API Management

Microsoft Azure API Management is a turnkey solution for publishing APIs to external and internal consumers. Quickly create consistent and modern API gateways for existing backend services hosted anywhere, secure and protect them from abuse and overuse, and gain insights into usage and health. Plus, automate and scale developer onboarding to help get your API program up and running in no time.

How can we improve Azure API Management?

You've used all your votes and won't be able to post a new idea, but you can still search and comment on existing ideas.

There are two ways to get more votes:

  • When an admin closes an idea you've voted on, you'll get your votes back from that idea.
  • You can remove your votes from an open idea you support.
  • To see ideas you have already voted on, select the "My feedback" filter and select "My open ideas".
(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Choose whether subscription key is taken as a query param, header or both

    Instead of the default where the subscription key is taken as both a query param and a header, allow the API administrator to choose. Also enable them to change the description of the field in the API definition.

    3 votes
    Vote
    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      I agree to the terms of service
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Defining APIs  ·  Flag idea as inappropriate…  ·  Admin →
    • Ability to Change Developer's Name and Email

      Hi,
      It seems that once you have created a Developer (or they have signed up), it is not possible for an admin/publisher user to modify the user's email address, first name or last name.
      The user can change this themselves via Developer Portal, but no way for admin to do anything.

      3 votes
      Vote
      Sign in
      Check!
      (thinking…)
      Reset
      or sign in with
      • facebook
      • google
        Password icon
        I agree to the terms of service
        Signed in as (Sign out)
        You have left! (?) (thinking…)
        0 comments  ·  Flag idea as inappropriate…  ·  Admin →
      • Allow to edit the base template

        I need to add custom JS on all pages of the Developer Portal, and doing so at the moment would require to edit all page templates.

        Publishers should be able to edit the base template of all pages.

        4 votes
        Vote
        Sign in
        Check!
        (thinking…)
        Reset
        or sign in with
        • facebook
        • google
          Password icon
          I agree to the terms of service
          Signed in as (Sign out)
          You have left! (?) (thinking…)
          0 comments  ·  Developer portal  ·  Flag idea as inappropriate…  ·  Admin →
        • Add the ability to disable features of the developer portal, including authorization-based enable/disable

          Provide a way to turn off features like, for example, the issues log. I can remove "Issues" from the navigation, but I can still just go to /Issues to get there. Also, let me hide features based on whether or not the user is logged in. For example, I only want "APIs" and "Products" to show up (and allow access) if the developer is logged in.

          3 votes
          Vote
          Sign in
          Check!
          (thinking…)
          Reset
          or sign in with
          • facebook
          • google
            Password icon
            I agree to the terms of service
            Signed in as (Sign out)
            You have left! (?) (thinking…)
            0 comments  ·  Developer portal  ·  Flag idea as inappropriate…  ·  Admin →
          • Extract JWT claims to variables during validation

            I'd like to be able to extract specific claims from a JWT while validating it. Here's some policy that won't work today but that I'd like to be able to write:

            <validate-jwt header-name="Authorization">
            <openid-config url="https://login.windows.net/contoso.onmicrosoft.com/.well-known/openid-configuration&quot; />
            <extract-claims-to-variables>
            <claim name="appid" variable="azureAppId" exists-action="override"/>
            <claim name="cloud_instance_name" variable="cloudInstanceName" exists-action="override"/>
            <claim name="email" variable="emailAddress" exists-action="override"/>
            </extract-claims-to-variables>
            </validate-jwt>

            With various JWT claims extracted to variables during validation, I could drive other bits of policy logic from them and pass them to the backend as required.

            16 votes
            Vote
            Sign in
            Check!
            (thinking…)
            Reset
            or sign in with
            • facebook
            • google
              Password icon
              I agree to the terms of service
              Signed in as (Sign out)
              You have left! (?) (thinking…)
              1 comment  ·  Security  ·  Flag idea as inappropriate…  ·  Admin →
            • VNET support with Standard pricing option

              The VNET is very inportant feature for this service so it should be in the Standard pricing option

              8 votes
              Vote
              Sign in
              Check!
              (thinking…)
              Reset
              or sign in with
              • facebook
              • google
                Password icon
                I agree to the terms of service
                Signed in as (Sign out)
                You have left! (?) (thinking…)
                0 comments  ·  Pricing  ·  Flag idea as inappropriate…  ·  Admin →
              • Make reCaptcha on SignUp page configurable or optional.

