Transform and protect your API using Azure APIM with a detailed explanation

Transforming and protecting APIs in Azure API Management (APIM) is a critical aspect of ensuring that your APIs are secure, scalable, and optimized for consumption. Azure APIM provides a rich set of policies to transform requests and responses, as well as protect APIs from unauthorized access, abuse, and attacks.

In this explanation, we’ll cover:

1. Transforming APIs: Modifying requests and responses (e.g., headers, body, URL).
2. Protecting APIs: Securing APIs with authentication, rate limiting, and IP filtering.

We’ll use a live example to demonstrate these concepts.

1. Transforming APIs in Azure API Management

Transforming APIs involves modifying the request or response to meet specific requirements. Common use cases include:

• Adding or removing headers.
• Modifying the request/response body.
• Rewriting URLs.
• Converting data formats (e.g., XML to JSON).

Example: Transforming a Request and Response

Let’s assume we have an API that returns user details in XML format, but we want to transform the response to JSON for better compatibility with modern clients.

Step 1: Create an API in Azure APIM

• Go to the Azure portal and navigate to your API Management instance.
• Create a new API (e.g., GET /users) or use an existing one.

Step 2: Add Transformation Policies

Azure APIM uses XML-based policies to transform requests and responses. Here’s how you can transform the response from XML to JSON:

<policies>
    <inbound>
        <base />
        <!-- Forward the request to the backend -->
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
        <!-- Transform the response from XML to JSON -->
        <xml-to-json kind="direct" apply="always" consider-accept-header="false" />
        <!-- Add a custom header -->
        <set-header name="Content-Type" exists-action="override">
            <value>application/json</value>
        </set-header>
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Step 3: Test the API

• Send a GET request to /users.
• The backend returns XML:

  <users>
      <user>
          <id>1</id>
          <name>John Doe</name>
      </user>
      <user>
          <id>2</id>
          <name>Jane Smith</name>
      </user>
  </users>

• After transformation, the response will be in JSON:

  {
      "users": {
          "user": [
              { "id": 1, "name": "John Doe" },
              { "id": 2, "name": "Jane Smith" }
          ]
      }
  }

2. Protecting APIs in Azure API Management

Protecting APIs involves securing them against unauthorized access, abuse, and attacks. Azure APIM provides several policies for this purpose, including:

• Authentication: Validate API keys, JWT tokens, or OAuth tokens.
• Rate Limiting: Control the number of requests per second/minute.
• IP Filtering: Restrict access based on client IP addresses.

Example: Protecting an API with Authentication and Rate Limiting

Step 1: Enable API Key Authentication

• Go to the API in Azure APIM.
• Under the Settings tab, enable Subscription Required. This ensures that clients must provide an API key to access the API.

Step 2: Add Rate Limiting Policy

Add a rate-limiting policy to restrict the number of requests to 10 requests per minute per subscription.

<policies>
    <inbound>
        <base />
        <!-- Validate API key -->
        <validate-subscription exists-action="error" />
        <!-- Rate limiting: 10 requests per minute -->
        <rate-limit calls="10" renewal-period="60" />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Step 3: Test the API

• Send a GET request to /users without an API key. You’ll receive a 401 Unauthorized error.
• Send a request with a valid API key. The first 10 requests will succeed, but the 11th request will return a 429 Too Many Requests error.

3. Advanced Protection: IP Filtering

You can restrict access to your API based on the client’s IP address. For example, allow only requests from specific IP ranges.

Example: IP Filtering Policy

<policies>
    <inbound>
        <base />
        <!-- Allow only requests from specific IP ranges -->
        <ip-filter action="allow">
            <address-range from="192.168.1.0" to="192.168.1.255" />
        </ip-filter>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

• Requests from IPs outside the range 192.168.1.0/24 will be blocked with a 403 Forbidden response.

Live Example: Transforming and Protecting a Weather API

Let’s assume we have a backend weather API that returns data in XML format. We want to:

1. Transform the response to JSON.
2. Protect the API with API key authentication and rate limiting.

Step 1: Define the API

• Create an API in Azure APIM with an operation GET /weather.
• Add a query parameter city.

Step 2: Add Transformation and Protection Policies

<policies>
    <inbound>
        <base />
        <!-- Validate API key -->
        <validate-subscription exists-action="error" />
        <!-- Rate limiting: 5 requests per minute -->
        <rate-limit calls="5" renewal-period="60" />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
        <!-- Transform response from XML to JSON -->
        <xml-to-json kind="direct" apply="always" consider-accept-header="false" />
        <!-- Add a custom header -->
        <set-header name="Content-Type" exists-action="override">
            <value>application/json</value>
        </set-header>
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Step 3: Test the API

• Call GET /weather?city=London with a valid API key.
• The backend returns XML:

  <weather>
      <city>London</city>
      <temperature>15</temperature>
      <unit>Celsius</unit>
  </weather>

• After transformation, the response is in JSON:
  

  {
      "weather": {
          "city": "London",
          "temperature": 15,
          "unit": "Celsius"
      }
  }

• If you exceed the rate limit (5 requests per minute), you’ll receive a 429 Too Many Requests error.

Benefits of Transforming and Protecting APIs in Azure APIM

1. Improved Security: Protect APIs from unauthorized access and abuse.
2. Enhanced Compatibility: Transform data formats to meet client requirements.
3. Scalability: Control traffic with rate limiting and caching.
4. Flexibility: Customize API behavior using policies.