Deploy and Configure API Management

0:00<v ->Welcome to the content on Azure's API Management Tool.</v>

0:04API Management is a big, big resource,

0:08and that's one of the reasons

0:09why it takes a really long time to deploy.

0:12You might be familiar with other Cloud providers'

0:15API Gateway Solution

0:17and an API Gateway is a piece of the puzzle here.

0:20It is one of the resources

0:22that gets deployed when we deploy API Management.

0:25But there's a couple other things

0:27that come with API Management under the hood,

0:29and all of a sudden, understanding what this thing

0:32is really capable of becomes a big deal.

0:34That's actually gonna help you understand

0:36and determine which size API management resource

0:40is gonna work best for you.

0:42So in this set of videos

0:43what we're really focused in on is, first of all,

0:45what is API management, and it's not the management of APIs.

0:49The actual name of the resource is API Management.

0:53Then we'll talk about how do we understand what right sizing

0:56and capabilities are we actually gonna need

0:59when we start working with API management.

1:01Then we'll deploy an API Management resource, which again,

1:05clear some time for, it can take an hour or more to deploy.

1:09Then we'll actually work with implementing APIs

1:12in API management and more, policies,

1:15how do we control traffic as it flows

1:19through our API backbone?

1:20This is a huge thing to understand

1:23because especially in the platform as a service world,

1:26in the microservices world, what we typically see

1:30are computers or applications talking to other computers

1:34and other applications.

1:36This is what APIs do.

1:38It enables or facilitates the transfer of data from one app

1:42to the next, and that's really

1:44what makes Microservices work.

1:46So sitting at the center of it all is API management,

1:50and that's why we're beginning our entire journey

1:53with API Management first.

1:55So a big set of videos coming up right here,

1:58API Management is not a small resource

2:00to understand or deploy.

2:02So get ready as we start to explore

2:04one of the first clutch crucial core

2:07platform as a service offerings

2:09that exist in Azure, let's go.

0:00<v Instructor>So, what is Azure API Management?</v>

0:03Look, as part of your journey as a developer,

0:05as a learner,

0:06someone who's seriously considering going through

0:09with the certification exam,

0:10one of the things

0:11you need to get familiar with right now is documentation.

0:15Documentation is,

0:17I repeat, is your best friend in your professional journey,

0:22not just your certification journey,

0:23in your professional journey.

0:25There's great diagrams, there's code samples,

0:28there's quick starts to help you get up and running.

0:30Now, of course, CBT Nuggets is also your best friend

0:34and I'm here to break down some of these key concepts

0:38and help you understand and get started even quicker.

0:41This is how Microsoft documentation

0:44is typically broken down.

0:45You really wanna focus in, first of all,

0:47on the left-hand side of the menu.

0:49You'll see, first of all, an overview.

0:51This is gonna give you your crash course

0:53on what it is that this particular resource does.

0:57Then you'll see some service-specific items,

0:59like features availability,

1:01where would this be available or not available,

1:04and then service limits,

1:05basically depending on how much you wanna pay,

1:07what can it do up to a certain limit?

1:10Quickstarts are gonna help you do something quickly.

1:13In this case,

1:14these quickstarts are just helping you create the instance.

1:17It's not so much about working with it,

1:19which is why you have me,

1:20I'm gonna help you work with it.

1:22Tutorials then start helping you working with it,

1:25usually doing one specific thing.

1:28In the case of API Management,

1:30it can do about 20 specific things,

1:32about a million specific things,

1:34so tutorials are a great way to help you get started.

1:37Samples are also exactly what they say.

1:40Usually they're code samples,

1:42in this case, they show you policy snippets.

1:45That'll make more sense

1:46when we start talking about policies

1:48towards the end of this set of videos.

1:51Concepts are where they start to get into keywords

1:53and understanding the actual architecture

1:56and workflows of what this particular resource can do.

2:00And how-to guides are exactly what the name implies here,

2:03how to perform some specific type of action

2:06with API Management.

2:08Now, immediately out of the gate,

2:09what are the things that I want you to know

2:11about API Management?

2:12First of all, platform as a service.

2:16You are not going to be responsible

2:19for managing the operating system,

2:21the security patching,

2:23even the actual architecture itself.

2:25For instance, if you think about API gateways in general,

2:29what does an API gateway do?

2:31Here, let's actually draw it up on the screen.

2:33Here, I'll just fire up my terminal

2:34and go full screen in the terminal

2:35so that we can talk about this.

2:37At the end of the day, when we have APIs,

2:39we're gonna have lots of APIs,

2:41especially for our microservices architecture.

2:44We might have APIs running in containers.

2:48These containers might be using Azure Container Instances

2:53or Azure Kubernetes Services.

2:56We might be running them on Azure App Services,

2:59App Services,

3:00the closest thing that I could akin it to

3:02within the AWS ecosystem would be Elastic Beanstalk.

3:06Azure's app services

3:08are a platform-as-a-service web hosting solution

3:12where they manage all of the web hosting itself

3:15and you just ship your code to it,

3:17perfect for APIs.

3:19These could even be running

3:20as other platform-as-a-service offerings,

3:22like a function app for compute resources

3:26or maybe something like the Queue Storage solution

3:30for managing data in a queue.

3:33The point is, as you start to grow

3:35and mature with platform-as-a-service offerings

3:38or development within cloud providers like Azure,

3:42you're gonna have a lot of APIs,

3:45and maybe it's end users

3:47who are interacting with your function app

3:49or maybe it's other resources in Azure

3:52that are interacting with your function app.

3:55And maybe your function app

3:56is interacting with the queue service

3:58and maybe containers are listening to the queue service,

4:01and this is how it all starts to get out of hand.

4:05What API Management does

4:07is it sits in front of all of this stuff

4:09and it serves as a reverse proxy,

4:13I'm gonna put R proxy right there like that,

4:15and it gives you, the API administrator,

4:18a single pane of glass to look into all of your APIs

4:22that you have available in your entire ecosystem.

4:26This is the API Gateway solution.

4:30The API Gateway is your data plane.

4:35When a request comes in,

4:36it's gonna hit your API Gateway first,

4:39and the API Gateway is a layer seven inspection tool

4:45that can look at what's going on exactly

4:47with this particular request.

4:49Where was it destined?

4:50What headers did it have?

4:52What size was the payload?

4:54Any other additional things

4:56that we need to know about this particular request

4:59can help us determine what to do with it.

