API Management Services [Microsoft.ApiManagement/service]

⚠️THIS MODULE IS CURRENTLY ORPHANED.⚠️

• Only security and bug fixes are being handled by the AVM core team at present.
• If interested in becoming the module owner of this orphaned module (must be Microsoft FTE), please look for the related "orphaned module" GitHub issue here!

This module deploys an API Management Service. The default deployment is set to use a Premium SKU to align with Microsoft WAF-aligned best practices. In most cases, non-prod deployments should use a lower-tier SKU.

Navigation

• Resource Types
• Usage examples
• Parameters
• Outputs
• Cross-referenced modules
• Notes
• Data Collection

Resource Types

Usage examples

The following section provides usage examples for the module, which were used to validate and deploy the module successfully. For a full reference, please review the module's test folder in its repository.

Note: Each example lists all the required parameters first, followed by the rest - each in alphabetical order.

Note: To reference the module, please use the following syntax ./packages/api-management-services/main.bicep.

• Deploying a Consumption SKU
• Using only defaults
• Deploying a Developer SKU
• Using large parameter set
• Deploying an APIM v2 sku
• WAF-aligned

Example 1: Deploying a Consumption SKU

This instance deploys the module using a Consumption SKU.

module service './packages/api-management-services/main.bicep' = {
  name: 'serviceDeployment'
  params: {
    // Required parameters
    name: 'apiscon001'
    publisherEmail: 'apimgmt-noreply@mail.windowsazure.com'
    publisherName: 'az-amorg-x-001'
    // Non-required parameters
    sku: 'Consumption'
  }
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    // Required parameters
    "name": {
      "value": "apiscon001"
    },
    "publisherEmail": {
      "value": "apimgmt-noreply@mail.windowsazure.com"
    },
    "publisherName": {
      "value": "az-amorg-x-001"
    },
    // Non-required parameters
    "sku": {
      "value": "Consumption"
    }
  }
}

using './packages/api-management-services/main.bicep'

// Required parameters
param name = 'apiscon001'
param publisherEmail = 'apimgmt-noreply@mail.windowsazure.com'
param publisherName = 'az-amorg-x-001'
// Non-required parameters
param sku = 'Consumption'

Example 2: Using only defaults

This instance deploys the module with the minimum set of required parameters.

module service './packages/api-management-services/main.bicep' = {
  name: 'serviceDeployment'
  params: {
    // Required parameters
    name: 'apismin001'
    publisherEmail: 'apimgmt-noreply@mail.windowsazure.com'
    publisherName: 'az-amorg-x-001'
  }
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    // Required parameters
    "name": {
      "value": "apismin001"
    },
    "publisherEmail": {
      "value": "apimgmt-noreply@mail.windowsazure.com"
    },
    "publisherName": {
      "value": "az-amorg-x-001"
    }
  }
}

using './packages/api-management-services/main.bicep'

// Required parameters
param name = 'apismin001'
param publisherEmail = 'apimgmt-noreply@mail.windowsazure.com'
param publisherName = 'az-amorg-x-001'

Example 3: Deploying a Developer SKU

This instance deploys the module using a Developer SKU.

module service './packages/api-management-services/main.bicep' = {
  name: 'serviceDeployment'
  params: {
    // Required parameters
    name: 'apisdev001'
    publisherEmail: 'apimgmt-noreply@mail.windowsazure.com'
    publisherName: 'az-amorg-x-001'
    // Non-required parameters
    enableDeveloperPortal: true
    sku: 'Developer'
  }
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    // Required parameters
    "name": {
      "value": "apisdev001"
    },
    "publisherEmail": {
      "value": "apimgmt-noreply@mail.windowsazure.com"
    },
    "publisherName": {
      "value": "az-amorg-x-001"
    },
    // Non-required parameters
    "enableDeveloperPortal": {
      "value": true
    },
    "sku": {
      "value": "Developer"
    }
  }
}

using './packages/api-management-services/main.bicep'

// Required parameters
param name = 'apisdev001'
param publisherEmail = 'apimgmt-noreply@mail.windowsazure.com'
param publisherName = 'az-amorg-x-001'
// Non-required parameters
param enableDeveloperPortal = true
param sku = 'Developer'

Example 4: Using large parameter set

This instance deploys the module with most of its features enabled.

