benefits of Azure API Management

Enhanced Security

• OAuth 2.0
• OpenID Connect
• JWT Validation
• Subscription Keys

Increased Scalability

Handle growing API traffic with managed infrastructure.

Centralized Governance

Manage APIs consistently across teams and environments.

Improved Developer Experience

Provide documentation, testing tools, and subscription management through the Developer Portal.

Operational Insights

Gain visibility into API usage, performance, and reliability.

Conclusion

Azure API Management is much more than an API gateway. It is a complete API lifecycle management platform that enables organizations to securely expose, monitor, transform, and scale APIs while providing excellent developer experiences.

Whether you're building microservices, exposing APIs to partners, or managing enterprise integrations, Azure APIM delivers the tools needed to govern APIs effectively and securely in the cloud.

By combining powerful gateways, flexible policies, self-service developer portals, deep monitoring capabilities, and Azure-native integrations, APIM remains one of the most popular API management solutions in the Microsoft ecosystem.

Github Action to build an artefact - Java application (.war file generation)

 

# This workflow will build a package using Maven and then publish it to GitHub packages when a release is created

# For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#apache-maven-with-a-settings-path

name: AscentOne Portal Backend - Maven

permissions:

actions: read

contents: read

on:

workflow_dispatch:

inputs:

command:

description: 'Which environment to build'

required: true

default: 'test'

type: choice

options:

- test

- production

jobs:

# build-frontend:

# uses: ./.github/workflows/AscentOne.yml

build:

runs-on: ubuntu-latest

environment: AscentOne.${{ github.event.inputs.command || 'test' }}

steps:

- uses: actions/checkout@v4

- name: Set up JDK 11

uses: actions/setup-java@v4

with:

java-version: '11'

distribution: 'temurin'

# Determine which branch to use in config repo

- name: Resolve config repo branch

id: config_branch

env:

BRANCH_NAME: ${{ github.ref_name }}

TOKEN: ${{ secrets.ACCESS_TOKEN }}

run: |

if git ls-remote --exit-code --heads \

https://x-access-token:${TOKEN}@github.com/AscentOne-Ltd/AscentOne-cicd-templates.git \

"${BRANCH_NAME}" >/dev/null 2>&1; then

echo "ref=${BRANCH_NAME}" >> $GITHUB_OUTPUT

echo "Using branch ${BRANCH_NAME}"

else

echo "ref=main" >> $GITHUB_OUTPUT

echo "Branch ${BRANCH_NAME} not found. Using main."

fi

# ✅ Pull config repo

- name: Checkout config repo

uses: actions/checkout@v4

with:

repository: AscentOne-Ltd/AscentOne-cicd-templates

token: ${{ secrets.ACCESS_TOKEN }}

path: config-repo

ref: ${{ steps.config_branch.outputs.ref }}

# ✅ Copy configs

- name: Copy config files

working-directory: AscentOneBackend

run: |

ENV=${{ github.event.inputs.command || 'test' }}

cp ../config-repo/templates/applications/AscentOne//$ENV/application.yml src/main/resources/application.yml

cp ../config-repo/templates/applications/AscentOne/$ENV/application-prod.yml src/main/resources/application-prod.yml

cp ../config-repo/templates/applications/AscentOne/$ENV/application-int.yml src/main/resources/application-int.yml

cp ../config-repo/templates/applications/AscentOne/$ENV/application-dev.yml src/main/resources/application-dev.yml

cp ../config-repo/templates/applications/AscentOne/$ENV/logback.xml src/main/resources/logback.xml

- name: Download frontend artifact

uses: dawidd6/action-download-artifact@v3

with:

workflow: ascentOneAngularfrontend.yml

name: application-ascentOneAngularfrontend-${{ github.event.inputs.command }}

path: ascentOneAngularfrontend-new

- name: Copy malfunction new frontend into backend resource folder

run: |

rm -rf AscentOneBackend/src/main/webapp/resources/html*

mkdir -p AscentOneBackend/src/main/webapp/resources/html

cp -r ascentOneAngularfrontend-new/malfunction/. AscentOneBackend/src/main/webapp/resources/html

- name: Build with Maven

working-directory: AscentOneBackend

run: mvn clean package -DskipTests

- name: Upload AscentOneBackend WAR artifact

uses: actions/upload-artifact@v4

with:

name: AscentOneBackend.war

path: AscentOneBackend/target/*.war

Security Vulnerability - Regular Expression Denial of Service (ReDoS)

NVD - CVE-2025-69873

 1. Backtracking (in the context of regular expressions and algorithms) is a trial‑and‑error process where the engine tries one possible path, and if that path fails, it goes back (“backtracks”) and tries another.