5:02The API Gateway from there can then pass it back

5:06to the resource that it's proxying.

5:10This can also serve as a point of SSL and TLS termination.

5:15Because it's platform as a service,

5:17you can think of it as nearly infinitely scalable,

5:21so it's a great candidate to offload

5:24that heavier compute operation

5:26of SSL and TLS encryption and termination.

5:30But beyond that,

5:31with the power to inspect what's going on

5:33with layer seven data,

5:36the payload itself, the headers,

5:38the actual URL that's requested,

5:41we can also, as the traffic is being moved to the backend

5:46or responses are being returned

5:48to the actual API Management,

5:50we can apply policies.

5:55Policies can add logic

5:57into helping API Management make decisions on what to do.

6:02For instance, we may have a request that comes in

6:05and it's typically destined for the Lambda function,

6:08but if the body size, the actual payload itself,

6:12is too big over a certain limit in kilobytes,

6:16we can use a policy to redirect it to something else

6:19like an app service.

6:21We can also check for authentication.

6:25If the correct authentication parameters were provided,

6:29pass it to the backend,

6:30otherwise, maybe redirect it to a queue for processing.

6:35By using one single resource to manage all of our APIs

6:39and all of their logic,

6:41we now have a single place where we can manage what goes on

6:45for all of the APIs in our entire environment

6:48without having to create a whole lot of custom code.

6:52I'm here to tell you right now,

6:53you might not see or very likely will not see

6:57any actual API code at all in this particular set of videos

7:02when we're working with API Management.

7:04The exception to that, I'll say, is policies right there

7:07for the longest time have been written in XML.

7:11So go ahead and prepare yourself mentally

7:13for that right now.

7:15When we start talking about policies,

7:16you'll start seeing policies written in XML.

7:20It's not that bad.

7:21It's not that bad, I promise,

7:23you're gonna see,

7:24but that's really the only code you're gonna see

7:27when working with API Management.

7:29Now, here's when I'm gonna clear the screen

7:30and start flipping things on your head.

7:32The API Gateway,

7:34right here I'm gonna put API GW,

7:38this was the data plane,

7:40and this is where data came in,

7:42data, new requests are gonna come in

7:44and hit the API Management URL first

7:48before they get processed and sent to the backend

7:51where they're also awaiting responses.

7:53But that's not the only thing you're getting

7:55when you get API Management,

7:57it's not just an API Gateway,

8:00you're also going to get the API Management plane itself.

8:08This is the brains of the operation

8:10or the control plane.

8:13When you start interacting with the control plane,

8:16this is you, the administrator,

8:18who's actually managing and deploying new APIs

8:21to the API Management.

8:23For instance,

8:23I've just deployed a new function app right here

8:27and now I want this to be proxied by API Gateway,

8:30and I wanna be able to write new policies

8:33for this function app.

8:34This is all handled in the control plane.

8:38The control plane allows you to manage your APIs,

8:42and with that comes one other additional benefit,

8:45the third resource that actually comes with API Management,

8:49the developer portal.

8:53Typically, when you create APIs,

8:55you're creating them for somebody else to consume,

8:58maybe that's somebody within your organization itself,

9:02a different dev team,

9:05or maybe you have something

9:06like a business-to-business arrangement

9:09where a customer or a partner, a business,

9:12needs to start interacting with your APIs.

9:15With the dev portal,

9:17you could actually publish your API specs to the dev portal.

9:23Your customers or partners register with the dev portal

9:30and then they request access

9:32to specific APIs on the backend.

9:35Of course, these will be accessed through the API Gateway,

9:40but when they need to understand what methods are available,

9:43what are the expected payloads,

9:45what are the expected parameters,

9:48what query strings are available,

9:49and in what data formats,

9:51what authorization or authentication is needed

9:53to actually access these,

9:55all of that is presented through the dev portal.

9:58It is a standing website that you manage

10:03and developers interact with.

10:05This could be public,

10:06this could be private,

10:07this could be integrated with Azure AD,

10:11as long as you get the correct licensing.

10:14So in your Azure AD,

10:16you could actually create some sort of a trust, so to speak,

10:21with your customer's domain,

10:23and then, in API Management, start granting privileges

10:27and permissions to your customers through Azure AD.

10:32Again, this depends on the licensing tier

10:34that you set for API Management.

10:37That's not a available feature

10:39until you get standard or premium.

10:41I wanna point that out right now,

10:43the integration with Azure AD doesn't begin

10:45until you get standard or premium,

10:46but nonetheless,

10:47these are the things that come with API Management.

10:50When you get API Management

10:52and deploy API Management,

10:54you get the data plane,

10:55which is what you expect, the API Gateway,

10:58but you also get the control plane

11:00and the dev portal with it.

11:03This is a really, really big resource,

11:06and this is why this is one of the rare times in Azure

11:09that it takes a long time to deploy this resource.

11:12It takes 45 minutes or more to deploy this.

11:17The last time I deployed it,

11:18it was like an hour and 10 minutes,

11:20but once it's up and running,

11:22you've got a really, really powerful tool at your disposal

11:25that can then start serving

11:27as a way to manage your various APIs and microservices

11:32that you can deploy throughout Azure.

11:34Oh, did I mention that this was fully scalable too?

11:38That was a big part of it, here is.

11:39Again, I can't reiterate this enough,

11:42you're not deploying a virtual machine here,

11:45you're not creating any IP address filters,

11:47at least not by default, you can,

11:50you don't have to worry about security patches,

11:54you're not managing any sort of NGINX server

11:56'cause NGINX does serve as a great API gateway,

11:59no, all of that is done for you.

12:02You get to focus on the solution itself,

12:04shipping and managing your API exactly the way you want to.

12:09You get to focus in on your product

12:11and not all of the underlying overhead that goes with it.

12:15This is why we start with API Management on this journey

12:18and this is why we're starting

12:19with a platform-as-a-service offering.

12:21Now, in the next video,

12:22we're gonna roll up our sleeves and deploy it.

12:24We're gonna look at a couple different ways to deploy it,

12:26so let's get going.

12:27I hope this has been informative for you,

12:28and I'd like to thank you for viewing.

0:00<v Instructor>Okay, so where do we go</v>

0:01to get logged into Azure?

0:03One more time, say it with me. portal.azure.com.

0:07Don't forget it.

0:08That's where we're gonna go.