module service './packages/api-management-services/main.bicep' = {
  name: 'serviceDeployment'
  params: {
    // Required parameters
    name: 'apismax001'
    publisherEmail: 'apimgmt-noreply@mail.windowsazure.com'
    publisherName: 'az-amorg-x-001'
    // Non-required parameters
    additionalLocations: [
      {
        disableGateway: false
        location: '<location>'
        publicIpAddressResourceId: '<publicIpAddressResourceId>'
        sku: {
          capacity: 1
          name: 'Premium'
        }
        virtualNetworkConfiguration: {
          subnetResourceId: '<subnetResourceId>'
        }
      }
    ]
    apiDiagnostics: [
      {
        apiName: 'echo-api'
        loggerName: 'logger'
        metrics: true
        name: 'applicationinsights'
      }
    ]
    apis: [
      {
        apiVersionSetName: 'echo-version-set'
        displayName: 'Echo API'
        name: 'echo-api'
        path: 'echo'
        protocols: [
          'http'
          'https'
        ]
        serviceUrl: 'http://echoapi.cloudapp.net/api'
      }
    ]
    apiVersionSets: [
      {
        description: 'echo-version-set'
        displayName: 'echo-version-set'
        name: 'echo-version-set'
        versioningScheme: 'Segment'
      }
    ]
    authorizationServers: [
      {
        authorizationEndpoint: '<authorizationEndpoint>'
        clientId: 'apimclientid'
        clientRegistrationEndpoint: 'http://localhost'
        clientSecret: '<clientSecret>'
        displayName: 'AuthServer1'
        grantTypes: [
          'authorizationCode'
        ]
        name: 'AuthServer1'
        tokenEndpoint: '<tokenEndpoint>'
      }
    ]
    backends: [
      {
        name: 'backend'
        tls: {
          validateCertificateChain: false
          validateCertificateName: false
        }
        url: 'http://echoapi.cloudapp.net/api'
      }
    ]
    caches: [
      {
        connectionString: 'connectionstringtest'
        name: 'westeurope'
        useFromLocation: 'westeurope'
      }
    ]
    diagnosticSettings: [
      {
        eventHubAuthorizationRuleResourceId: '<eventHubAuthorizationRuleResourceId>'
        eventHubName: '<eventHubName>'
        metricCategories: [
          {
            category: 'AllMetrics'
          }
        ]
        name: 'customSetting'
        storageAccountResourceId: '<storageAccountResourceId>'
        workspaceResourceId: '<workspaceResourceId>'
      }
    ]
    identityProviders: [
      {
        allowedTenants: [
          'mytenant.onmicrosoft.com'
        ]
        authority: '<authority>'
        clientId: 'apimClientid'
        clientLibrary: 'MSAL-2'
        clientSecret: 'apimSlientSecret'
        name: 'aad'
        signInTenant: 'mytenant.onmicrosoft.com'
      }
    ]
    location: '<location>'
    lock: {
      kind: 'CanNotDelete'
      name: 'myCustomLockName'
    }
    loggers: [
      {
        credentials: {
          instrumentationKey: '<instrumentationKey>'
        }
        description: 'Logger to Azure Application Insights'
        isBuffered: false
        name: 'logger'
        targetResourceId: '<targetResourceId>'
        type: 'applicationInsights'
      }
    ]
    managedIdentities: {
      systemAssigned: true
      userAssignedResourceIds: [
        '<managedIdentityResourceId>'
      ]
    }
    namedValues: [
      {
        displayName: 'apimkey'
        name: 'apimkey'
        secret: true
      }
    ]
    policies: [
      {
        format: 'xml'
        value: '<policies> <inbound> <rate-limit-by-key calls=\'250\' renewal-period=\'60\' counter-key=\'@(context.Request.IpAddress)\' /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>'
      }
    ]
    portalsettings: [
      {
        name: 'signin'
        properties: {
          enabled: false
        }
      }
      {
        name: 'signup'
        properties: {
          enabled: false
          termsOfService: {
            consentRequired: false
            enabled: false
          }
        }
      }
    ]
    products: [
      {
        apis: [
          'echo-api'
        ]
        approvalRequired: false
        displayName: 'Starter'
        groups: [
          'developers'
        ]
        name: 'Starter'
        subscriptionRequired: false
      }
    ]
    publicIpAddressResourceId: '<publicIpAddressResourceId>'
    publicNetworkAccess: 'Enabled'
    roleAssignments: [
      {
        name: '6352c3e3-ac6b-43d5-ac43-1077ff373721'
        principalId: '<principalId>'
        principalType: 'ServicePrincipal'
        roleDefinitionIdOrName: 'Owner'
      }
      {
        name: '<name>'
        principalId: '<principalId>'
        principalType: 'ServicePrincipal'
        roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
      }
      {
        principalId: '<principalId>'
        principalType: 'ServicePrincipal'
        roleDefinitionIdOrName: '<roleDefinitionIdOrName>'
      }
    ]
    subnetResourceId: '<subnetResourceId>'
    subscriptions: [
      {
        displayName: 'testArmSubscriptionAllApis'
        name: 'testArmSubscriptionAllApis'
        scope: '/apis'
      }
    ]
    tags: {
      Environment: 'Non-Prod'
      'hidden-title': 'This is visible in the resource name'
      Role: 'DeploymentValidation'
    }
    virtualNetworkType: 'Internal'
  }
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    // Required parameters
    "name": {
      "value": "apismax001"
    },
    "publisherEmail": {
      "value": "apimgmt-noreply@mail.windowsazure.com"
    },
    "publisherName": {
      "value": "az-amorg-x-001"
    },
    // Non-required parameters
    "additionalLocations": {
      "value": [
        {
          "disableGateway": false,
          "location": "<location>",
          "publicIpAddressResourceId": "<publicIpAddressResourceId>",
          "sku": {
            "capacity": 1,
            "name": "Premium"
          },
          "virtualNetworkConfiguration": {
            "subnetResourceId": "<subnetResourceId>"
          }
        }
      ]
    },
    "apiDiagnostics": {
      "value": [
        {
          "apiName": "echo-api",
          "loggerName": "logger",
          "metrics": true,
          "name": "applicationinsights"
        }
      ]
    },
    "apis": {
      "value": [
        {
          "apiVersionSetName": "echo-version-set",
          "displayName": "Echo API",
          "name": "echo-api",
          "path": "echo",
          "protocols": [
            "http",
            "https"
          ],
          "serviceUrl": "http://echoapi.cloudapp.net/api"
        }
      ]
    },
    "apiVersionSets": {
      "value": [
        {
          "description": "echo-version-set",
          "displayName": "echo-version-set",
          "name": "echo-version-set",
          "versioningScheme": "Segment"
        }
      ]
    },
    "authorizationServers": {
      "value": [
        {
          "authorizationEndpoint": "<authorizationEndpoint>",
          "clientId": "apimclientid",
          "clientRegistrationEndpoint": "http://localhost",
          "clientSecret": "<clientSecret>",
          "displayName": "AuthServer1",
          "grantTypes": [
            "authorizationCode"
          ],
          "name": "AuthServer1",
          "tokenEndpoint": "<tokenEndpoint>"
        }
      ]
    },
    "backends": {
      "value": [
        {
          "name": "backend",
          "tls": {
            "validateCertificateChain": false,
            "validateCertificateName": false
          },
          "url": "http://echoapi.cloudapp.net/api"
        }
      ]
    },
    "caches": {
      "value": [
        {
          "connectionString": "connectionstringtest",
          "name": "westeurope",
          "useFromLocation": "westeurope"
        }
      ]
    },
    "diagnosticSettings": {
      "value": [
        {
          "eventHubAuthorizationRuleResourceId": "<eventHubAuthorizationRuleResourceId>",
          "eventHubName": "<eventHubName>",
          "metricCategories": [
            {
              "category": "AllMetrics"
            }
          ],
          "name": "customSetting",
          "storageAccountResourceId": "<storageAccountResourceId>",
          "workspaceResourceId": "<workspaceResourceId>"
        }
      ]
    },
    "identityProviders": {
      "value": [
        {
          "allowedTenants": [
            "mytenant.onmicrosoft.com"
          ],
          "authority": "<authority>",
          "clientId": "apimClientid",
          "clientLibrary": "MSAL-2",
          "clientSecret": "apimSlientSecret",
          "name": "aad",
          "signInTenant": "mytenant.onmicrosoft.com"
        }
      ]
    },
    "location": {
      "value": "<location>"
    },
    "lock": {
      "value": {
        "kind": "CanNotDelete",
        "name": "myCustomLockName"
      }
    },
    "loggers": {
      "value": [
        {
          "credentials": {
            "instrumentationKey": "<instrumentationKey>"
          },
          "description": "Logger to Azure Application Insights",
          "isBuffered": false,
          "name": "logger",
          "targetResourceId": "<targetResourceId>",
          "type": "applicationInsights"
        }
      ]
    },
    "managedIdentities": {
      "value": {
        "systemAssigned": true,
        "userAssignedResourceIds": [
          "<managedIdentityResourceId>"
        ]
      }
    },
    "namedValues": {
      "value": [
        {
          "displayName": "apimkey",
          "name": "apimkey",
          "secret": true
        }
      ]
    },
    "policies": {
      "value": [
        {
          "format": "xml",
          "value": "<policies> <inbound> <rate-limit-by-key calls=\"250\" renewal-period=\"60\" counter-key=\"@(context.Request.IpAddress)\" /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>"
        }
      ]
    },
    "portalsettings": {
      "value": [
        {
          "name": "signin",
          "properties": {
            "enabled": false
          }
        },
        {
          "name": "signup",
          "properties": {
            "enabled": false,
            "termsOfService": {
              "consentRequired": false,
              "enabled": false
            }
          }
        }
      ]
    },
    "products": {
      "value": [
        {
          "apis": [
            "echo-api"
          ],
          "approvalRequired": false,
          "displayName": "Starter",
          "groups": [
            "developers"
          ],
          "name": "Starter",
          "subscriptionRequired": false
        }
      ]
    },
    "publicIpAddressResourceId": {
      "value": "<publicIpAddressResourceId>"
    },
    "publicNetworkAccess": {
      "value": "Enabled"
    },
    "roleAssignments": {
      "value": [
        {
          "name": "6352c3e3-ac6b-43d5-ac43-1077ff373721",
          "principalId": "<principalId>",
          "principalType": "ServicePrincipal",
          "roleDefinitionIdOrName": "Owner"
        },
        {
          "name": "<name>",
          "principalId": "<principalId>",
          "principalType": "ServicePrincipal",
          "roleDefinitionIdOrName": "b24988ac-6180-42a0-ab88-20f7382dd24c"
        },
        {
          "principalId": "<principalId>",
          "principalType": "ServicePrincipal",
          "roleDefinitionIdOrName": "<roleDefinitionIdOrName>"
        }
      ]
    },
    "subnetResourceId": {
      "value": "<subnetResourceId>"
    },
    "subscriptions": {
      "value": [
        {
          "displayName": "testArmSubscriptionAllApis",
          "name": "testArmSubscriptionAllApis",
          "scope": "/apis"
        }
      ]
    },
    "tags": {
      "value": {
        "Environment": "Non-Prod",
        "hidden-title": "This is visible in the resource name",
        "Role": "DeploymentValidation"
      }
    },
    "virtualNetworkType": {
      "value": "Internal"
    }
  }
}

using './packages/api-management-services/main.bicep'