Think of backtracking like this:

“Try option A.
If it doesn’t work, rewind and try option B.
If that doesn’t work, rewind further and try option C…”

This is fine when there are only a few options.
It becomes dangerous when the number of options grows exponentially.

What is catastrophic backtracking?

Catastrophic backtracking happens when:

• A regex has nested repetition or ambiguity
• The engine must try an enormous number of paths
• Matching time becomes extremely slow

Example :

^(a+)+$

Why it’s bad:

• a+ already repeats
• Wrapping it in ()+ creates nested repetition
• The engine keeps retrying the same matches in different groupings

Just adding one more character to the input can double execution time.

What is ReDoS

A ReDoS vulnerability stands for Regular Expression Denial of Service. It is a type of Denial‑of‑Service (DoS) attack that exploits how some regular expressions are evaluated.

ReDoS happens when a specially crafted input causes a regular expression to take an extremely long time to evaluate, consuming CPU and making an application unresponsive.

Why backtracking causes ReDoS

Backtracking itself is normal.
It becomes a vulnerability when attackers can control the input.

Attack flow:

1. Attacker sends specially crafted input
2. Regex engine enters massive backtracking
3. CPU usage spikes
4. Application becomes unresponsive

In Node.js or single‑threaded environments:

• One slow regex = entire server blocked

What makes it a vulnerability?

ReDoS becomes a security vulnerability when:

1. A regex is evaluated on untrusted input
2. The regex or the input can be influenced by an attacker
3. The regex runs on a shared or single-threaded resource (e.g. Node.js event loop)

An attacker can then:

• Send a single request
• Tie up CPU
• Block all other users

Getting access token from Microsoft using Powershell

 

$tenantId   = "<your-tenant-id>"

$clientId   = "<yourclient-id>"

$client_secret= "<client-secret>"

$scope      = "api://<your-client-id>/.default"

$grant_type = "client_credentials"

$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"

$body = @{

    client_id      = "$clientId"

    client_secret  = "$client_secret"

    scope          =  "$scope"

    grant_type     = "client_credentials"

}

$graphToken = Invoke-RestMethod `

    -Method POST `

    -Uri $tokenUrl `

    -ContentType "application/x-www-form-urlencoded" `

    -Body $body

$token =  $graphToken.access_token

Top Ways to Mock your server for testing/building Angular Project

 #1. Using Proxy 

Add a file proxy.conf.json

{

  "/rest": {

    "target": "http://tca-test-exs.doaminname:8080",

    "secure": false,

    "changeOrigin": true,

    "logLevel": "debug",

     "headers": {

      "Authorization": "Basic ZW1zdmljcm06OTclb3BzY2sh"

      }

    }

}

Run angular CLI using ng serve --proxy-config proxy.conf.json

#2. Exposing a brand-new Node Server Fake API:

Install

npm install -g json-server

Add a folder "server" and add two files : server.js and db.json

const app = require('express')();

app.get('/product2/portalService/getUsers', (req, res) => {

  res.json([

    { id: 1, name: 'Node Mock IAP' }

  ]);

});

app.listen(3000);

Run that server. js in a new powershell window in VS Code

Powershell script to get Keyvault token using Powershell - Windows and Linux

 $os = [System.Environment]::OSVersion.Platform

$runningLinux = $false

$Host.UI.WriteLine("Running on $os")

if("Unix" -eq $os)

{

    $runningLinux = $true

}

az login --service-principal   -u <principle-guid>   -p <active-secret>   --tenant <token-guid>

$Host.UI.WriteLine("Login was successful for az cli and now going to get the token from https://vault.azure.net")

$token=az account get-access-token --resource https://vault.azure.net --query accessToken -o tsv

$Host.UI.WriteLine("Received token successful $token")

 

# Define headers properly (PowerShell expects a hash table)

$headers = @{

    "Authorization" = "Bearer $token"

}

 

$Host.UI.WriteLine("Start calling nslook on kvdmpprodae001.vault.azure.net")

if(!$runningLinux)

{

    Resolve-DnsName kvdmpprodae001.vault.azure.net

} else

{

    nslookup kvdmpprodae001.vault.azure.net

}

$Host.UI.WriteLine("End calling nslook on kvdmpprodae001.vault.azure.net")

$Host.UI.WriteLine("Start calling curl on https://kvdmpprodae001.vault.azure.net")

curl -v https://kvdmpprodae001.vault.azure.net

$Host.UI.WriteLine("End calling curl on https://kvdmpprodae001.vault.azure.net")

 

if($runningLinux)

{

    $Host.UI.WriteLine("Start calling curl on https://kvdmpprodae001.vault.azure.net/secrets/<your-key-name>?api-version=7.3")

    curl -v -H "Authorization: Bearer $token" --trace-ascii trace.log https://kvdmpprodae001.vault.azure.net/secrets/<your-key-name>?api-version=7.3

    $Host.UI.WriteLine("End calling curl on https://kvdmpprodae001.vault.azure.net/secrets/<your-key-name>?api-version=7.3")

}

 

# Call Key Vault REST API

$Host.UI.WriteLine("Invoking the webrequest with the token received")

$response = Invoke-WebRequest -Uri "https://kvdmpprodae001.vault.azure.net/secrets/<your-key-name>?api-version=7.3" -Headers $headers

 

    $Host.UI.WriteLine("Now printing the vault access")

# Output response

$response.Content

Once you created above .ps1 file. Run it using Powershell in Windows or install powershell in Linux and run using :

pwsh <filename>.ps1

Powershell script to bring news from news Feeds and create a nice looking HTML page.

# ===== DailyNews.ps1 =====




# RSS feed URLs

$techFeeds = @(

"https://techcrunch.com/feed/",

"https://feeds.arstechnica.com/arstechnica/index"

)

$propertyFeeds = @(

"https://www.abc.net.au/news/feed/52278/rss.xml"

)




# Output HTML file

$outputFile = "C:\temp\DailyNews.html"




# Current date

$date = (Get-Date).ToString("dddd, MMM dd yyyy")




# Function to fetch feed items

function Get-FeedItems {

param($url)




Write-Host $url

try {

$rss = [xml](Invoke-WebRequest -Uri $url -UseBasicParsing -ErrorAction Stop).Content

$items = @()

foreach ($item in $rss.rss.channel.item | Select-Object -First 5) {

$items += [PSCustomObject]@{

Title = $item.title

Link = $item.link

PubDate = $item.pubDate

Source = $rss.rss.channel.title

}

}

return $items

} catch {

Write-Host "⚠️ Could not fetch: $url"

return @([PSCustomObject]@{

Title = "⚠️ Could not fetch"

Link = $url

PubDate = ""

Source = ""

})

}

}




# Fetch items

$techNews = @()

foreach ($feed in $techFeeds) {

$techNews += Get-FeedItems $feed

}




$propertyNews = @()

foreach ($feed in $propertyFeeds) {

$propertyNews += Get-FeedItems $feed

}







# Build HTML content

$html = @"

<html>

<head>

<title>📰 Daily Tech & Property News - $date</title>

<style>

body { font-family: Segoe UI, Arial; background: #f9fafb; color: #333; margin: 20px; }

h1, h2 { color: #2a7ae2; }

a { text-decoration: none; color: #0078d7; }

a:hover { text-decoration: underline; }

section { margin-bottom: 40px; }

.article { margin: 8px 0; }

footer { margin-top: 40px; font-size: 12px; color: #777; }

</style>

</head>

<body>

<h1>📰 Daily Tech & Property News</h1>

<p><b>Date:</b> $date</p>




<section>

<h2>🏠 Property News</h2>

<ul>

"@




foreach ($item in $propertyNews) {

$html += "<li class='article'><a href='$($item.Link)' target='_blank'>$($item.Title)</a></li>`n"

}




$html += @"

</ul>

</section>




<section>

<h2>💻 Tech News</h2>

<ul>

"@




foreach ($item in $techNews) {

$html += "<li class='article'><a href='$($item.Link)' target='_blank'>$($item.Title)</a></li>`n"

}




$html += @"

</ul>

</section>




<footer>Generated automatically by PowerShell – $date</footer>

</body></html>

"@




# Save HTML

$html | Out-File -FilePath $outputFile -Encoding utf8

Write-Host "✅ HTML News Summary saved to $outputFile"