                There should be a way to disable or at least tone down the ferocity of the reCaptcha. According to our analytics we lose up to 20% of prospective clients who give up after refreshing 2 or 3 times and still not being able to read the reCaptcha.

                4 votes
                Vote
                Sign in
                Check!
                (thinking…)
                Reset
                or sign in with
                • facebook
                • google
                  Password icon
                  I agree to the terms of service
                  Signed in as (Sign out)
                  You have left! (?) (thinking…)
                  0 comments  ·  API management experience  ·  Flag idea as inappropriate…  ·  Admin →
                • Auditing of the subscription key regeneration or updates.

                  Logging of the information on when the subscription was updated and the user id would be a great help for the auditing of the service.

                  1 vote
                  Vote
                  Sign in
                  Check!
                  (thinking…)
                  Reset
                  or sign in with
                  • facebook
                  • google
                    Password icon
                    I agree to the terms of service
                    Signed in as (Sign out)
                    You have left! (?) (thinking…)
                    1 comment  ·  Service management  ·  Flag idea as inappropriate…  ·  Admin →
                  • Allow Api management publisher portal to host/upload root certificate to retrieve swagger document from web apis using self-signed certs

                    Allow Api management publisher portal to host/upload root certificate to retrieve swagger document from web apis using self-signed certs.

                    At the moment if you want to update the API's from a Web role using self-signed certs, it just fails to retrieve because of CA hierarchy or rather lack of.

                    1 vote
                    Vote
                    Sign in
                    Check!
                    (thinking…)
                    Reset
                    or sign in with
                    • facebook
                    • google
                      Password icon
                      I agree to the terms of service
                      Signed in as (Sign out)
                      You have left! (?) (thinking…)
                      1 comment  ·  Defining APIs  ·  Flag idea as inappropriate…  ·  Admin →
                    • Edit Internal Email Templates

                      Please add the ability to edit the internal emails sent when users sign up.

                      2 votes
                      Vote
                      Sign in
                      Check!
                      (thinking…)
                      Reset
                      or sign in with
                      • facebook
                      • google
                        Password icon
                        I agree to the terms of service
                        Signed in as (Sign out)
                        You have left! (?) (thinking…)
                        0 comments  ·  API management experience  ·  Flag idea as inappropriate…  ·  Admin →
                      • Add custom text field to Signup form

                        It would be nice if you could customize the signup form a bit more to include things like company name and phone number, etc.

                        5 votes
                        Vote
                        Sign in
                        Check!
                        (thinking…)
                        Reset
                        or sign in with
                        • facebook
                        • google
                          Password icon
                          I agree to the terms of service
                          Signed in as (Sign out)
                          You have left! (?) (thinking…)
                          1 comment  ·  Developer portal  ·  Flag idea as inappropriate…  ·  Admin →
                        • New policy to sign JWT

                          We currently have a scenario where we secure the calls to Api Management instances via JWT signed specifically for APIM. Based on some criteria, we are then signing new JWT's, to talk to back end environments. We do not want to secure the actual Api's via certificates, but simply via JWT's signed by Api Manager.

                          Currently I am using a secured call to an azure function that signs a Jwt and returns the token back but ideally we would like to have this feature built in.

                          3 votes
                          Vote
                          Sign in
                          Check!
                          (thinking…)
                          Reset
                          or sign in with
                          • facebook
                          • google
                            Password icon
                            I agree to the terms of service
                            Signed in as (Sign out)
                            You have left! (?) (thinking…)
                            2 comments  ·  Policies  ·  Flag idea as inappropriate…  ·  Admin →
                          • Fix API Management Analytics (all request seem to come from source U.S.)

                            In the Api Management Analytics page, all request seem to come fromj United Status, which is not the case in reality. Our App Service is deployed in WestEurope, so that must be the source of the requests to this API (also in WestEurope).
                            Please fix that issue. Issue has been created as ticket at Microsoft Support [REG:117021415315202]. Answer from Ice Shi:
                            "
                            After checking with our APIM production team, I got the root cause of why the APIM analytics data shows all come from US.
                            Current this data based off an IP to region lookup DB we get from the…

                            7 votes
                            Vote
                            Sign in
                            Check!
                            (thinking…)
                            Reset
                            or sign in with
                            • facebook
                            • google
                              Password icon
                              I agree to the terms of service
                              Signed in as (Sign out)
                              You have left! (?) (thinking…)
                              0 comments  ·  API management experience  ·  Flag idea as inappropriate…  ·  Admin →
                            • Ability to upload root and intermediate SSL certificates for backend services

                              We are using our own internal Certificate Authority, and use SSL certificates generated from this CA for our backend services. Without uploading the root and intermediate SSL Certificates, we cannot validate the SSL chain. The alternative is to bypass chained validation for the backends, but this brings in other security risks (as we cannot guarantee where the backend SSL certs come from - they could be self signed, as an example).