// Required parameters
param name = 'apismax001'
param publisherEmail = 'apimgmt-noreply@mail.windowsazure.com'
param publisherName = 'az-amorg-x-001'
// Non-required parameters
param additionalLocations = [
  {
    disableGateway: false
    location: '<location>'
    publicIpAddressResourceId: '<publicIpAddressResourceId>'
    sku: {
      capacity: 1
      name: 'Premium'
    }
    virtualNetworkConfiguration: {
      subnetResourceId: '<subnetResourceId>'
    }
  }
]
param apiDiagnostics = [
  {
    apiName: 'echo-api'
    loggerName: 'logger'
    metrics: true
    name: 'applicationinsights'
  }
]
param apis = [
  {
    apiVersionSetName: 'echo-version-set'
    displayName: 'Echo API'
    name: 'echo-api'
    path: 'echo'
    protocols: [
      'http'
      'https'
    ]
    serviceUrl: 'http://echoapi.cloudapp.net/api'
  }
]
param apiVersionSets = [
  {
    description: 'echo-version-set'
    displayName: 'echo-version-set'
    name: 'echo-version-set'
    versioningScheme: 'Segment'
  }
]
param authorizationServers = [
  {
    authorizationEndpoint: '<authorizationEndpoint>'
    clientId: 'apimclientid'
    clientRegistrationEndpoint: 'http://localhost'
    clientSecret: '<clientSecret>'
    displayName: 'AuthServer1'
    grantTypes: [
      'authorizationCode'
    ]
    name: 'AuthServer1'
    tokenEndpoint: '<tokenEndpoint>'
  }
]
param backends = [
  {
    name: 'backend'
    tls: {
      validateCertificateChain: false
      validateCertificateName: false
    }
    url: 'http://echoapi.cloudapp.net/api'
  }
]
param caches = [
  {
    connectionString: 'connectionstringtest'
    name: 'westeurope'
    useFromLocation: 'westeurope'
  }
]
param diagnosticSettings = [
  {
    eventHubAuthorizationRuleResourceId: '<eventHubAuthorizationRuleResourceId>'
    eventHubName: '<eventHubName>'
    metricCategories: [
      {
        category: 'AllMetrics'
      }
    ]
    name: 'customSetting'
    storageAccountResourceId: '<storageAccountResourceId>'
    workspaceResourceId: '<workspaceResourceId>'
  }
]
param identityProviders = [
  {
    allowedTenants: [
      'mytenant.onmicrosoft.com'
    ]
    authority: '<authority>'
    clientId: 'apimClientid'
    clientLibrary: 'MSAL-2'
    clientSecret: 'apimSlientSecret'
    name: 'aad'
    signInTenant: 'mytenant.onmicrosoft.com'
  }
]
param location = '<location>'
param lock = {
  kind: 'CanNotDelete'
  name: 'myCustomLockName'
}
param loggers = [
  {
    credentials: {
      instrumentationKey: '<instrumentationKey>'
    }
    description: 'Logger to Azure Application Insights'
    isBuffered: false
    name: 'logger'
    targetResourceId: '<targetResourceId>'
    type: 'applicationInsights'
  }
]
param managedIdentities = {
  systemAssigned: true
  userAssignedResourceIds: [
    '<managedIdentityResourceId>'
  ]
}
param namedValues = [
  {
    displayName: 'apimkey'
    name: 'apimkey'
    secret: true
  }
]
param policies = [
  {
    format: 'xml'
    value: '<policies> <inbound> <rate-limit-by-key calls=\'250\' renewal-period=\'60\' counter-key=\'@(context.Request.IpAddress)\' /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>'
  }
]
param portalsettings = [
  {
    name: 'signin'
    properties: {
      enabled: false
    }
  }
  {
    name: 'signup'
    properties: {
      enabled: false
      termsOfService: {
        consentRequired: false
        enabled: false
      }
    }
  }
]
param products = [
  {
    apis: [
      'echo-api'
    ]
    approvalRequired: false
    displayName: 'Starter'
    groups: [
      'developers'
    ]
    name: 'Starter'
    subscriptionRequired: false
  }
]
param publicIpAddressResourceId = '<publicIpAddressResourceId>'
param publicNetworkAccess = 'Enabled'
param roleAssignments = [
  {
    name: '6352c3e3-ac6b-43d5-ac43-1077ff373721'
    principalId: '<principalId>'
    principalType: 'ServicePrincipal'
    roleDefinitionIdOrName: 'Owner'
  }
  {
    name: '<name>'
    principalId: '<principalId>'
    principalType: 'ServicePrincipal'
    roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
  }
  {
    principalId: '<principalId>'
    principalType: 'ServicePrincipal'
    roleDefinitionIdOrName: '<roleDefinitionIdOrName>'
  }
]
param subnetResourceId = '<subnetResourceId>'
param subscriptions = [
  {
    displayName: 'testArmSubscriptionAllApis'
    name: 'testArmSubscriptionAllApis'
    scope: '/apis'
  }
]
param tags = {
  Environment: 'Non-Prod'
  'hidden-title': 'This is visible in the resource name'
  Role: 'DeploymentValidation'
}
param virtualNetworkType = 'Internal'

Example 5: Deploying an APIM v2 sku

This instance deploys the module using a v2 SKU.

module service './packages/api-management-services/main.bicep' = {
  name: 'serviceDeployment'
  params: {
    // Required parameters
    name: 'apisv2s001'
    publisherEmail: 'apimgmt-noreply@mail.windowsazure.com'
    publisherName: 'az-amorg-x-001'
    // Non-required parameters
    enableDeveloperPortal: true
    sku: 'BasicV2'
  }
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    // Required parameters
    "name": {
      "value": "apisv2s001"
    },
    "publisherEmail": {
      "value": "apimgmt-noreply@mail.windowsazure.com"
    },
    "publisherName": {
      "value": "az-amorg-x-001"
    },
    // Non-required parameters
    "enableDeveloperPortal": {
      "value": true
    },
    "sku": {
      "value": "BasicV2"
    }
  }
}

using './packages/api-management-services/main.bicep'

// Required parameters
param name = 'apisv2s001'
param publisherEmail = 'apimgmt-noreply@mail.windowsazure.com'
param publisherName = 'az-amorg-x-001'
// Non-required parameters
param enableDeveloperPortal = true
param sku = 'BasicV2'