0:09I'm gonna go ahead and get signed in.

0:11Use my multi-factor authentication code.

0:14And I'm gonna say, yeah, I wanna stay signed in.

0:16We're gonna be working here for a while.

0:18And we've got a little trouble with the portal.

0:20I'm gonna click Try Again real quick and it should,

0:239 times outta 10, this really does just flip

0:25right on for me here.

0:26Come on, come on there. There we go.

0:28See, you just hit Try Again until it works.

0:29Sometimes that happens, especially when I'm using

0:32my multi-factor authentication code

0:34and takes forever to get going.

0:36Okay, I'm gonna search for API management.

0:38We're gonna first do this from the portal

0:42so that way we can see how to do this from the portal.

0:44And then I'm also gonna show you

0:46how to do this with PowerShell.

0:47So I'm gonna search for API management services.

0:50That is what we're trying to deploy.

0:52And then we're gonna click right here, dead center,

0:54"Create API Management service."

0:57Okay, now get used to this dialogue as we go through this.

1:01Remember what I said, every resource needs

1:04subscription, resource group, region.

1:08That's every single resource that you deploy

1:10is gonna ask you for these three things

1:13when you get started.

1:14Now, subscription is not something I can just create

1:17on the fly, but resource groups actually are.

1:20I can create a new resource group by clicking Create New.

1:23I can give it a new name.

1:25I'll call this "knoxsapim".

1:28How about that?

1:29To put my API tools or my API resources,

1:33like grouped together, I'm gonna put them

1:35in that resource group like so.

1:37I'm also gonna put this in the south-central US,

1:40just because that's close to me.

1:41It's a nice close proximity.

1:43Now we're gonna go down here and choose the resource name.

1:46We'll call this "knoxsapim" again, just to give it a name.

1:50Knox's API management.

1:52Now the organization name, this is starting

1:54to get into that developer portal stuff right here.

1:58We need to be able to present to our outside users

2:01or the people who are consumer API, let them know who it is

2:05that they're actually working with and connecting to here.

2:07I'm gonna call this organization name "Knox's Data"

2:11and I'm gonna type in my administrator email,

2:13knox@knoxsdata.com.

2:16Now, the pricing tier.

2:18I did say we were gonna talk about this

2:19for a little bit, didn't I?

2:21If you actually click on the I right here,

2:22it'll tell you, "Explore the pricing tiers,"

2:24and then you can click Learn More.

2:27When you get down here, scroll down to the pricing tiers

2:30and you see across the top, the column headers here,

2:33are each individual tier that you can have.

2:37Consumption is literally pay for what you use.

2:40It's not a flat fee per month.

2:42It is billed per execution.

2:45The first million API operations

2:48per subscription are included.

2:50After you go over 1 million API operations,

2:54you're looking at four point, you know,

2:564.20 cents per 10,000 operations.

3:01So if you extrapolate that by another million, it's $4.20.

3:05Now, if you don't want the lightweight serverless version,

3:08even though it's all platform-as-a-service

3:10behind the scenes, it's all really serverless for you.

3:13You can go up to Developer,

3:15which will give you a $48 a month charge,

3:18and we start to see where this really comes into play.

3:22The developer license is to help you get started

3:24developing with API management behind the scenes.

3:28If you're going to have development environments

3:31in your cloud, it makes a lot of sense

3:32to have the developer API management.

3:35For instance, you may have a development function app

3:39before it gets shipped into the production

3:42function app slot.

3:43The development function app should probably

3:45be behind a development API management tool.

3:49Notice the big thing about that though, no SLA.

3:53However, it does add cache, and it does add, well,

3:56one scale out units with automatic scaling.

4:00The other thing that I would point out, a big one

4:02that may be a factor for you in the consumption environment,

4:04is that this does have limits that apply here.

4:07Whereas when you start paying the flat fee per month,

4:10there are no limits of how much consumption

4:13or how much this can actually use.

4:16Now when you start to scroll down,

4:18you see some other cool things that come with this.

4:20The developer portal starts kicking in

4:22with the developer license, as opposed to using

4:24the consumption based license.

4:26You have the ability to use multiple custom domain names.

4:29Now the developer license is integrated with Azure AD.

4:32I know I said that that didn't start until standard,

4:35and I'm gonna stick by what I said on this one.

4:37This is really, this is still for a developer environment.

4:41This is not to be actually published out into production.

4:45This is really to help you build and test.

4:48Once you start shipping into production,

4:50that's when you start to see your Azure AD

4:54actually being consumed by developers

4:56in the standard license right there.

4:59Scroll down some more and notice some other things here

5:01like availability zone support, or virtual network support,

5:06multi-region deployment support.

5:08Even the ability to self host your own API gateway

5:11comes up, not until you get way down into the tiers

5:15towards premium and isolated.

5:17Now, the final thing to understand about Azure API

5:20management is that it works with the concept of units.

5:24And ultimately what you should be thinking about

5:26and how to scale this and properly size it is gonna be

5:29what is your maximum throughput, again, per unit.

5:33One unit is going to equal 500 requests per second

5:37in the Developer tier, 1,000 in Basic,

5:392,500 in Standard, and 4,000 in Premium.

5:43But remember when you start going higher in price,

5:47you also get the ability to scale out units.

5:50So you have one unit in Developer.

5:52You can scale out to two units in Basic.

5:55Four in Standard, 12 per region in Premium.

5:59So make sure you do the math and understand

6:02that when you get something like Basic,

6:04which does 1000 requests per second per unit,

6:07and we can scale up to two units,

6:09that really means you can get 2000 requests per second.

6:14I say this again, because look,

6:15the jump in prices is not insignificant.

6:18It can get pretty pricey.

6:20Although for very large enterprises,

6:232,800 bucks a month is not that bad.

6:27But to be fair, that is, again, per unit.

6:32Okay, so with that being said, I'm gonna jump back

6:34to create API management and I'm gonna leave this

6:36on the Developer tier right here.

6:39We'll choose to go to the next section right here

6:41where we have monitoring.

6:43We can turn on application insights right here.

6:46This digs a little bit deeper.

6:48We haven't talked about application insights yet.

6:50It adds extensible monitoring for you.

6:53When you're building your APIs,

6:55you can actually start logging more telemetry items

6:59and ship them directly into Azure

7:01for analyzing and analytics.

7:03Scale?

