Explore API Management

Question 1

What does API Management (APIM) provide?

Answer 1

• core functionality to ensure a successful API program through dev engagement, business insights, analytics, security and protection
• devs subscribe to a product that contains an API, then they cna call the APIs operation, subject to any usage policies that may be in effect

Question 2

What is APIM made up of?

Answer 2

• API gateway, management plane and a dev portal
• all azure hosted and fully managed by default
• available in different tiers which vary in capacity and features

Question 3

What is API gateway?

Answer 3

Endpoint that…
-Accepts API calls and routes them to appropriate backends
- verifies API keys and other credentials presented with requests
- enforces usage quotas and rate limits
- transforms request and responses specified in policy statements
- caches responses to imrpvoe response latency and minimise the load on the backend service
emits logs, metrics and traces for monitoring, reporting and troubleshooting

Question 4

What is the management plane on APIM, what can we use it for?

Answer 4

Admin interface where you set up your API program and use it to…
- provision and configure API mgmt service settings
- define or import API schema
- package APIs into products
- set up policies like quotas or transformations on the APIs
- get insights from analytics
- manage users

Question 5

What is the developer portal in terms of APIM?

Answer 5

Auto generated, fully customisable website with the docs of your API where devs can…
- reads docs
- call API via interactive console
- create an account and sub to get API keys
- access analytics on their own usage
- download API definitions
- manage API keys

Question 6

What are products in APIM?

Answer 6

• How APIs are surfaced to devs
• Have one or more APIs and are configured with a title, description and T&Cs
• can be open or protected
• protected must be subscribed to before they can be used
• sub approval is configured at the product level and can either require admin approval or be auto approved

Question 7

What are the 3 groups in APIM?

Answer 7

Used to manage visibility of products to devs
- Admins = Manage API mgmt, create APIs and products
- Developers = Authenticated dev p[ortal users that build apps using APIs, can access dev portal
- Guests = unauthenticated dev portal uses, can be granted read-only access so view APIs but not call them

Question 8

What are developers in APIM?

Answer 8

• represent the user accounts in APIM instance
• can be created or invited to join by admins or can sign up from dev portal
• each dev is a member of one or more groups and can subscribe to the products that grant visibility to those groups

Question 9

What are policies in APIM?

Answer 9

• collection of statements which in turn contain expressions that are executed sequentially on the request or response of an API
• e.g. format conversion from XML to JSON or call rate limiting to restrict number of incoming calls from a dev
• can be applied at different scopes (global, product, specific API or specific API operation)

Question 10

What are policy expressions in APIM?

Answer 10

• can be used as attribute values or test values in any of the APIM policies unless the policy says otherwise
• some policies such as “control flow” and “set var” are based on policy expressions
• single C# statement enclosed in a @(expression) or multi statement C# code block enclosed in a @{expression} that returns a value

Question 11

What does the API gateway manage?

Answer 11

• responsible for proxying API requests, applying policies and collecting telemetry
• decouples client from the services
• sits between clients and services acting as a reverse proxy by routing requests from clients to services
• may also perform cross-cutting tasks such as auth, SSL termination and rate limiting
• if you dont deploy a gateway clients must send requests directly to back-end services

Question 12

What are the issues with exposing services directly to clients in relation to APIM?

Answer 12

• can lead to complex client code as client has to keep track of multiple endpoints and handle failures in a resilient way
• creates coupling between client and backend
• single operation might require calls to multiple services
• services with public endpoints are a potential attack surgace

Question 13

what is the managed APIM gateway?

Answer 13

• default component that is deployed in Azure for every APIM instance in every service tier
• all API traffic flows through azure regardless of where backends implementing the APIs are hosted

Question 14

what is self hosted APIM gateway?

Answer 14

• optional, containerised version of default gateway thats useful for hybrid and multicloud scenarios
• Enables customers with hybrid IT infra to manage APIs hosted on prem and across clouds from a single APIM service in azure

Question 15

What do APIM policies allow?

Answer 15

• publisher to change the behaviour of the API through config
• applied inside the gateway that sits between the API consumer and the managed API
• Can apply changes to requests and response inside the gateway before passing onto the API/Client

Question 16

What is an APIM policy defintion?

Answer 16

• XML that describes a sequence of inbound and outbound statements

<policies>
<inbound>statements to be applied to request go here</inbound>
<backend>statements to be applied before the request is forwarded to backend go here</backend>
<outbound>statements to be applied to the response go here</outbound>
<on-error>statements to be applied if theres an error go here</on-error>
</policies>

Question 17

what is the context var in terms of policy expressions in APIM?

Answer 17

• each expression has access to the var and an allowed subnet of the .NET framework types
• provides a sophisticated means to control traffic and modify API behaviour without requiring you to write specialised code or modify backend services

Question 18

Example of a policy statement that adds user data to incoming request

Answer 18

<policies>
<inbound>
<base></base>
<set-header>
<value>@(context.User.Id)</value>
<value>@(context.Deployment.Region)</value>
</set-header>
</inbound>
</policies>

Question 19

what is the <base></base> tag in policy statement?

Answer 19

• allows for ordering of statements
• anything before that element executes first, then anything after that element executes

Question 20

What is control flow in APIM policies?

Answer 20

• conditionally applies policy statements based on the results of the evaluation of boolean expressions
• <choose> applies enclosed policy statements based on the outcome of expressions (if-then-else)
  </choose>

<choose>
<when>...</choose>
<when>...</choose>
<otherwise>…</otherwise>
</choose>
</when></when></choose>

Question 21

What is a forward request in APIM policies?

Answer 21

• Forwards the request to the backend service
• backend service URL is specified in the API settings
• policies in the outbound section are evaluated immediately upon the successful completion of the policies in the inbound section

<forward-request></forward-request>

Question 22

What is the limit concurrency tag in APIM policies?

Answer 22

• Prevents enclosed policies from executing by more than the specified number of requests at a time
• when requests exceed the limit they fail with 429 too many requests

<limit-concurrency>…</limit-concurrency>

Question 23

What is the log to event hub tag in APIM policies?

Answer 23

• sends msgs in the specified format to an event hub defined by a logger entity
• used to save selected requests or response context info for online or offline access

<log-to-event-hub>Expression returning a string to be logged</log-to-event-hub>

Question 24

What is the mock response tag in APIM policies?

Answer 24

• Aborts pipeline execution and returns a mock response directly to the caller
• prefers response content example whenever available
• Generates sample responses from schemas when provided and examples if no schemas

<mock-response></mock-response>

Question 25

What is Retry tag in APIM policies?

Answer 25

- Retries execution of the enclosed policy statements if and until the condition is met - Repeats at specified time intervals and up to the specified retry count …

Question 26

What is return response tag in APIM policies?

Answer 26

- Aborts pipeline execution and returns either a default or custom response to the caller - Default is 200 ok with no body