Example 6: WAF-aligned

This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.

module service './packages/api-management-services/main.bicep' = {
  name: 'serviceDeployment'
  params: {
    // Required parameters
    name: 'apiswaf002'
    publisherEmail: 'apimgmt-noreply@mail.windowsazure.com'
    publisherName: 'az-amorg-x-001'
    // Non-required parameters
    additionalLocations: [
      {
        availabilityZones: [
          1
          2
          3
        ]
        disableGateway: false
        location: '<location>'
        sku: {
          capacity: 3
          name: 'Premium'
        }
      }
    ]
    apis: [
      {
        apiVersionSetName: 'echo-version-set'
        description: 'An echo API service'
        displayName: 'Echo API'
        name: 'echo-api'
        path: 'echo'
        protocols: [
          'https'
        ]
        serviceUrl: 'https://echoapi.cloudapp.net/api'
      }
    ]
    apiVersionSets: [
      {
        description: 'An echo API version set'
        displayName: 'Echo version set'
        name: 'echo-version-set'
        versioningScheme: 'Segment'
      }
    ]
    authorizationServers: [
      {
        authorizationEndpoint: '<authorizationEndpoint>'
        clientId: 'apimClientid'
        clientRegistrationEndpoint: 'https://localhost'
        clientSecret: '<clientSecret>'
        displayName: 'AuthServer1'
        grantTypes: [
          'authorizationCode'
        ]
        name: 'AuthServer1'
        tokenEndpoint: '<tokenEndpoint>'
      }
    ]
    backends: [
      {
        name: 'backend'
        tls: {
          validateCertificateChain: true
          validateCertificateName: true
        }
        url: 'https://echoapi.cloudapp.net/api'
      }
    ]
    caches: [
      {
        connectionString: 'connectionstringtest'
        name: 'westeurope'
        useFromLocation: 'westeurope'
      }
    ]
    customProperties: {
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2': 'True'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA256': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_GCM_SHA256': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA256': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11': 'False'
    }
    diagnosticSettings: [
      {
        eventHubAuthorizationRuleResourceId: '<eventHubAuthorizationRuleResourceId>'
        eventHubName: '<eventHubName>'
        storageAccountResourceId: '<storageAccountResourceId>'
        workspaceResourceId: '<workspaceResourceId>'
      }
    ]
    identityProviders: [
      {
        allowedTenants: [
          'mytenant.onmicrosoft.com'
        ]
        authority: '<authority>'
        clientId: 'apimClientid'
        clientLibrary: 'MSAL-2'
        clientSecret: '<clientSecret>'
        name: 'aad'
        signInTenant: 'mytenant.onmicrosoft.com'
      }
    ]
    loggers: [
      {
        credentials: {
          instrumentationKey: '<instrumentationKey>'
        }
        description: 'Logger to Azure Application Insights'
        isBuffered: false
        name: 'logger'
        targetResourceId: '<targetResourceId>'
        type: 'applicationInsights'
      }
    ]
    managedIdentities: {
      systemAssigned: true
      userAssignedResourceIds: [
        '<managedIdentityResourceId>'
      ]
    }
    namedValues: [
      {
        displayName: 'apimkey'
        name: 'apimkey'
        secret: true
      }
    ]
    policies: [
      {
        format: 'xml'
        value: '<policies> <inbound> <rate-limit-by-key calls=\'250\' renewal-period=\'60\' counter-key=\'@(context.Request.IpAddress)\' /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>'
      }
    ]
    portalsettings: [
      {
        name: 'signin'
        properties: {
          enabled: false
        }
      }
      {
        name: 'signup'
        properties: {
          enabled: false
          termsOfService: {
            consentRequired: false
            enabled: false
          }
        }
      }
    ]
    privateEndpoints: [
      {
        privateDnsZoneGroup: {
          privateDnsZoneGroupConfigs: [
            {
              privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
            }
          ]
        }
        subnetResourceId: '<subnetResourceId>'
      }
    ]
    products: [
      {
        apis: [
          'echo-api'
        ]
        approvalRequired: true
        description: 'This is an echo API'
        displayName: 'Echo API'
        groups: [
          'developers'
        ]
        name: 'Starter'
        subscriptionRequired: true
        terms: 'By accessing or using the services provided by Echo API through Azure API Management, you agree to be bound by these Terms of Use. These terms may be updated from time to time, and your continued use of the services constitutes acceptance of any changes.'
      }
    ]
    publicNetworkAccess: '<publicNetworkAccess>'
    subscriptions: [
      {
        displayName: 'testArmSubscriptionAllApis'
        name: 'testArmSubscriptionAllApis'
        scope: '/apis'
      }
    ]
    tags: {
      Environment: 'Non-Prod'
      'hidden-title': 'This is visible in the resource name'
      Role: 'DeploymentValidation'
    }
  }
}