7:04Well, right here, we're not only using the Developer tier,

7:06so we don't have the ability to identify

7:09how many units we want to use.

7:11Managed identity.

7:12Ah, remember this?

7:13Yeah, does my API management tool need to access

7:18other resources in Azure like a key vault, like a database.

7:23In this case, we could give API management an identity

7:27that shows up in Azure Active Directory,

7:29and then very quickly assign it roles

7:32that give it permissions to other items.

7:34Did we want to integrate this with a virtual network

7:37or a private endpoint?

7:39Do I have virtual machines that need to access this API

7:42management as if it was connected on the local subnet?

7:46We could configure that right here.

7:49Protocol settings.

7:50Do we wanna force these specific kinds of TLS,

7:54or cipher encryptions, or HTTPS to be used right here?

7:58By default it wants to use the most latest and greatest.

8:00That would be TLS 1.2.

8:02But if we need to use older versions of HTTP or TLS

8:06or SSL, you could specify them right here.

8:09Lastly, there are tags.

8:10If we need to organize our resources,

8:12this is really useful for billing

8:14as well as analyzing resource consumption

8:17with our own custom tagging system.

8:19It's a key in a value pair that we could look up later.

8:22And then lastly, of course, is Review and Create.

8:25We're gonna fire off the Create button right there

8:27and boom, the deployment is underway.

8:29Like I said, this is gonna take a long time.

8:32I also said I was gonna show you

8:34another way to get this done.

8:36What we are gonna do now is I'm gonna fire up PowerShell

8:39and bringing my PowerShell terminal onto the screen

8:42right now we're gonna create an Azure API management

8:47instance directly using a PowerShell command here.

8:51First things first, though.

8:52My terminal needs to get authenticated

8:54and accessed into Azure.

8:56So I'm gonna say, "login-azaccount" like so.

9:00I'm actually gonna zoom in a little bit too

9:02so that we see the font nice and big "AzAccount," like this.

9:06Press Enter.

9:07And what does it do?

9:08It pops up a browser terminal right here.

9:11So I'm gonna go ahead and say

9:12I'm already signed in with this account.

9:14And just like that, authentication is complete.

9:17If I jump back to my PowerShell screen...

9:19Oh, too many PowerShell prompts right here.

9:21If I jump back to PowerShell here, let's go ahead

9:22and terminate that one, and it should have, there we go.

9:26It now shows me as logged in.

9:28Great.

9:29And it sees I'm currently using

9:30my pay-as-you-go subscription.

9:32That's really good.

9:34So now that my prompt here is logged into Azure, like so,

9:38what I need to do now is give it a commandlet

9:41that tells it what to do.

9:42The commandlet syntax, if you've never seen PowerShell

9:45before, is usually some type of verb, hyphen,

9:50then some object to do this verb against.

9:53In this case, when I say new, hyphen,

9:56that's basically saying create a new something.

10:00Now I have to tell it what to create.

10:02And the syntax we're usually gonna see with working

10:04with Azure resources always begins with A-Z.

10:08So it might be New-AzVm or New-AzFunctionApp

10:13or something like that.

10:14In this case I'm saying New-AzApiManagement.

10:19Let's go ahead and search for it.

10:21Tab to auto complete and it brings up New-AzApiManagement.

10:25Now we have to give it some parameters.

10:27These are named parameters, meaning the parameter has a name

10:31and we just specify it with hyphen,

10:33then whatever the name of the parameter is, like the name

10:36of my AZ API manager.

10:38I'll call this "posh" for PowerShell, "knoxapim."

10:42That way I know this will be the one

10:44that was created with PowerShell.

10:46I'll say my ResourceGroupName,

10:51if we spell it correctly, like this,

10:52and I can Tab to complete these,

10:53we can put this in my appdev resource group.

10:56I'll say -Location.

10:59That can be in let's say, southcentralus,

11:04all one word.

11:06Then we'll -Organization.

11:09Remember that was needed.

11:10And I'll call this "Knoxs Posh" for PowerShell.

11:14And then I'll say AdminEmail, like so.

11:18Quotes, and I'll say "knox@knoxsdata.com."

11:21And guess what?

11:23Press Enter, and there it goes.

11:25It's on the way.

11:26Now, like I said, this takes a long time to deploy,

11:30so don't close your terminal

11:32if you're going along with this.

11:33It's gonna take, you know, 45 minutes

11:35to an hour to deploy all of these resources.

11:38So I'm gonna stop recording right now, go get some lunch,

11:42and hopefully, by the time I get back, these resources

11:45will all be deployed and in the next video

11:47we can pick up where we left off.

11:48All right, see you in just a minute.

11:51Okay, so that went quite a bit quicker than expected.

11:54I started it at 10:32, I checked it at 11:10,

11:58so about 40 minutes in, and the resource has been deployed.

12:02It looks like it's good to go.

12:04I see...

12:05Now lemme take you in here 'cause the first time

12:07we've actually looked at a resource in Azure.

12:09So here we are.

12:10At the top right, right here at the top.

12:12You know, this section right here.

12:14This looks about the same for every resource

12:17that you see here.

12:18We've got an activity log, which usually involves

12:22like a security log, an audit log.

12:26Who logged in, who changed what.

12:28That's really what you're looking for here.

12:30IAM, or access control is where we delegate permissions

12:34to our internal staff to look at this resource

12:39in the first place, change this resource, you know,

12:42from a technical standpoint,

12:44maybe scaling or something like that.

12:46And then there's a security administrator on top of this

12:49who gets to delegate permissions to this resource as well.

12:53That's what typically happens there.

12:55Tags, Diagnose and solve problems, and then Events.

12:59So then we scroll down and we see, ah, here's APIs.

13:03That's what we're gonna be working on over the next

13:05few sets of videos, which is pretty cool.

13:07This is where we actually begin to work

13:09with our control plane.

13:11This is our control plane, effectively

13:13where we're going to implement APIs to be managed

13:16in our data plane and such, and such, and such,

13:18which is really cool.

13:19Then below that you've get the developer portal section.

13:22Notice, I really like pointing out

13:24that there is OAuth 2.0 and OIDC.

13:28That way if you need to connect to our clients

13:31or customers external identity providers

13:34and manage permissions that way, we have the ability

13:36to configure that right here in the developer portal.

13:39Then lastly, you have the monitoring section,

13:42which is where we can actually monitor the health,

13:44the status, and the consumption of the API gateway resource.

