Connect Azure API Management

You connect Azure API Management under Integrations → API Gateways. You give the connection a name and enter the service principal Client ID and Secret, plus your Tenant Id, Subscription Id, Resource Group, and Service ID. Then you run Test Connection. The core flow works on Azure today; some per-key operations do not yet.

Where do you connect Azure API Management?

Go to Integrations → API Gateways, choose + Add Gateway, and on Select an API Gateway Type pick Azure API Gateway, then connect.

1. Open Integrations → API Gateways.
2. Choose + Add Gateway.
3. On Select an API Gateway Type, select Azure API Gateway.
4. Confirm the selection to open the connect form. The gateway type is shown at the top.

What does each Azure field mean?

The connect form asks for a name and six Azure values. Client ID and Secret are write-only, so Apiable does not show them again after you save.

Apiable uses these to request an Azure access token and call the Azure Resource Manager API for your API Management service.

How do you set up a least-privilege service principal?

Create an app registration in Microsoft Entra ID, add a client secret, and assign it the built-in role API Management Service Contributor scoped to your API Management instance. That gives Apiable exactly the access it needs on one service, nothing wider.

1. In Microsoft Entra ID, go to App registrations and register a new application. Single tenant is enough, and no redirect URI is needed.
2. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID. These map to Client ID and Tenant Id in Apiable.
3. Under Certificates and secrets, add a new client secret. Copy its value immediately, since Azure shows it only once. This is the Secret in Apiable.
4. Open your API Management instance, go to Access control (IAM), and add a role assignment.
5. Assign the built-in role API Management Service Contributor, with the app registration as the member. Scope it to this API Management instance, not the whole subscription.

Apiable authenticates as this service principal, requests an Azure access token, and calls the Azure Resource Manager API for the one API Management service named by Service ID. With the role scoped to that instance, the credentials cannot reach other resources.

How do you test and save the Azure connection?

Fill in all seven fields, then click the refresh control labelled Test Connection. Apiable lists the APIs on your API Management service to confirm the credentials work. A green check reads passed; a red mark reads failed. Then click Save Changes.

1. Enter Name, Client ID, Secret, Tenant Id, Subscription Id, Resource Group, and Service ID. Test Connection stays disabled until all are filled.
2. Click the refresh control to run Test Connection. Apiable requests a token and lists the APIs on your service as the check.
3. Read the result: a green check means the test passed; a red mark means it failed.
4. Click Save Changes. The gateway appears on the API Gateways list with its Type, Created, and Edited times.

How do you point the Azure gateway at an Authorization Server?

Open the saved gateway and go to its Authorization tab. Choose the OAuth handler: Gateway-native only or Authorization Server. Picking Authorization Server reveals a picker of your connected servers.

The tab also shows a Level 0 API Key section and a Product-level governance pairing mode, then Save Changes. See Authorization Servers for how a bound server issues tokens.

Where do your Azure APIs appear after connecting?

They appear when you build a plan. Apiable lists the APIs on your API Management service, and you choose which the plan exposes. The connect form itself only sets up the connection.

When a consumer subscribes, Apiable creates an Azure product for the plan, attaches the plan's APIs to it, and creates an Azure subscription with primary and secondary keys. See APIs and coupling for picking APIs and how coupling works, and Plans for how plans sit on the gateway.

What does Apiable support on Azure API Management today?

The core flow: connect the gateway, sync its APIs, and deploy plan subscriptions as Azure products and subscriptions. Several per-key operations are not yet implemented on Azure.

These operations are not yet implemented on Azure:

• Rotating a subscription's secret.
• Enabling or disabling an individual API key.
• Validating that a plan already exists on the gateway.
• Reading usage per plan or per key from the gateway.

Troubleshooting

Match what you see to the fix.

Where to next