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    // Required parameters
    "name": {
      "value": "apiswaf002"
    },
    "publisherEmail": {
      "value": "apimgmt-noreply@mail.windowsazure.com"
    },
    "publisherName": {
      "value": "az-amorg-x-001"
    },
    // Non-required parameters
    "additionalLocations": {
      "value": [
        {
          "availabilityZones": [
            1,
            2,
            3
          ],
          "disableGateway": false,
          "location": "<location>",
          "sku": {
            "capacity": 3,
            "name": "Premium"
          }
        }
      ]
    },
    "apis": {
      "value": [
        {
          "apiVersionSetName": "echo-version-set",
          "description": "An echo API service",
          "displayName": "Echo API",
          "name": "echo-api",
          "path": "echo",
          "protocols": [
            "https"
          ],
          "serviceUrl": "https://echoapi.cloudapp.net/api"
        }
      ]
    },
    "apiVersionSets": {
      "value": [
        {
          "description": "An echo API version set",
          "displayName": "Echo version set",
          "name": "echo-version-set",
          "versioningScheme": "Segment"
        }
      ]
    },
    "authorizationServers": {
      "value": [
        {
          "authorizationEndpoint": "<authorizationEndpoint>",
          "clientId": "apimClientid",
          "clientRegistrationEndpoint": "https://localhost",
          "clientSecret": "<clientSecret>",
          "displayName": "AuthServer1",
          "grantTypes": [
            "authorizationCode"
          ],
          "name": "AuthServer1",
          "tokenEndpoint": "<tokenEndpoint>"
        }
      ]
    },
    "backends": {
      "value": [
        {
          "name": "backend",
          "tls": {
            "validateCertificateChain": true,
            "validateCertificateName": true
          },
          "url": "https://echoapi.cloudapp.net/api"
        }
      ]
    },
    "caches": {
      "value": [
        {
          "connectionString": "connectionstringtest",
          "name": "westeurope",
          "useFromLocation": "westeurope"
        }
      ]
    },
    "customProperties": {
      "value": {
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2": "True",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA256": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_GCM_SHA256": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA256": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": "False",
        "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": "False"
      }
    },
    "diagnosticSettings": {
      "value": [
        {
          "eventHubAuthorizationRuleResourceId": "<eventHubAuthorizationRuleResourceId>",
          "eventHubName": "<eventHubName>",
          "storageAccountResourceId": "<storageAccountResourceId>",
          "workspaceResourceId": "<workspaceResourceId>"
        }
      ]
    },
    "identityProviders": {
      "value": [
        {
          "allowedTenants": [
            "mytenant.onmicrosoft.com"
          ],
          "authority": "<authority>",
          "clientId": "apimClientid",
          "clientLibrary": "MSAL-2",
          "clientSecret": "<clientSecret>",
          "name": "aad",
          "signInTenant": "mytenant.onmicrosoft.com"
        }
      ]
    },
    "loggers": {
      "value": [
        {
          "credentials": {
            "instrumentationKey": "<instrumentationKey>"
          },
          "description": "Logger to Azure Application Insights",
          "isBuffered": false,
          "name": "logger",
          "targetResourceId": "<targetResourceId>",
          "type": "applicationInsights"
        }
      ]
    },
    "managedIdentities": {
      "value": {
        "systemAssigned": true,
        "userAssignedResourceIds": [
          "<managedIdentityResourceId>"
        ]
      }
    },
    "namedValues": {
      "value": [
        {
          "displayName": "apimkey",
          "name": "apimkey",
          "secret": true
        }
      ]
    },
    "policies": {
      "value": [
        {
          "format": "xml",
          "value": "<policies> <inbound> <rate-limit-by-key calls=\"250\" renewal-period=\"60\" counter-key=\"@(context.Request.IpAddress)\" /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>"
        }
      ]
    },
    "portalsettings": {
      "value": [
        {
          "name": "signin",
          "properties": {
            "enabled": false
          }
        },
        {
          "name": "signup",
          "properties": {
            "enabled": false,
            "termsOfService": {
              "consentRequired": false,
              "enabled": false
            }
          }
        }
      ]
    },
    "privateEndpoints": {
      "value": [
        {
          "privateDnsZoneGroup": {
            "privateDnsZoneGroupConfigs": [
              {
                "privateDnsZoneResourceId": "<privateDnsZoneResourceId>"
              }
            ]
          },
          "subnetResourceId": "<subnetResourceId>"
        }
      ]
    },
    "products": {
      "value": [
        {
          "apis": [
            "echo-api"
          ],
          "approvalRequired": true,
          "description": "This is an echo API",
          "displayName": "Echo API",
          "groups": [
            "developers"
          ],
          "name": "Starter",
          "subscriptionRequired": true,
          "terms": "By accessing or using the services provided by Echo API through Azure API Management, you agree to be bound by these Terms of Use. These terms may be updated from time to time, and your continued use of the services constitutes acceptance of any changes."
        }
      ]
    },
    "publicNetworkAccess": {
      "value": "<publicNetworkAccess>"
    },
    "subscriptions": {
      "value": [
        {
          "displayName": "testArmSubscriptionAllApis",
          "name": "testArmSubscriptionAllApis",
          "scope": "/apis"
        }
      ]
    },
    "tags": {
      "value": {
        "Environment": "Non-Prod",
        "hidden-title": "This is visible in the resource name",
        "Role": "DeploymentValidation"
      }
    }
  }
}

using './packages/api-management-services/main.bicep'

// Required parameters
param name = 'apiswaf002'
param publisherEmail = 'apimgmt-noreply@mail.windowsazure.com'
param publisherName = 'az-amorg-x-001'
// Non-required parameters
param additionalLocations = [
  {
    availabilityZones: [
      1
      2
      3
    ]
    disableGateway: false
    location: '<location>'
    sku: {
      capacity: 3
      name: 'Premium'
    }
  }
]
param apis = [
  {
    apiVersionSetName: 'echo-version-set'
    description: 'An echo API service'
    displayName: 'Echo API'
    name: 'echo-api'
    path: 'echo'
    protocols: [
      'https'
    ]
    serviceUrl: 'https://echoapi.cloudapp.net/api'
  }
]
param apiVersionSets = [
  {
    description: 'An echo API version set'
    displayName: 'Echo version set'
    name: 'echo-version-set'
    versioningScheme: 'Segment'
  }
]
param authorizationServers = [
  {
    authorizationEndpoint: '<authorizationEndpoint>'
    clientId: 'apimClientid'
    clientRegistrationEndpoint: 'https://localhost'
    clientSecret: '<clientSecret>'
    displayName: 'AuthServer1'
    grantTypes: [
      'authorizationCode'
    ]
    name: 'AuthServer1'
    tokenEndpoint: '<tokenEndpoint>'
  }
]
param backends = [
  {
    name: 'backend'
    tls: {
      validateCertificateChain: true
      validateCertificateName: true
    }
    url: 'https://echoapi.cloudapp.net/api'
  }
]
param caches = [
  {
    connectionString: 'connectionstringtest'
    name: 'westeurope'
    useFromLocation: 'westeurope'
  }
]
param customProperties = {
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2': 'True'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA256': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_GCM_SHA256': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA256': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10': 'False'
  'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11': 'False'
}
param diagnosticSettings = [
  {
    eventHubAuthorizationRuleResourceId: '<eventHubAuthorizationRuleResourceId>'
    eventHubName: '<eventHubName>'
    storageAccountResourceId: '<storageAccountResourceId>'
    workspaceResourceId: '<workspaceResourceId>'
  }
]
param identityProviders = [
  {
    allowedTenants: [
      'mytenant.onmicrosoft.com'
    ]
    authority: '<authority>'
    clientId: 'apimClientid'
    clientLibrary: 'MSAL-2'
    clientSecret: '<clientSecret>'
    name: 'aad'
    signInTenant: 'mytenant.onmicrosoft.com'
  }
]
param loggers = [
  {
    credentials: {
      instrumentationKey: '<instrumentationKey>'
    }
    description: 'Logger to Azure Application Insights'
    isBuffered: false
    name: 'logger'
    targetResourceId: '<targetResourceId>'
    type: 'applicationInsights'
  }
]
param managedIdentities = {
  systemAssigned: true
  userAssignedResourceIds: [
    '<managedIdentityResourceId>'
  ]
}
param namedValues = [
  {
    displayName: 'apimkey'
    name: 'apimkey'
    secret: true
  }
]
param policies = [
  {
    format: 'xml'
    value: '<policies> <inbound> <rate-limit-by-key calls=\'250\' renewal-period=\'60\' counter-key=\'@(context.Request.IpAddress)\' /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>'
  }
]
param portalsettings = [
  {
    name: 'signin'
    properties: {
      enabled: false
    }
  }
  {
    name: 'signup'
    properties: {
      enabled: false
      termsOfService: {
        consentRequired: false
        enabled: false
      }
    }
  }
]
param privateEndpoints = [
  {
    privateDnsZoneGroup: {
      privateDnsZoneGroupConfigs: [
        {
          privateDnsZoneResourceId: '<privateDnsZoneResourceId>'
        }
      ]
    }
    subnetResourceId: '<subnetResourceId>'
  }
]
param products = [
  {
    apis: [
      'echo-api'
    ]
    approvalRequired: true
    description: 'This is an echo API'
    displayName: 'Echo API'
    groups: [
      'developers'
    ]
    name: 'Starter'
    subscriptionRequired: true
    terms: 'By accessing or using the services provided by Echo API through Azure API Management, you agree to be bound by these Terms of Use. These terms may be updated from time to time, and your continued use of the services constitutes acceptance of any changes.'
  }
]
param publicNetworkAccess = '<publicNetworkAccess>'
param subscriptions = [
  {
    displayName: 'testArmSubscriptionAllApis'
    name: 'testArmSubscriptionAllApis'
    scope: '/apis'
  }
]
param tags = {
  Environment: 'Non-Prod'
  'hidden-title': 'This is visible in the resource name'
  Role: 'DeploymentValidation'
}

Parameters

Required parameters

Conditional parameters

Optional parameters

Parameter: name

The name of the API Management service.