13:48We could also look at our deployment

13:51and infrastructure tiers right here,

13:53and this is also where we can come back

13:55and reconfigure any of this, like our pricing tier.

13:58We can actually change these at any time.

14:00We can scale this differently.

14:02We can go to a different pricing tier

14:04and then configure scale out on top of that

14:07from right here in the portal.

14:08Again, you should be extrapolating this,

14:11like obviously, the things we're looking at here

14:13are specific to an API management resource.

14:17But when it comes to virtual machines or SQL databases

14:21or service bus, anything like that,

14:24this menu on the left-hand side

14:26and the types of things that you can do from there

14:30and how you can reconfigure your resources

14:33or audit your resources, this is pretty standard.

14:36This is pretty much the same for all of Azure.

14:39So you're getting, even though this feels

14:41like this is my first time touching Azure,

14:43and this is our first resource being deployed,

14:46this is going to feel very familiar after a while.

14:49Okay, so now that the resources have been deployed,

14:52it's time to start using it in the next video.

14:54I hope this has been informative for you

14:56and I'd like to thank you for viewing.

0:00<v Instructor>So fundamentally, one of the biggest things</v>

0:02that API Management allows us to do

0:04is categorize or group all of our APIs into one place,

0:10and then from there, add logic or policies on top of it.

0:13Immediately, what you should be thinking is,

0:16now my requests are gonna make their way

0:19into this public gateway URL.

0:21Notice also, here's the developer portal URL,

0:24if you wanna start clicking in there

0:25and taking a look at what you can do,

0:27assuming you've already deployed this resource

0:28along with me.

0:30It's okay if you didn't, we're just saying,

0:32that's the idea here.

0:33So with traffic,

0:35new requests coming in, hitting this URL,

0:38we need to give it a backend to start serving,

0:41and this is what APIs do.

0:43So right here on the left-hand side,

0:46we're gonna publish the first API that we have.

0:48Now, how do we publish APIs?

0:50There's a few different ways,

0:52and you're seeing it right now.

0:53We have, we can define a new API from scratch

0:56with a classic HTTP-based REST API,

0:59we can define a WebSocket API,

1:02and we can define a GraphQL API.

1:04We'll cover some of these things in a later set of videos

1:07as we start to progress through

1:09the AZ-204 a little bit more.

1:11Now, the preference, probably the preferred way

1:14to actually publish an API

1:16is from an already existing definition.

1:20Most APIs today, especially if you're an API developer,

1:24come standard outta the box with the ability

1:27to scaffold a Swagger or OpenAPI definition for you.

1:31Similarly, if you're creating something like a SOAP API

1:35that is RPC-based, a WSDL is just part of the mix.

1:39So using one of these definitions

1:42is going to save you a humongous amount of time and effort

1:47when actually it comes to creating the API.

1:51When you choose to import it from a definition,

1:53API Management's like, "Ah, cool, I know all of the routes,

1:56all of the parameters, all of the payloads.

1:58I already know everything I need to know about this API,

2:02and it makes it a lot easier."

2:04I'm gonna show you both of the ways in this video.

2:06Then lastly is you could actually create this

2:10from an already existing Azure resource.

2:12And this is really preferable

2:14if you're serious about developing resources for Azure.

2:18In this case, your resources could be living

2:23in an App Service, we already talked about that,

2:26the Function App, or a container itself.

2:28Now, we haven't talked a lot about Logic Apps,

2:31and Logic Apps mysteriously are missing

2:34from the latest revision of the AZ-204 certification exam.

2:38My personal opinion,

2:40they're one of the coolest things in all of Azure,

2:42and should never ever be overlooked

2:45on any certification or in professional life.

2:48The point is, all of these resources

2:51expose an HTTPS endpoint,

2:56and when they're already deployed in Azure,

2:58it's really just as simple

3:00as pointing your API Management resource

3:02to that resource there so that it knows

3:04that it should proxy to those backend resources.

3:07Pretty straightforward.

3:08Alright, let's start with the very beginning,

3:11and we'll manually define an HTTP endpoint

3:13that API Management should proxy.

3:16Here's the thing, when we define it by an HTTP endpoint,

3:18could be any HTTP endpoint on the planet, couldn't it?

3:23It doesn't have to be hosted in Azure.

3:26This is really just serving as a proxy,

3:28and when requests come in to API Management,

3:30it's just gonna proxy it

3:32to this backend endpoint that we specify.

3:34Well, if that's the case, why not use

3:37one of the more popular HTTP endpoints in the world,

3:39the Star Wars API, what everybody uses to learn.

3:43See, we can absolutely leverage the Star Wars API,

3:46which is at swapi, Star Wars API, .dev/api endpoint.

3:52So I'm gonna copy this right here

3:55to copy this https://swapi.dev/api.

3:59I'm gonna jump back over here,

4:01and for the web service URL, I'm gonna paste it in like so.

4:04We're gonna call this display name Star Wars,

4:07let's call it Star Wars API.

4:10It'll automatically give it a name

4:12in the format that it wants,

4:13and if we need to put an API URL suffix right here, we can.

4:17Notice you have the ability also to flip this over

4:21to the full HTTP API creation process if you want.

4:24This allows you to give it a description,

4:26which might be useful for your developers

4:28who might wanna consume this.

4:30We can specify what protocols should be available

4:33or sent to the backend if need be.

4:36We can provide tags for this, like Star Wars,

4:40if that's what we need to do,

4:41to create a new tag for grouping our services together.

4:45Similar, if this needs to belong to a product

4:48that we're trying to deploy,

4:49we could specify a product that this needs to belong to.

4:53And then we can even specify which of our API gateways,

4:56assuming we had purchased the standard or premium tiers,

5:01where we have multiple gateways that we can scale,

5:04we could choose which gateway this needs to go in.

5:07Then we can even add versions to this API.

5:10That way, if I start to push new versions,

5:13and need to update the definitions

5:15in the backend here for API Management,

5:18we can keep track of the versions that we're publishing.

5:19Now, I'll flip this back to the basic tier

5:22for just a second, leaving things as they are,

5:24and I'll click Create.

5:26Now, since we chose the manual way of doing this,

5:29it's now on us to go through and define

5:32all of the different routes or methods

5:35that are possible with this particular API.

5:38It's on you to do that,

5:40this is why we like the definition.

