AZ-204 - Consuming Azure Services & API Management
Azure API Management (APIM)
Azure API Management (APIM) is a fully managed service that helps organizations publish, secure, transform, maintain, and monitor APIs. It acts as a gateway between API consumers and backend services.
APIM Components
API Gateway
The endpoint that accepts API calls and routes them to backends. Enforces policies such as rate limiting, authentication, and request/response transformation.
Azure Portal (Management Plane)
The administrative interface where you define APIs, configure policies, manage products and subscriptions, set up users and groups, and view analytics.
Developer Portal
An auto-generated, fully customizable website where API consumers discover APIs, read documentation, try APIs via an interactive console, and obtain subscription keys.
APIM Tiers
| Tier | Use Case | SLA |
|---|---|---|
| Consumption | Serverless, pay-per-call | 99.95% |
| Developer | Non-production, evaluation | No SLA |
| Basic | Entry-level production | 99.95% |
| Standard | Medium traffic production | 99.95% |
| Premium | Multi-region, VNet, high scale | 99.99% |
Configure API Management
Products
Products are how APIs are surfaced to developers. A product contains one or more APIs. Products can be Open (no subscription required) or Protected (subscription required).
Subscriptions & Keys
API consumers access protected products via subscription keys. Keys are passed in the Ocp-Apim-Subscription-Key header or as a query parameter.
Policies
Policies are XML-based statements that modify API behavior. They execute at four scopes:
<inbound> <!-- Applied on request -->
</inbound>
<backend> <!-- Before forwarding to backend -->
</backend>
<outbound> <!-- Applied on response -->
</outbound>
<on-error> <!-- On exception -->
</on-error>
</policies>
Common Policies
| Policy | Purpose |
|---|---|
| rate-limit | Limit calls per time period (e.g., 100 calls per 60 seconds) |
| quota | Limit total calls or bandwidth per subscription over a period |
| ip-filter | Allow or deny requests from specific IP addresses |
| set-header | Add, remove, or modify HTTP headers |
| rewrite-uri | Transform the request URL path before forwarding |
| validate-jwt | Validate a JWT token for authentication |
| cache-lookup / cache-store | Cache responses to improve performance |
| cors | Enable Cross-Origin Resource Sharing |
Test the API
APIM provides a built-in test console in the Azure Portal. You can send requests with headers, query parameters, and body content directly from the portal to test backend connectivity and policy behavior.
Add a New API
Import Methods
APIs can be added manually or imported from:
- OpenAPI/Swagger - JSON or YAML specification files
- WSDL - SOAP service definitions
- Azure App Service - Direct import of web apps
- Azure Function App - Direct import of function apps
- Logic App - Import Logic App workflows as APIs
Swagger / OpenAPI
OpenAPI (formerly Swagger) is a specification for describing REST APIs. APIM natively supports OpenAPI v2 and v3 for importing and exporting API definitions.
OpenAPI Benefits in APIM
- Auto-generates API operations from the spec
- Populates request/response schemas and examples
- Produces interactive documentation in the Developer Portal
- Enables validation policies to enforce schemas
API Management Developer Portal
The Developer Portal is an auto-generated website for API consumers. It allows developers to:
- Browse and search available APIs
- Read auto-generated or custom documentation
- Try API calls via an interactive console
- Create accounts and subscribe to products
- View usage analytics for their subscriptions
The portal is fully customizable via a visual editor or code. Administrators can brand it, add pages, and control access.
Key Terms
| Term | Definition |
|---|---|
| API Management (APIM) | A managed service that acts as a gateway for publishing, securing, transforming, and monitoring APIs. |
| Product | A grouping of one or more APIs that is published to developers. Can be Open or Protected. |
| Subscription Key | A key passed in the Ocp-Apim-Subscription-Key header to authenticate API calls to protected products. |
| Policy | XML-based statements that modify API behavior at inbound, backend, outbound, or on-error stages. |
| Developer Portal | An auto-generated, customizable website where API consumers discover APIs, read docs, and obtain keys. |
| OpenAPI (Swagger) | A standard specification format for describing REST APIs, used for importing APIs into APIM. |
- APIM policies use XML and execute in four stages: inbound, backend, outbound, on-error.
- rate-limit restricts calls per time window. quota restricts total calls over a longer period.
- The Consumption tier is serverless and pay-per-call -- no infrastructure to manage.
- Subscription keys are passed via the Ocp-Apim-Subscription-Key header.
- validate-jwt policy is used for OAuth 2.0 / Azure AD authentication at the gateway.
- OpenAPI specs can be imported to auto-generate API operations and documentation.
- The Developer Portal is auto-generated but fully customizable.
Practice Questions
Q1. In which section of an APIM policy would you add rate limiting for incoming requests?
- backend
- outbound
- inbound
- on-error
Answer: C
Rate limiting is applied in the inbound section because it should be enforced before the request reaches the backend service.
Q2. Which header is used to pass the subscription key when calling an API through APIM?
- Authorization
- X-API-Key
- Ocp-Apim-Subscription-Key
- X-Subscription-Id
Answer: C
By default, APIM expects the subscription key in the Ocp-Apim-Subscription-Key header or as a query parameter named subscription-key.
Q3. Which APIM policy validates an OAuth 2.0 token at the gateway?
- authenticate-basic
- validate-jwt
- check-header
- ip-filter
Answer: B
The validate-jwt policy checks JSON Web Tokens for validity, including issuer, audience, expiration, and required claims.
Q4. Which APIM tier is serverless and charges per API call?
- Developer
- Basic
- Consumption
- Standard
Answer: C
The Consumption tier is serverless with pay-per-call pricing. It requires no infrastructure management and scales automatically.
Q5. A developer wants to import an existing REST API definition into APIM. Which format should they use?
- RAML
- GraphQL schema
- OpenAPI (Swagger) JSON/YAML
- Protocol Buffers
Answer: C
APIM natively supports importing APIs from OpenAPI (Swagger) v2 and v3 specification files in JSON or YAML format.
AZ-204 Developing Azure Solutions - Table of Contents
Master all exam topics with comprehensive study guides and practice questions.