• Required: Yes
• Type: string

Parameter: publisherEmail

The email address of the owner of the service.

• Required: Yes
• Type: string

Parameter: publisherName

The name of the owner of the service.

• Required: Yes
• Type: string

Parameter: skuCapacity

The scale units for this API Management service. Required if using Basic, Standard, or Premium skus. For range of capacities for each sku, reference https://azure.microsoft.com/en-us/pricing/details/api-management/.

• Required: No
• Type: int
• Default: 3

Parameter: additionalLocations

Additional datacenter locations of the API Management service. Not supported with V2 SKUs.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: additionalLocations.location

The location name of the additional region among Azure Data center regions.

• Required: Yes
• Type: string

Parameter: additionalLocations.sku

SKU properties of the API Management service.

• Required: Yes
• Type: object

Required parameters

Parameter: additionalLocations.sku.capacity

Capacity of the SKU (number of deployed units of the SKU). For Consumption SKU capacity must be specified as 0.

• Required: Yes
• Type: int

Parameter: additionalLocations.sku.name

Name of the Sku.

• Required: Yes
• Type: string
• Allowed:

  [
    'Basic'
    'BasicV2'
    'Consumption'
    'Developer'
    'Isolated'
    'Premium'
    'Standard'
    'StandardV2'
  ]
  

Parameter: additionalLocations.availabilityZones

A list of availability zones denoting where the resource needs to come from.

• Required: No
• Type: array
• Allowed:

  [
    1
    2
    3
  ]
  

Parameter: additionalLocations.disableGateway

Property only valid for an Api Management service deployed in multiple locations. This can be used to disable the gateway in this additional location.

• Required: No
• Type: bool

Parameter: additionalLocations.natGatewayState

Property can be used to enable NAT Gateway for this API Management service.

• Required: No
• Type: string
• Allowed:

  [
    'Disabled'
    'Enabled'
  ]
  

Parameter: additionalLocations.publicIpAddressResourceId

Public Standard SKU IP V4 based IP address to be associated with Virtual Network deployed service in the location. Supported only for Premium SKU being deployed in Virtual Network.

• Required: No
• Type: string

Parameter: additionalLocations.virtualNetworkConfiguration

Virtual network configuration for the location.

• Required: No
• Type: object

Required parameters

Parameter: additionalLocations.virtualNetworkConfiguration.subnetResourceId

The full resource ID of a subnet in a virtual network to deploy the API Management service in.

• Required: Yes
• Type: string

Parameter: apiDiagnostics

API Diagnostics.

• Required: No
• Type: array

Required parameters

Conditional parameters

Optional parameters

Parameter: apiDiagnostics.apiName

The name of the parent API.

• Required: Yes
• Type: string

Parameter: apiDiagnostics.loggerName

The name of the logger.

• Required: Yes
• Type: string

Parameter: apiDiagnostics.httpCorrelationProtocol

Sets correlation protocol to use for Application Insights diagnostics. Required if using Application Insights.

• Required: No
• Type: string
• Allowed:

  [
    'Legacy'
    'None'
    'W3C'
  ]
  

Parameter: apiDiagnostics.metrics

Emit custom metrics via emit-metric policy. Required if using Application Insights.

• Required: No
• Type: bool

Parameter: apiDiagnostics.operationNameFormat

The format of the Operation Name for Application Insights telemetries. Required if using Application Insights.

• Required: No
• Type: string
• Allowed:

  [
    'Name'
    'URI'
  ]
  

Parameter: apiDiagnostics.alwaysLog

Specifies for what type of messages sampling settings should not apply.

• Required: No
• Type: string

Parameter: apiDiagnostics.backend

Diagnostic settings for incoming/outgoing HTTP messages to the Backend.

• Required: No
• Type: object

Parameter: apiDiagnostics.frontend

Diagnostic settings for incoming/outgoing HTTP messages to the Gateway.

• Required: No
• Type: object

Parameter: apiDiagnostics.logClientIp

Log the ClientIP.

• Required: No
• Type: bool

Parameter: apiDiagnostics.name

Type of diagnostic resource.

• Required: No
• Type: string
• Allowed:

  [
    'applicationinsights'
    'azuremonitor'
    'local'
  ]
  

Parameter: apiDiagnostics.samplingPercentage

Rate of sampling for fixed-rate sampling. Specifies the percentage of requests that are logged. 0% sampling means zero requests logged, while 100% sampling means all requests logged.

• Required: No
• Type: int

Parameter: apiDiagnostics.verbosity

The verbosity level applied to traces emitted by trace policies.

• Required: No
• Type: string
• Allowed:

  [
    'error'
    'information'
    'verbose'
  ]
  

Parameter: apis

APIs.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: apis.displayName

API name. Must be 1 to 300 characters long.

• Required: Yes
• Type: string

Parameter: apis.name

API revision identifier. Must be unique in the current API Management service instance. Non-current revision has ;rev=n as a suffix where n is the revision number.

• Required: Yes
• Type: string

Parameter: apis.path

Relative URL uniquely identifying this API and all of its resource paths within the API Management service instance. It is appended to the API endpoint base URL specified during the service instance creation to form a public URL for this API.

• Required: Yes
• Type: string

Parameter: apis.apiRevision

Describes the Revision of the API. If no value is provided, default revision 1 is created.

• Required: No
• Type: string

Parameter: apis.apiRevisionDescription

Description of the API Revision.

• Required: No
• Type: string

Parameter: apis.apiType

Type of API to create. * http creates a REST API * soap creates a SOAP pass-through API * websocket creates websocket API * graphql creates GraphQL API.

• Required: No
• Type: string
• Allowed:

  [
    'graphql'
    'http'
    'soap'
    'websocket'
  ]
  

Parameter: apis.apiVersion

Indicates the Version identifier of the API if the API is versioned.

• Required: No
• Type: string

Parameter: apis.apiVersionDescription

Description of the API Version.

• Required: No
• Type: string

Parameter: apis.apiVersionSetName

The name of the API version set to link.

• Required: No
• Type: string

Parameter: apis.authenticationSettings

Collection of authentication settings included into this API.

• Required: No
• Type: object

Parameter: apis.description

Description of the API. May include HTML formatting tags.

• Required: No
• Type: string

Parameter: apis.diagnostics

Array of diagnostics to apply to the Service API.

• Required: No
• Type: array

Required parameters

Conditional parameters

Optional parameters

Parameter: apis.diagnostics.loggerName

The name of the logger.

• Required: Yes
• Type: string

Parameter: apis.diagnostics.httpCorrelationProtocol

Sets correlation protocol to use for Application Insights diagnostics. Required if using Application Insights.

• Required: No
• Type: string
• Allowed:

  [
    'Legacy'
    'None'
    'W3C'
  ]
  

Parameter: apis.diagnostics.metrics

Emit custom metrics via emit-metric policy. Required if using Application Insights.

• Required: No
• Type: bool

Parameter: apis.diagnostics.operationNameFormat

The format of the Operation Name for Application Insights telemetries. Required if using Application Insights.