                              4 votes
                              Vote
                              Sign in
                              Check!
                              (thinking…)
                              Reset
                              or sign in with
                              • facebook
                              • google
                                Password icon
                                I agree to the terms of service
                                Signed in as (Sign out)
                                You have left! (?) (thinking…)
                                0 comments  ·  Security  ·  Flag idea as inappropriate…  ·  Admin →
                              • 26 votes
                                Vote
                                Sign in
                                Check!
                                (thinking…)
                                Reset
                                or sign in with
                                • facebook
                                • google
                                  Password icon
                                  I agree to the terms of service
                                  Signed in as (Sign out)
                                  You have left! (?) (thinking…)
                                  5 comments  ·  Defining APIs  ·  Flag idea as inappropriate…  ·  Admin →
                                • allow group

                                  Allow restricting groups to specific operations vs per api. Maybe a policy editor entry?

                                  4 votes
                                  Vote
                                  Sign in
                                  Check!
                                  (thinking…)
                                  Reset
                                  or sign in with
                                  • facebook
                                  • google
                                    Password icon
                                    I agree to the terms of service
                                    Signed in as (Sign out)
                                    You have left! (?) (thinking…)
                                    0 comments  ·  Policies  ·  Flag idea as inappropriate…  ·  Admin →
                                  • Provide API to retrieve developer keys

                                    I need to get the developer keys through an API to link azure api manager to my own web application

                                    1 vote
                                    Vote
                                    Sign in
                                    Check!
                                    (thinking…)
                                    Reset
                                    or sign in with
                                    • facebook
                                    • google
                                      Password icon
                                      I agree to the terms of service
                                      Signed in as (Sign out)
                                      You have left! (?) (thinking…)
                                      1 comment  ·  Developer portal  ·  Flag idea as inappropriate…  ·  Admin →
                                    • Allow CORS headers for Management API

                                      In order to invoke Management REST API endpoint (like ***.management.azure-api.net/apis?api-version=vvv) from browser's JS code, CORS headers should be enabled there. Moreover, full Management REST API endpoint configuration (thru Azure portal) is very welcomed addition.

                                      1 vote
                                      Vote
                                      Sign in
                                      Check!
                                      (thinking…)
                                      Reset
                                      or sign in with
                                      • facebook
                                      • google
                                        Password icon
                                        I agree to the terms of service
                                        Signed in as (Sign out)
                                        You have left! (?) (thinking…)
                                        0 comments  ·  Service management  ·  Flag idea as inappropriate…  ·  Admin →
                                      • Allow setting a "Reply-to" field on all emails

                                        A user should be able to contact the API support by replying to the emails she receives.

                                        Emails from the API Management are sent from a 'noreply' address (<apimgmt-noreply@mail.windowsazure.com>). Administrators should have the option to configure a "Reply-To" email address.

                                        6 votes
                                        Vote
                                        Sign in
                                        Check!
                                        (thinking…)
                                        Reset
                                        or sign in with
                                        • facebook
                                        • google
                                          Password icon
                                          I agree to the terms of service
                                          Signed in as (Sign out)
                                          You have left! (?) (thinking…)
                                          0 comments  ·  API management experience  ·  Flag idea as inappropriate…  ·  Admin →
                                        • Support for Let's Encrypt

                                          Allow publishers to easily use Let's Encrypt with the API management. https://letsencrypt.org/

                                          27 votes
                                          Vote
                                          Sign in
                                          Check!
                                          (thinking…)
                                          Reset
                                          or sign in with
                                          • facebook
                                          • google
                                            Password icon
                                            I agree to the terms of service
                                            Signed in as (Sign out)
                                            You have left! (?) (thinking…)
                                            0 comments  ·  Security  ·  Flag idea as inappropriate…  ·  Admin →
                                          ← Previous 1 3 4 5 9 10
                                          • Don't see your idea?

                                          Feedback and Knowledge Base