An introduction to how Azure API Management works and what are the benefits you can expect from using it.

1. AZURE API MANAGEMENT - WHY BOTHER?
Jouni Heikniemi
@jouniheikniemi

2. Azure API Management
HR CRM
Custom
App
Workflow
engine
…
Client
Application
Single, unified, wonderful REST API
The producer
The consumer
Azure On-premises Amazon? Google?

3. So let’s talk about APIs

4. Classifying APIs
By intent:
Data retrieval
Data modification
Validation
Management
By access policy:
Private in-app
Internal
Public
Commercial
By technology:
In-process binary
File-based batch
TCP/IP
Web-ready (SOAP/REST)

5. Azure App Service / Web App
Hey, I know how to do this?

6. So why do I need API
Management?

7. Six things you might want to do…
1. Publish a single API endpoint for several applications
2. Centralize authentication and authorization
3. Protect your APIs from load with throttling and caching
4. Monitor API usage and performance systematically
5. Apply transformations etc. logic on API calls
6. Providing a friendly documentary UX for your API customers
“Tools for the API Economy”

8. Six Seven things you might want to do…
1. Publish a single API endpoint for several applications
2. Centralize authentication and authorization
3. Protect your APIs from load with throttling and caching
4. Monitor API usage and performance systematically
5. Apply transformations etc. logic on API calls
6. Providing a friendly documentary UX for your API customers
7. Centralize your use of external APIs – “reverse API proxying”

9. Azure API Management
HR CRM
Custom
App
Workflow
engine
…
Client
Application
Single, unified, wonderful REST API
The producer
The consumer

12. API Mgmt pricing
• Developer edition has all the
features, but no SLA
• Standard edition is a bit expensive,
but sufficient for most customers
• If you need more data transfer capacity, just pay the data rates
• If you need more API calls, scale up by paying for more units
• If you need geo-distribution, VPN/ER or full Azure AD support, go
Premium

14. This is the old administrative experience, i.e.
“publisher portal” (or the “Legacy of Apiphany”)

15. This experience is aimed at people
using your APIs, i.e. “developer portal”

16. Let’s publish an API

18. Azure App Service
Architecture: Where are we now?
Publisher Portal
Developer Portal
Azure API Management

19. Adding a new API

21. No operations –
nothing can be called.
APIM needs to know
the endpoints!

22. You can be quite specific here –
but you don’t have to. APIM
cares much less about the content
of the requests/responses (for now).

23. Back to the developer portal…

25. Can we now call it?

26. Managing your consumers

27. Taxonomy of API publishing so far
API
Operation
- A set of endpoints served from a single backend under an URI prefix
- A single method/path combination, “one action method”
- Documents its interface via request/response, description etc.

28. Adding users into the mix
API
Operation
- Access to a group of APIs
- Is subscribed to by users
Subscription
User
- Links a single user to a product
- Possibly multiple subscriptions
- Account in the developer portal
- Control product availability
- E.g. administrators,
partners, employees…
User Groups
Product

31. Subscribing

32. Subscribing

33. Subscribed! Now what?

34. Getting into it, finally!

35. Six things you might want to do…
1. Publish a single API endpoint for several applications
2. Centralize authentication and authorization
3. Protect your APIs from load with throttling and caching
4. Monitor API usage and performance systematically
5. Apply transformations etc. logic on API calls
6. Providing a friendly documentary UX for your API customers

36. The Wonderful
World of Policies

39. Forms are a poor man’s substitute for real
code (even XML)!

41. Throttling

42. What does throttling look like?

43. Caching

44. Calling external services in policies

45. Some examples of additional policies
• Check HTTP header
• Restrict caller IP
• Validate JWT token
• Conditional backend change
• Retry
• Mask URLs
• Convert between JSON & XML
• Find/replace
• You can also call external
services
• … and write C#, using quite a
few of libraries

46. The
base-line
1. Global scope – e.g. error logging
2. Product scope – e.g. throttling
3. API scope – e.g. request/response manipulation
4. Operation scope – e.g. caching

47. Monitoring

48. Monitoring with Power BI
Bing for:
Azure API Management Power BI Solution template
https://blogs.msdn.microsoft.com/apimanagement/2017/09/27/power-bi-solution-template/

49. You end up deploying this…

50. Monitoring with Power BI

51. What did I ignore for the sake of the demo?
• How do I make sure nobody bypasses API Management?
• It’s really painful to add the APIs by hand
• How do I operate this configuration mess?

52. Securing your backend
Azure API Management
Azure App Service
IP address restrictions
Shared secrets
Client certificates
Azure AD
(virtual network)

53. Securing your backend by APIM IP

54. Securing your backend with shared secrets

55. Securing your backend the enterprise ways

56. Not using “Add Blank API”

57. Swashbuckle to the rescue!

58. And finally, how to manage the config…
API Management
Management API
Azure Resource
Manager
Git
repository

59. Summary
• API Management is awesome
• But it’s a bit heavy and complicated – you need to invest both
money and brains into it
• There’s a lot I didn’t cover: versioning, SOAP/REST conversions,
developer portal customization, blogging…
• Luckily, the documentation is pretty good:
https://docs.microsoft.com/en-us/azure/api-management/

60. Extra tips
• Azure API Management UserVoice:
https://feedback.azure.com/forums/248703-api-management/
• Azure API Management Roadmap:
https://trello.com/b/FAA147vS/azure-api-management-product-
roadmap

62. Please do not forget to evaluate the
session before you leave by using our
Lollipolls!
AND go to Darrel Miller’s API Ecosystem
session tomorrow at 10:30 (in this room)!

63. That’s all folks!
Jouni Heikniemi
CEO/Consultant
Offbeat Solutions
Finland
@jouniheikniemi
jouni@offbeat.fi