• Required: No
• Type: string
• Allowed:

  [
    'Name'
    'URI'
  ]
  

Parameter: apis.diagnostics.alwaysLog

Specifies for what type of messages sampling settings should not apply.

• Required: No
• Type: string

Parameter: apis.diagnostics.backend

Diagnostic settings for incoming/outgoing HTTP messages to the Backend.

• Required: No
• Type: object

Parameter: apis.diagnostics.frontend

Diagnostic settings for incoming/outgoing HTTP messages to the Gateway.

• Required: No
• Type: object

Parameter: apis.diagnostics.logClientIp

Log the ClientIP.

• Required: No
• Type: bool

Parameter: apis.diagnostics.name

Type of diagnostic resource.

• Required: No
• Type: string
• Allowed:

  [
    'applicationinsights'
    'azuremonitor'
    'local'
  ]
  

Parameter: apis.diagnostics.samplingPercentage

Rate of sampling for fixed-rate sampling. Specifies the percentage of requests that are logged. 0% sampling means zero requests logged, while 100% sampling means all requests logged.

• Required: No
• Type: int

Parameter: apis.diagnostics.verbosity

The verbosity level applied to traces emitted by trace policies.

• Required: No
• Type: string
• Allowed:

  [
    'error'
    'information'
    'verbose'
  ]
  

Parameter: apis.format

Format of the Content in which the API is getting imported.

• Required: No
• Type: string
• Allowed:

  [
    'openapi'
    'openapi-link'
    'openapi+json'
    'openapi+json-link'
    'swagger-json'
    'swagger-link-json'
    'wadl-link-json'
    'wadl-xml'
    'wsdl'
    'wsdl-link'
  ]
  

Parameter: apis.isCurrent

Indicates if API revision is current API revision.

• Required: No
• Type: bool

Parameter: apis.operations

The operations of the api.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: apis.operations.displayName

The display name of the operation.

• Required: Yes
• Type: string

Parameter: apis.operations.method

A Valid HTTP Operation Method. Typical Http Methods like GET, PUT, POST but not limited by only them.

• Required: Yes
• Type: string

Parameter: apis.operations.name

The name of the policy.

• Required: Yes
• Type: string

Parameter: apis.operations.urlTemplate

Relative URL template identifying the target resource for this operation. May include parameters. Example: /customers/{cid}/orders/{oid}/?date={date}.

• Required: Yes
• Type: string

Parameter: apis.operations.description

Description of the operation. May include HTML formatting tags. Must not be longer than 1.000 characters.

• Required: No
• Type: string

Parameter: apis.operations.policies

The policies to apply to the operation.

• Required: No
• Type: array

Required parameters

Parameter: apis.operations.policies.format

Format of the policyContent.

• Required: Yes
• Type: string
• Allowed:

  [
    'rawxml'
    'rawxml-link'
    'xml'
    'xml-link'
  ]
  

Parameter: apis.operations.policies.name

The name of the policy.

• Required: Yes
• Type: string

Parameter: apis.operations.policies.value

Contents of the Policy as defined by the format.

• Required: Yes
• Type: string

Parameter: apis.operations.request

An entity containing request details.

• Required: No
• Type: object

Parameter: apis.operations.responses

An entity containing request details.

• Required: No
• Type: array

Parameter: apis.operations.templateParameters

Collection of URL template parameters.

• Required: No
• Type: array

Parameter: apis.policies

Array of Policies to apply to the Service API.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: apis.policies.value

Contents of the Policy as defined by the format.

• Required: Yes
• Type: string

Parameter: apis.policies.format

Format of the policyContent.

• Required: No
• Type: string
• Allowed:

  [
    'rawxml'
    'rawxml-link'
    'xml'
    'xml-link'
  ]
  

Parameter: apis.policies.name

The name of the policy.

• Required: No
• Type: string

Parameter: apis.protocols

Describes on which protocols the operations in this API can be invoked. - HTTP or HTTPS.

• Required: No
• Type: array

Parameter: apis.serviceUrl

Absolute URL of the backend service implementing this API. Cannot be more than 2000 characters long.

• Required: No
• Type: string

Parameter: apis.sourceApiId

API identifier of the source API.

• Required: No
• Type: string

Parameter: apis.subscriptionKeyParameterNames

Protocols over which API is made available.

• Required: No
• Type: object

Parameter: apis.subscriptionRequired

Specifies whether an API or Product subscription is required for accessing the API.

• Required: No
• Type: bool

Parameter: apis.type

Type of API.

• Required: No
• Type: string
• Allowed:

  [
    'graphql'
    'http'
    'soap'
    'websocket'
  ]
  

Parameter: apis.value

Content value when Importing an API.

• Required: No
• Type: string

Parameter: apiVersionSets

API Version Sets.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: apiVersionSets.displayName

The display name of the Name of API Version Set.

• Required: Yes
• Type: string

Parameter: apiVersionSets.name

API Version set name.

• Required: Yes
• Type: string

Parameter: apiVersionSets.versioningScheme

An value that determines where the API Version identifier will be located in a HTTP request.

• Required: Yes
• Type: string
• Allowed:

  [
    'Header'
    'Query'
    'Segment'
  ]
  

Parameter: apiVersionSets.description

Description of API Version Set.

• Required: No
• Type: string

Parameter: apiVersionSets.versionHeaderName

Name of HTTP header parameter that indicates the API Version if versioningScheme is set to header.

• Required: No
• Type: string

Parameter: apiVersionSets.versionQueryName

Name of query parameter that indicates the API Version if versioningScheme is set to query.

• Required: No
• Type: string

Parameter: authorizationServers

Authorization servers.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: authorizationServers.authorizationEndpoint

OAuth authorization endpoint. See http://tools.ietf.org/html/rfc6749#section-3.2.

• Required: Yes
• Type: string

Parameter: authorizationServers.clientId

Client or app ID registered with this authorization server.

• Required: Yes
• Type: securestring

Parameter: authorizationServers.clientSecret

Client or app secret registered with this authorization server. This property will not be filled on 'GET' operations! Use '/listSecrets' POST request to get the value.

• Required: Yes
• Type: securestring

Parameter: authorizationServers.displayName

API Management Service Authorization Servers name. Must be 1 to 50 characters long.

• Required: Yes
• Type: string

Parameter: authorizationServers.grantTypes

Form of an authorization grant, which the client uses to request the access token. - authorizationCode, implicit, resourceOwnerPassword, clientCredentials.

• Required: Yes
• Type: array
• Allowed:

  [
    'authorizationCode'
    'clientCredentials'
    'implicit'
    'resourceOwnerPassword'
  ]
  

Parameter: authorizationServers.name

Identifier of the authorization server.

• Required: Yes
• Type: string

Parameter: authorizationServers.authorizationMethods

HTTP verbs supported by the authorization endpoint. GET must be always present. POST is optional. - HEAD, OPTIONS, TRACE, GET, POST, PUT, PATCH, DELETE.

• Required: No
• Type: array

Parameter: authorizationServers.bearerTokenSendingMethods

Specifies the mechanism by which access token is passed to the API. - authorizationHeader or query.

• Required: No
• Type: array

Parameter: authorizationServers.clientAuthenticationMethod

Method of authentication supported by the token endpoint of this authorization server. Possible values are Basic and/or Body. When Body is specified, client credentials and other parameters are passed within the request body in the application/x-www-form-urlencoded format. - Basic or Body.