5:42And the way we do that is we click

5:43the Add operation button right here, give it a click,

5:47and then we start to actually define

5:48what this is gonna look like.

5:50For instance, looking at the Star Wars API,

5:52one of the routes is to people.

5:54We can type people right here, forward slash,

5:57and just click Request,

5:59and we can see it returns a list of all people back to us,

6:02like so, see?

6:04The full payload of all people in all Star Wars

6:06comes back to us.

6:08So let's start to define this.

6:09We can call this display name all-people, like so.

6:13The URL to it is /people, like so.

6:18The request is a GET method,

6:20as opposed to a POST, or a PUT, or a PATCH, or a DELETE.

6:23And if we need, we can specify query parameters, headers,

6:27requests, and responses that should be sent back.

6:30When I click Save right here,

6:33we now see there is a GET request that's present

6:36available in the frontend.

6:39Similarly on the Star Wars API,

6:41we can also request planets like so.

6:44If I choose Request, we'll see planets comes back.

6:48Ah, there's planets right there.

6:51So jumping back here to my API Management,

6:53I'll add another operation right here.

6:56We'll call this all-planets, and I'll specify

7:00the path to the resource is /planets, like so.

7:04I'll click Save, and now,

7:06we have the planets operation that's available.

7:08So I have people and I have planets.

7:12Notice you can click on them over here

7:13under the operations and toggle between them.

7:16So how do I know that I configured this correctly?

7:19Well, of course, you can test it out.

7:21Let's test planets here for a second,

7:23since we just created all-planets.

7:24What I can do is I can click this Test tab right here,

7:28and under the Test tab, this is where I could add

7:31query parameters, headers, product scopes, request URLs.

7:37We could see exactly what request URL

7:39we're gonna be hitting.

7:40This is the request URL I'm about to request.

7:42So when I click Send, fire away,

7:45hold your breath, does this, oh, 200 OK response.

7:49Scroll on down,

7:51there is the response payload coming back, see?

7:55Really cool.

7:56You could even do things like trace the request

7:58if you wanted to do that.

8:00Now, you may have been spying here for a second.

8:02One of the cool things that the Star Wars API

8:05has the ability to do was to dig deeper

8:07and return a specific record here.

8:09For instance, if I wanted to return just the planet

8:12with an ID of one,

8:13how could I go about adding this parameter

8:16or this value to my API?

8:18Watch this, if I jump back to API Management,

8:20what I'm gonna do

8:22is I'm just gonna create a new operation real quick,

8:24and I'm gonna call this specific-planet, like so.

8:29And what I'm gonna do is on the GET request,

8:32we're gonna put planets/,

8:35wait, wait, it was /planets, /planets/{,

8:41and then we'll call it planetid,

8:44then closed brace, like so.

8:46When I scroll down immediately here,

8:49the template parameters has picked up

8:51I created a parameter called planetid.

8:54I can give this a description.

8:56I can also give this a type.

8:58Like if I wanted to, I could optionally specify a number.

9:02And then I could give this a value,

9:04like a default value of one, like so.

9:07So if I don't pass one in,

9:08but I hit this specific endpoint,

9:11it can automatically put it on there.

9:12Now, I'm not gonna worry about this.

9:14I don't want to use a default value.

9:16We'll choose no default here, make sure it's selected,

9:18and I'll clear out this number right here.

9:21This is all optional.

9:22As long as we have planetid right here, that's okay.

9:25I can click Save.

9:27Now I have a specific planetid that's been parameterized,

9:30and if I wanna test it out, I can come in here,

9:34and I can specify a value of one

9:36to add on to this parameter.

9:38So when I scroll on down, we see exactly what it is

9:41that it's gonna try and request to do.

9:44I'll hit Send to fire it off,

9:46and we get the one specific request that comes back now.

9:50So now, my API Management gateway

9:52has the ability to handle both a route for all planets

9:56as well as a specific parameterized planet.

9:59Pretty cool, right?

10:01Now, I did say I was also gonna show you

10:02how to import one of these from definition,

10:05and how much time that's gonna save you.

10:08Here's what I want you to do.

10:09Go to Google, and search for Pokemon API SwaggerHub.

10:13The very first link that comes up

10:16is gonna look kind of like this green symbol,

10:17and spy on the URL,

10:19it goes app.swaggerhub.com/apis/PokemonApi.

10:23That's where you wanna land.

10:24You're actually gonna get redirected

10:26to a site that looks like this.

10:28Over here on the right-hand side, go to Export,

10:31Download API, and choose JSON Resolved.

10:35That's the one you want to download.

10:37When you've got that JSON file

10:39downloaded on your local computer,

10:41that's what we're gonna use to import a new API over here.

10:44So I'm gonna add a new API,

10:46let's go ahead and add a new API, this is where we are,

10:50and I'm gonna choose to create from a definition

10:52that's an OpenAPI standard.

10:54And then I'm gonna select the file

10:56that I want to download here.

10:58So I'm gonna scroll on down to my Ps, there's the file.

11:01I'm gonna choose Open, and it immediately,

11:04you can see it immediately finds the display name

11:07and the name here.

11:09Now, you look at this base URL, knoxsapim.azure-api.net.

11:14Without anything tacked on to the end of it,

11:16it knows that by default,

11:18it's gonna be using the Star Wars API

11:21that I've already set up.

11:22To point new traffic to this new Pokemon API,

11:26this is what the API URL suffix does.

11:30If I type poke right here,

11:32we see now the base URL has a slash poke,

11:35and any endpoints that come after that

11:38are gonna be the ones that are for my Pokemon API.

11:41So look what happens when I click Create.

11:44It spins for a little bit, and then,

11:46I now have the full Pokemon API

11:48and all of their methods right here.

11:52So machines, abilities, Pokemon, IDs, Pokemon by name,

11:59and Pokemon by region.

12:01So I can go here, and now we can see,

12:03ah, this is how it's actually gonna work.

12:06So my endpoint, if you look at how the test would look,

12:08look down here at the test

12:10what the endpoint is really gonna look like.

12:12This is where the GET requests are now gonna be sent,

12:15/poke/api/v2/pokemon/{id},

12:20and that's what's gonna get sent to the backend Pokemon API.

12:25This is what's really cool about importing

12:27from the actual definitions themselves, and lots of times,

12:31depending on the frameworks that we're using,

12:33these definitions write themselves.

12:36They're built in to the framework by default.

