Chapter 4. What is Azure API Management?

In the previous chapters, we have discussed what integration is in the new world of cloud computing and taken a look at how we can start building these integrations through the use of an Azure App Service plan and API Apps.

In order to understand how this applies more readily to an enterprise, it is important to know how to control and manage API assets that exist or are built as part of any enterprise development.

Typically, modern APIs are used to achieve one of the following two outcomes:

• To expose the on-premises line of business applications, such as Customer Relationship Management (CRM) or Enterprise Resource Planning (ERP) solutions to other applications that need to consume and interact with these enterprise assets both on-premises and in the cloud

• To provide access to the API for commercial purposes to monetize access to the assets exposed by the API

The latter use case is important as it allows organizations to extend the use of their API investment...

The anatomy of Azure API Management

To understand how to get the best out of an API, it is important to understand some terms that are used for APIs and within Azure API Management, and these are described here.

API and operations

An API provides an abstraction layer through an endpoint that allows interaction with entities or processes that would otherwise be difficult to consume.

Most API developers favor using a RESTful approach to API applications since this allows us easy understanding on how to work with the operations that the API exposes and provides scalability, modifiability, reliability, and performance. Representational State Transfer (REST) is an architectural style that was introduced by Roy Fielding in his doctoral thesis in 2000:( http://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arch_style.htm ).

Typically, modern APIs are exposed using HTTP since this makes it easier for different types of clients to interact with it, and this increased interoperability provides...

Working with Azure API Management

Azure API Management is the outcome of the acquisition by Microsoft of Apiphany, and as such it has its own management interfaces. Therefore, it has a slightly different look and feel to the standard Azure Portal content.

The Developer portal and Publisher portal are described in detail in this section, but first a new instance of API Management is required.

Once created (and the provisioning in the Azure infrastructure can take some time), most interactions take place through the Developer portal and Publisher portal.

Creating your first Azure API Management instance

Azure API Management is accessed via the Classic Portal:

The creation of an instance is straightforward and follows three steps via a wizard:

1. Enter the URL, which has to be globally unique and choose the SUBSCRIPTION and the REGION.

   

2. Enter an ORGANIZATION NAME, which appears on the portals, and an ADMINISTRATOR E-MAIL address to which alerts and requests for access are sent. By default, a developer...

Policies in Azure API Management

In order to provide control over interactions with products or APIs in Azure API Management, policies are used. Policies make it possible to change the default behavior of an API in the product, for example, to meet the governance needs of your company or product, and are a series of statements executed sequentially on each request or response of an API. Three demo scenarios will provide a taster of this powerful feature of Azure API Management.

How to use Policies in Azure API Management

Policies are created and managed through the Publisher portal.

The first step in policy creation is to determine at what scope the policy should be applied. Policies can be assigned to all products, individual products, the individual APIs associated with a product, and finally the individual operations associated with an API. This will be demonstrated further.

Click on the Policies option from the sidebar to specify the policy scope and to define the policy using an XSLT-like...

Securing your API in Azure API Management

We have previously discussed how it is possible to organize APIs in products with those products further refined through the use of policies.

Access to and visibility of products is controlled through the use of groups and developer subscriptions for those APIs requiring subscriptions.

In most enterprise scenarios where you are providing access to some line of business system on-premises, it is necessary to provide sufficient security on the API endpoint to ensure that the solution remains compliant.

There are a number of ways to achieve this level of security using Azure API Management, such as using certificates, Azure Active Directory, or extending the corporate network into Microsoft Azure using a Virtual Private Network (VPN), and creating a hybrid cloud solution.

Securing your API backend with mutual certificates

Certificate exchange allows Azure API Management and an API to create a trust boundary based on encryption that is well understood and...

Monitoring your API

Any application tool is only as good as the insight you can gain from the operation of the tool.

Azure API Management is no exception and provides a number of ways of getting information about how the APIs are being used and are performing.

Analytics in the Publisher portal

Developers are provided access to analytics information regarding their own usage of APIs through the Developer portal on their profile page by clicking on the Analytics button.

This is a subset of the full data provided by the Publisher portal. In the Publisher portal, access to the organization's API usage information is via the Analytics link on the side menu.

When opened, a summary page is shown containing a roll-up of information in other sections including API by API usage.

Clicking on Usage in the navigation tab shows the overall usage and bandwidth information for the API instance along with an indication on where calls originated. The information is further broken down by API.

Usage information...

Summary

API Management can be used to provide developer access to key information in your organization, information that could be sensitive, or that needs to be limited in use.

Through the use of products, policies, and security, it is possible to ensure that firm control is maintained over the API estate.

The developer experience can be tailored to provide a virtual storefront to any APIs along with information and blogs to help drive deeper developer engagement.

Although not discussed in this chapter, it is also possible for developers to publish their own applications to the API Management instance for other developers to use.

API Management is an important tool in the management, governance, and monitoring of your organization's API assets.