• Required: No
• Type: array

Parameter: authorizationServers.clientRegistrationEndpoint

Optional reference to a page where client or app registration for this authorization server is performed. Contains absolute URL to entity being referenced.

• Required: No
• Type: string

Parameter: authorizationServers.defaultScope

Access token scope that is going to be requested by default. Can be overridden at the API level. Should be provided in the form of a string containing space-delimited values.

• Required: No
• Type: string

Parameter: authorizationServers.resourceOwnerPassword

Can be optionally specified when resource owner password grant type is supported by this authorization server. Default resource owner password.

• Required: No
• Type: securestring

Parameter: authorizationServers.resourceOwnerUsername

Can be optionally specified when resource owner password grant type is supported by this authorization server. Default resource owner username.

• Required: No
• Type: string

Parameter: authorizationServers.serverDescription

Description of the authorization server. Can contain HTML formatting tags.

• Required: No
• Type: string

Parameter: authorizationServers.supportState

If true, authorization server will include state parameter from the authorization request to its response. Client may use state parameter to raise protocol security.

• Required: No
• Type: bool

Parameter: authorizationServers.tokenBodyParameters

Additional parameters required by the token endpoint of this authorization server represented as an array of JSON objects with name and value string properties, i.e. {"name" : "name value", "value": "a value"}. - TokenBodyParameterContract object.

• Required: No
• Type: array

Parameter: authorizationServers.tokenEndpoint

OAuth token endpoint. Contains absolute URI to entity being referenced.

• Required: No
• Type: string

Parameter: availabilityZones

A list of availability zones denoting where the resource needs to come from. Only supported by Premium sku.

• Required: No
• Type: array
• Default:

  [
    1
    2
    3
  ]
  

• Allowed:

  [
    1
    2
    3
  ]
  

Parameter: backends

Backends.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: backends.name

Backend Name.

• Required: Yes
• Type: string

Parameter: backends.url

Runtime URL of the Backend.

• Required: Yes
• Type: string

Parameter: backends.credentials

Backend Credentials Contract Properties.

• Required: No
• Type: object

Parameter: backends.description

Backend Description.

• Required: No
• Type: string

Parameter: backends.protocol

Backend communication protocol. - http or soap.

• Required: No
• Type: string

Parameter: backends.proxy

Backend Proxy Contract Properties.

• Required: No
• Type: object

Parameter: backends.resourceId

Management Uri of the Resource in External System. This URL can be the Arm Resource ID of Logic Apps, Function Apps or API Apps.

• Required: No
• Type: string

Parameter: backends.serviceFabricCluster

Backend Service Fabric Cluster Properties.

• Required: No
• Type: object

Parameter: backends.title

Backend Title.

• Required: No
• Type: string

Parameter: backends.tls

Backend TLS Properties.

• Required: No
• Type: object

Parameter: caches

Caches.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: caches.connectionString

Runtime connection string to cache. Can be referenced by a named value like so, {{}}.

• Required: Yes
• Type: string

Parameter: caches.name

Identifier of the Cache entity. Cache identifier (should be either 'default' or valid Azure region identifier).

• Required: Yes
• Type: string

Parameter: caches.useFromLocation

Location identifier to use cache from (should be either 'default' or valid Azure region identifier).

• Required: Yes
• Type: string

Parameter: caches.description

Cache description.

• Required: No
• Type: string

Parameter: caches.resourceId

Original uri of entity in external system cache points to.

• Required: No
• Type: string

Parameter: certificates

List of Certificates that need to be installed in the API Management service. Max supported certificates that can be installed is 10.

• Required: No
• Type: array

Parameter: customProperties

Custom properties of the API Management service. Not supported if SKU is Consumption.

• Required: No
• Type: object
• Default:

  {
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA256': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_GCM_SHA256': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA256': 'False'
      'Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168': 'False'
  }
  

Parameter: diagnosticSettings

The diagnostic settings of the service.

• Required: No
• Type: array

Optional parameters

Parameter: diagnosticSettings.eventHubAuthorizationRuleResourceId

Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to.

• Required: No
• Type: string

Parameter: diagnosticSettings.eventHubName

Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.

• Required: No
• Type: string

Parameter: diagnosticSettings.logAnalyticsDestinationType

A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type.

• Required: No
• Type: string
• Allowed:

  [
    'AzureDiagnostics'
    'Dedicated'
  ]
  

Parameter: diagnosticSettings.logCategoriesAndGroups

The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to [] to disable log collection.

• Required: No
• Type: array

Optional parameters

Parameter: diagnosticSettings.logCategoriesAndGroups.category

Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here.

• Required: No
• Type: string

Parameter: diagnosticSettings.logCategoriesAndGroups.categoryGroup

Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to allLogs to collect all logs.

• Required: No
• Type: string

Parameter: diagnosticSettings.logCategoriesAndGroups.enabled

Enable or disable the category explicitly. Default is true.

• Required: No
• Type: bool

Parameter: diagnosticSettings.marketplacePartnerResourceId

The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.

• Required: No
• Type: string

Parameter: diagnosticSettings.metricCategories

The name of metrics that will be streamed. "allMetrics" includes all possible metrics for the resource. Set to [] to disable metric collection.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: diagnosticSettings.metricCategories.category

Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to AllMetrics to collect all metrics.

• Required: Yes
• Type: string

Parameter: diagnosticSettings.metricCategories.enabled

Enable or disable the category explicitly. Default is true.

• Required: No
• Type: bool

Parameter: diagnosticSettings.name

The name of the diagnostic setting.

• Required: No
• Type: string

Parameter: diagnosticSettings.storageAccountResourceId

Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.

• Required: No
• Type: string

Parameter: diagnosticSettings.workspaceResourceId

Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.

• Required: No
• Type: string

Parameter: disableGateway

Property only valid for an API Management service deployed in multiple locations. This can be used to disable the gateway in master region.

• Required: No
• Type: bool
• Default: False

Parameter: enableClientCertificate

Property only meant to be used for Consumption SKU Service. This enforces a client certificate to be presented on each request to the gateway. This also enables the ability to authenticate the certificate in the policy on the gateway.

• Required: No
• Type: bool
• Default: False

Parameter: enableDeveloperPortal

Enable the Developer Portal. The developer portal is not supported on the Consumption SKU.

• Required: No
• Type: bool
• Default: False

Parameter: enableTelemetry

Enable/Disable usage telemetry for module.

• Required: No
• Type: bool
• Default: True

Parameter: hostnameConfigurations

Custom hostname configuration of the API Management service.

• Required: No
• Type: array

Parameter: identityProviders

Identity providers.

• Required: No
• Type: array

Required parameters

Conditional parameters

Optional parameters

Parameter: identityProviders.name

Identity provider name.

• Required: Yes
• Type: string

Parameter: identityProviders.clientId

Client ID of the Application in the external Identity Provider. Required if identity provider is used.

• Required: No
• Type: string

Parameter: identityProviders.clientSecret

Client secret of the Application in external Identity Provider, used to authenticate login request. Required if identity provider is used.

• Required: No
• Type: securestring

Parameter: identityProviders.allowedTenants

List of Allowed Tenants when configuring Azure Active Directory login. - string.

• Required: No
• Type: array

Parameter: identityProviders.authority

OpenID Connect discovery endpoint hostname for AAD or AAD B2C.

• Required: No
• