Chapter 3. Getting Started with API Apps

	Insufficient facts always invite danger.
	--Mr. Spock, Star Trek

Azure App Service is a fully managed Platform as a Service (Paas) for developers who makes it easier to build web, mobile, and integration apps. API Apps makes easy to build and consume your APIs in the cloud. It provides a rich platform and ecosystem in order to build, consume, and distribute APIs in the cloud and on-premise.

In this chapter, you will learn the following topics:

• How to build an API App and deploy it in Azure

• How to consume API Apps in different types of client application

• Different ways to secure your API App in Azure App Service

As discussed in the previous chapter, Azure App Service is a new fully managed PaaS platform in order to build web, mobile, and integration scenarios. API App is the big fundamental app type of four app types offered by Azure App Service (for more information, refer: https://docs.microsoft.com/en-us/azure/app-service/app-service-value-prop...

Why use API Apps?

API Apps in Azure App Service make it easy to develop, publish, and consume your APIs in cloud and on-premise. If you have some capability you want to expose as an API, you should deploy it as an API App to make use of these key benefits out of the box:

• A scalable RESTful API with enterprise-level security

• API discoverable using Swagger metadata

• Multiple language and framework support

• Automatic client SDK generation

• Visual Studio Integration

• Access on-premise data using Hybrid Connections

• Packaging and Marketplace support

• It can be used in a business process workflow by integrating it with Logic Apps:

The API App host takes care of managing authentication for the app, which helps developers get rid of the headache of implementing it themselves. They can now focus on developing the business logic and leverage API App features to secure it.

With enterprise-level security, you can use your secured API in any of your web app or mobile apps. API Apps also support the most popular and...

Building, hosting, and consuming your first API App

Let's start with the app.

What is Swagger?

Swagger is open source software that provides powerful metadata representation of your RESTful API. It is a specification for documenting RESTful APIs. It is machine-readable and language agnostic, so there are different implementations for different platforms.

In Azure API Apps, Microsoft adapts Swashbuckle to implement Swagger 2.0. So, the API you create can be easily discoverable using metadata in Swagger 2.0 format, which is widely accepted and supported.

Support for Swagger 2.0 (Refer: http://swagger.io/) API metadata is built into Azure App Service. Each API App can specify a URL endpoint that returns metadata for the API in Swagger JSON format. The JSON metadata returned from that endpoint can be used to generate client code.

If you have a Web API project, then to add Swagger to the project you need to install Swashbuckle via NuGet. Swashbuckle enables the way Swagger metadata is generated for...

Security

In this section, you will learn the various techniques used to implement security in Azure App Services. It offers services that implement the industry-renowned OAuth 2.0 and OpenID Connect protocols and work with multiple identity providers. A quick definition of some of the terms used across this chapter are provided later for easier understanding.

• Identity provider: Services responsible for providing authentication tokens for users looking to interact with a system, for example, Facebook, Google, and Microsoft.

• OAuth: This is an open source protocol that allows users to share their private resources such as photos, videos, or contacts lists stored on a site to another site without having to hand out their password. For example, you sign up for a music streaming service, and it offers you an option to share your playlist with your friends. It redirects you to Facebook to log in and then you are asked if you want to share your friend list with the streaming service. You click on...

What is App Service authentication and authorization?

Azure App Service authentication and authorization is a feature that provides a way for you to restrict access to your app services. It requires no complex configuration or writing any code for implementation. Let's see how it works and manages to do this.

Authentication

For app services users to get authenticated, we can choose from a set of identity providers (Azure Active Directory, Facebook, Google, Microsoft Account, and Twitter), or we can implement our own custom authentication mechanism.

To get authenticated using one of the identity providers, you first need to configure the identity provider to know about your application. The identity provider will then provide with IDs and secrets that we provide to the App service. After this, the users can be directed to an endpoint that enables them to sign in.

In the case of service-to-service scenarios, App Service can protect your application using Azure Active Directory. The calling application...

Summary

In this chapter, we discussed what an API App is, the benefits of API Apps, and how to develop API Apps using Visual Studio. We also discussed how easily we can host and secure our API in Azure. We will carry out the concept of API App throughout this book as this is a foundational exercise for the next-generation integration. In the next chapter, we will be discussing Azure API Management.