Azure API Management

What it is

Azure API Management (APIM) is a managed service for putting a gateway in front of one or more APIs. It gives callers a consistent front door while the backend APIs can remain in App Service, Functions, containers, or elsewhere. At the gateway, APIM can apply policies, then forward a request to the configured backend.

Prerequisites and mechanics

Understand HTTP requests and responses, REST resources, JSON, authentication, and OpenAPI. An API definition describes the contract that callers use; the backend implements the actual operation. APIM can import an API definition, expose a frontend API, and use a policy to validate, transform, rate-limit, cache, or route traffic at the gateway boundary.

Relationships and choices

APIM fronts an application runtime; it does not replace App Service, Functions, or a container host. It is also not automatically the authority for every business decision. A subscription key can grant access to an APIM product or API, and a gateway policy can validate a token. The backend may still need to decide whether the authenticated caller may read or change a particular record.

Worked example and route

Northwind imports an OpenAPI description for its orders API. It requires a partner token, rejects oversized requests at the gateway, and routes valid calls to the orders backend. The backend still checks whether that partner is assigned to the requested order. This topic fits after REST/JSON and identity, before event and message integration.

Re-audit

Re-open when gateway policies, API access, supported definitions, or product behavior changes. Sources checked 2026-09-17: API Management key concepts, subscriptions, and authentication and authorization.