Mastering Azure API Management Policies with 3 Practical Cases

Azure API Management service (APIM) comes with a rich policy library that enables you to manage, secure, and manipulate requests/responses in a centralized and scalable way. With over 70+ types of policies, however, it's easy to be lost. In this post, I'll walk you through 3 real-world, use-case scenarios that illustrate how to successfully compose these policies together. Each case contains a full policy block and a short description of every policy used. Let's begin. ✨ Case 1: Securing and Optimizing an AI-Powered API Scenario: You're building an API that connects to Azure OpenAI. The API must be secure, enforce token limits, cache responses intelligently, and log usage for cost control. v1 AzureAPIM @{ return "Tokens used: " + context.Variables["total_tokens"]; } Explanation: validate-jwt: Ensures only authorized users access the API. rate-limit: Prevents abuse by throttling calls. azure-openai-token-limit & emit-token-metric: Enforces OpenAI token constraints and usage logging. semantic-cache-lookup/store & cache-lookup/store: Layered caching improves performance. check-header: Validates required custom headers. set-header: Adds branding info. log-to-eventhub: Sends logs to Event Hub for auditing. ⚡ Case 2: Internal Microservices Gateway with Data Transformations Scenario: You’re building a gateway API for internal microservices that include Dapr bindings, Cosmos DB access, and advanced XML/JSON transformations. SELECT * FROM c WHERE c.type = 'event' https://other-microservice/api Explanation: authentication-managed-identity: Secure Cosmos DB access. json-to-xml / xml-to-json: Flexible data formatting. invoke-dapr-binding: Triggers Dapr components. cosmosdb-data-source: Pulls data into pipeline. limit-concurrency: Prevents overload. send-request: Connects to another internal API. find-and-replace: Cleans outbound data. emit-metric: Custom usage metric.

Apr 15, 2025 - 17:12

Mastering Azure API Management Policies with 3 Practical Cases

Azure API Management service (APIM) comes with a rich policy library that enables you to manage, secure, and manipulate requests/responses in a centralized and scalable way. With over 70+ types of policies, however, it's easy to be lost. In this post, I'll walk you through 3 real-world, use-case scenarios that illustrate how to successfully compose these policies together.

Each case contains a full policy block and a short description of every policy used. Let's begin.

✨ Case 1: Securing and Optimizing an AI-Powered API

Scenario:
You're building an API that connects to Azure OpenAI. The API must be secure, enforce token limits, cache responses intelligently, and log usage for cost control.


  
     header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
       url="https://login.microsoftonline.com/YOUR-TENANT/v2.0/.well-known/openid-configuration" />
    
     calls="100" renewal-period="60" />
     max-tokens="2048" />
     name="total_tokens" />
     />
     vary-by-developer="true" />
     name="x-api-version" failed-check-httpcode="400" failed-check-error-message="Missing API version header">
      v1
    
     name="x-powered-by" exists-action="override">
      AzureAPIM
    
  
  
     />
  
  
     duration="300" />
     />
     logger-id="openai-logger">
      @{ return "Tokens used: " + context.Variables["total_tokens"]; }

Explanation:

validate-jwt: Ensures only authorized users access the API.
rate-limit: Prevents abuse by throttling calls.
azure-openai-token-limit & emit-token-metric: Enforces OpenAI token constraints and usage logging.
semantic-cache-lookup/store & cache-lookup/store: Layered caching improves performance.
check-header: Validates required custom headers.
set-header: Adds branding info.
log-to-eventhub: Sends logs to Event Hub for auditing.

⚡ Case 2: Internal Microservices Gateway with Data Transformations

Scenario:
You’re building a gateway API for internal microservices that include Dapr bindings, Cosmos DB access, and advanced XML/JSON transformations.


  
     resource="https://cosmos.azure.com/" />
     base-url="https://microservice.internal" />
     max-size="102400" />
     apply="always" />
     binding-name="sendEmail" operation="create" />
    
      SELECT * FROM c WHERE c.type = 'event'
    
     count="10" />
     name="env" value="internal" />
  
  
     mode="new">
      https://other-microservice/api
    
  
  
     apply="always" />
     from="error" to="issue" />
     name="microservice_usage" value="1" />

Explanation:

authentication-managed-identity: Secure Cosmos DB access.
json-to-xml / xml-to-json: Flexible data formatting.
invoke-dapr-binding: Triggers Dapr components.
cosmosdb-data-source: Pulls data into pipeline.
limit-concurrency: Prevents overload.
send-request: Connects to another internal API.
find-and-replace: Cleans outbound data.
emit-metric: Custom usage metric.