12:38Something like Python's FastAPI

12:41is automatically generating this Swagger definition

12:44as you develop the actual API itself.

12:47So importing this into something like API Management

12:50would be really easy.

12:52So now, we've seen how to create and publish and test APIs,

12:56including implementing parameters on top of that.

12:59I hope this has been informative for you,

13:00and I'd like to thank you for viewing.

0:00<v Narrator>So you might've been spying</v>

0:01on this a little bit when we were actually creating

0:04the different operations that can be done.

0:06Let's pick on specific planet here for a second.

0:09Over here on the right hand side, which is kind of hard

0:12to see because I'm super zoomed in right now,

0:13I actually have to zoom out so that you can see this.

0:16We actually see the traffic flow like this.

0:21This is the request coming in over here.

0:25This is the response going out over here.

0:29Most API gateways

0:31and API management is not an exception in this case,

0:34give you the ability to inspect data

0:37as it comes into the front end.

0:39Do something with that data, make a decision,

0:43change it something before it gets sent to the backend.

0:48Then when the response comes back from the backend,

0:50we can do something with that response data, transform it,

0:56make a decision about what to do with it,

0:58and then send it back to the original calling client.

1:02This is not unlike anything else you've ever seen

1:04if you've ever worked with an API Gateway before,

1:07and sure enough, API Management

1:08gives you the exact same flexibility

1:10that you would expect in this case.

1:12Where it starts to differ a little bit

1:14is how you actually implement these.

1:16What we actually implement here are known as policies

1:22and policies are written in XML.

1:26That's actually what you see right there.

1:28Now, I'll say, I wanna pause right now

1:29and say, you know, it's been a couple years, probably two

1:32or three years since I last recorded API management,

1:35and they've already shown improvements

1:37on working with policies

1:39as we start to progress through our journey here.

1:42For instance, this is kind of nice, the ability

1:45to add a policy right here

1:47where you click on the add policy button

1:50to add an inbound processing policy.

1:52You can click on it

1:53and we can now actually look at some of the policies

1:56that we wanna inspect.

1:58For instance, do we wanna filter by IP addresses?

2:01Do we wanna rate limit based on an API key?

2:05Do we want to bypass the backend

2:08and just return a mock response?

2:10Do we want to enable course headers?

2:13Do we wanna add headers?

2:15Do we want to validate a JWT token?

2:18Ah, there's the authentication

2:20you were probably wondering about.

2:22Yep. If you want to integrate with something like Auth zero,

2:26you absolutely have the ability to grab

2:29and validate A JWT token directly in these policies.

2:34You can also custom make your own policies with XML as well.

2:37The big thing I wanted you to see

2:39in this video is just understanding the workflow

2:42and what policies are doing at each one of these stages.

2:46With inbound processing,

2:48we're really inspecting the original request

2:50and adding policies based on how that request

2:54should be formatted and structured.

2:58Should we validate the IP address that it's coming from?

3:01The JWT token that's in the header.

3:04When we look at the backend policies here,

3:06this is really any decisions we're making

3:09before it gets sent out to the backend.

3:13Lots of times, this is actually for route redirecting.

3:20I'll use this example already and I'm gonna use it again.

3:22What we can do, especially on the backend stage right here,

3:26is we can inspect something like the payload size

3:31and create a policy

3:32that chooses a different backend to send this to

3:36if the payload size is greater than a certain size,

3:39this is what a backend policy would be all for.

3:42And then outbound processing is looking at these responses

3:46and choosing what policy should go in here.

3:48Again, not terribly surprising to see things

3:52like setting and adding headers or changing headers

3:55before it goes back to the client,

3:57validating the content like the JSON schema or structure

4:01and validating the status code

4:03that we're getting back from the backend server.

4:06Here, I'll click discard so we don't add anything right now.

4:09When you ultimately are ready to see the full policy

4:12or custom type in your own policy,

4:15you can click the little code view right here

4:17and it'll actually bring up the XML policy itself.

4:21The thing I want you to really pay attention to here

4:24is this XML template is the full policy

4:27of all of the phases that we just inspected.

4:30There's inbound, there's backend,

4:34there's outbound,

4:35and then there's even an on error policy,

4:38something that you didn't see from that Gooey,

4:41what's the policy or what should we do

4:44whenever there's actually an error?

4:47For now, this is a quick look at what policies do

4:50and how they're kind of laid out and how you can get to them

4:53whenever we're actually working with specific operations.

4:56That's the last thing I wanna point out is each operation

5:00can have different policies

5:02and do have different policies,

5:04so you might be creating different policies

5:07for each operation that exists across all of your APIs

5:10if that's what you want to do.

5:12Okay, now that that's been set up, in the next video,

5:15we'll take a look at some examples

5:16of how policies can be written.

5:18I hope this has been informative for you,

5:19and I'd like to thank you for viewing.

0:00<v Instructor>So let's start</v>

0:01to explore these policies a bit, huh?

0:03Let's see what we can really do to have some fun with this.

0:07One of the most basic transformations that we can do

0:09for an inbound request is maybe we're getting a request

0:12inbound that's authenticated

0:14through something like OAuth 2.0.

0:18This is gonna be something that we are going

0:21to either connect to the other identity provider,

0:24the the customer's identity provider,

0:26and get a claim from them

0:27that says they are who they say they are

0:29or perhaps we're actually leveraging something

0:31like Azure AD.

0:33Again, we kind of saw how that was gonna work

0:36when we were looking at things like the billing

0:38and pricing of the tiers.

0:40So once the user is authenticated,

0:42what then could we also do

0:44that has to do with authentication?

0:46Perhaps the backend actually requires authentication.

0:50Now, am I gonna be able to leverage the same OAuth 2.0

0:54or Azure AD,

0:55or is this gonna be something like

0:57an entirely different authentication structure and scheme?

1:01The more likely scenario is the latter,

1:04where the backend isn't going

1:06to rely on authenticating the front end customer.

1:09We have already handled authenticating

1:12the front end customer.

1:13Now, we just need to make sure the channel is secure

1:16between the API gateway and the backend itself

1:21and this could use

1:22an entirely different authentication scheme.

1:25So what we're really trying to do here is we're trying

1:27to add in an HTTP authorization header

1:34into the request that goes to the backend.

1:36Let me show you how to do that.

1:39You'll be surprised at how easy it really is.

