Azure API Management: Complete Implementation Guide

Deep dive into Azure APIM. Beyond a simple proxy, APIM is your unified entry point for microservices. We cover the Consumption tier (Serverless), Policies for security, and Versioning strategies.

Architecture

flowchart TB
    Client -->|HTTPS| APIM[Azure API Management]
    
    subgraph "Backend"
        APIM -->|VNET Peering| AKS[Kubernetes Internal API]
        APIM -->|Global| Fn[Azure Functions]
        APIM -->|Legacy| OnPrem[On-Premises SOAP]
    end
    
    APIM -->|Logs| AppInsights
    
    style APIM fill:#E1F5FE,stroke:#0277BD

Policies: The Power of XML

Use policies to modify requests before they reach the backend.

<inbound>
    <base />
    <!-- Validate JWT from AAD -->
    <validate-jwt header-name="Authorization" failed-validation-httpcode="401">
        <openid-config url="https://login.microsoftonline.com/common/.well-known/openid-configuration" />
    </validate-jwt>
    
    <!-- Rate Limit by Subscription -->
    <rate-limit calls="100" renewal-period="60" />
    
    <!-- Transform to JSON -->
    <json-to-xml apply="always" consider-accept-header="false" />
</inbound>

Versioning

Use “Path Based” versioning (e.g., `/v1/orders`) for explicit contracts. APIM handles routing to different backend URLs for each version.

Key Takeaways

• Use **Consumption Tier** for serverless, low-cost scenarios (cold start applies).
• Use APIM for cross-cutting concerns (Auth, Throttling, Caching).
• Keep business logic OUT of policies; use them for transformations only.