1:42We can go into the code view right here,

1:44and then in the inbound section right underneath base,

1:47I'm gonna press Enter

1:49and I'm just gonna paste in one simple line of XML.

1:53You're gonna see how easy it is.

1:55If I'm trying

1:56to do basic authentication to the backend, just username

1:59and password to reach the backend.

2:01I'll paste in the line.

2:02It is a tag called Authentication Basic

2:05with an attribute of username and password.

2:09Then you supply the username like knox

2:10and, you know, teaches

2:13or something like that as a password

2:15and it's gonna send this to the backend by default,

2:17that's it, that's all there is

2:19to adding an inserting an authentication header

2:22into the backend.

2:24Now, there are some other ways

2:25that you can authenticate to the backend.

2:27For instance, if you wanted to use something

2:29like a certificate, the certificate

2:31that might be hosted in something like Azure Key Vault.

2:35If assuming API management has a managed identity

2:39and can access the the actual certificate in key vault,

2:42it's just as simple as this.

2:44Specify the authentication cert,

2:46authentication certificate, and then the certificate ID

2:50to grab out of the key vault, just like that.

2:53See, that's really all there is

2:55to adding backend authentication into the mix.

2:59I'll click Save right here to save that

3:01and boom, see, now we've got the base policy

3:05and the authentication basic policy added into the mix.

3:09One more for good measures,

3:10I'll just press the plus

3:12and we'll add an IP filter into the mix.

3:15I'll add the IP filter right here,

3:17and we can say what the first and last IPS in the range are.

3:21Notice this is set to be the allowed IP list range.

3:25We could also flip this to be a blocked IP list range,

3:29which then allows everything else.

3:31So for instance, if I wanna block 1.2.3.4

3:35and allow everything else, I can click Save right there

3:38and now I have an IP filter.

3:40Click back on the code view,

3:42and you can see exactly

3:44how this policy was scaffolded for you

3:45that was really, really helpful.

3:48So this is a basic example of how to start working

3:51with inbound processing policies,

3:54adding in authentication headers to be sent to the backend,

3:58as well as performing filtering operations

4:00from the front end.

4:02I hope this has been informative for you,

4:03and I'd like to thank you for viewing.

0:00<v ->Now one thing, final thing I wanted you to leave,</v>

0:03one final thing I wanted to leave you with.

0:05That was hard to say.

0:07Is I wanted you to know that we've just scratched

0:09on the surface when it comes to policies.

0:12Yes, when it comes to policies,

0:14you got some really useful ones right here out of the gate

0:18that you can help get started with.

0:20But there are an extraordinary number of policies

0:25and XML tags that you can work with.

0:28And like I said, documentation is gonna be your best friend.

0:30Here's a perfect example why.

0:32When I scroll on down here, click under reference

0:36and then go down until you see API management policies.

0:41Flip that open, and these are all the tags

0:46that you can work with.

0:48Now, these are really useful tags.

0:50When we see things like set header right here,

0:52we're thinking, "Okay, well I got the idea

0:54of what set header is gonna do,

0:57but it would be really nice to see some examples

0:59of really useful policies that other people

1:03have come up with".

1:04Well, scroll back up just a hair on the left hand side

1:06of your menu and then under samples go to policy snippets.

1:11This is actually gonna take you into like a VS code

1:14plugin installation,

1:16but right here the top folder on GitHub is examples.

1:20And when you click on this, this is where your world

1:26kind of gets flipped upside down for a second.

1:28Yeah.

1:30"Parse A JWT token using expressions.

1:33Put a file onto a blob storage account.

1:38Log errors to stackify.

1:41Forward an event to the Azure event grid.

1:45Encrypt data using expressions".

1:49Hopefully I'm kind of drilling this home

1:51at this point that you see.

1:52There's a lot that you can absolutely do here.

1:55One of my favorite ones though is route requests

1:58based on size policy.

2:00Give that a click right there

2:01and start to explore what this is.

2:03Remember, I've mentioned this a few times now,

2:05that if a payload comes in that is too big,

2:09for instance, over 256 KBs, which is the limit

2:13of Azure Service Bus, we may wanna redirect

2:17that message somewhere else.

2:19That's exactly what we're looking at here.

2:22A service bus really is just a gigantic message queue,

2:25and the thing that makes it work so fast and so well,

2:29and so performant is limiting the size of the messages.

2:32So in this case, if we're using our API Gateway to serve

2:35as a proxy to service bus, then we need to validate

2:39that the file or the payload size that's coming in

2:42isn't too big.

2:44So what this does is it uses an inbound policy

2:48and then in the base section,

2:50or underneath the base section,

2:51we're gonna set a variable at runtime.

2:54And the name of that variable is gonna be body size.

2:57And that value is gonna come from the message itself's

3:02request headers, content length.

3:05That's gonna tell you what the body size is

3:08of the payload that's coming in.

3:10From there, we're gonna say choose when we're gonna find

3:14as an integer for that body size value.

3:17If it's greater than, or if it's less than 256,000,

3:23then we're not gonna do anything.

3:25We close our wind block right there.

3:27We're just gonna let it go to the backend

3:29because it was under the 256K.

3:31Otherwise, we're gonna rewrite the URI

3:35and change to a different backend service

3:38that we're using right here.

3:40See, this is a perfectly good example of when

3:43we might want to use a complicated policy,

3:46and these policies can be complicated yet very powerful.

3:50So I wanted you to be aware.

3:52First of all, there's two really important resources.

3:55The examples are great,

3:57but you also need to be aware if you keep hitting back

4:00a few times here, you also need to be aware that all

4:03of the potential policy tags that you can use,

4:07they exist under the API Management policies reference.

4:12Understanding how to use these is gonna be

4:15extremely powerful.

4:16And you wanna spend some time thumbing through these.

4:18Just look at the names, and either guess what they do

4:22or say, "Oh, that would be really useful.

4:24Let me see if I can find an example

4:26where they've already used it".

4:28One of those is gonna be powerful and useful for you.

4:32So before we signed off an API Management

4:34and moved on to the next topic, I wanted you to be aware

4:37that there's more underneath the service, service,

4:40underneath the surface of API management policies,

4:44and using this documentation right here to look at

4:46what these different policies can do in addition

4:49to the examples or the sample code,

4:51that's gonna be really helpful

4:53for kick-starting your journey into defining policies

4:55for each of your API's operations.

4:59I hope this has been informative for you,

5:00and I'd like to thank you for viewing.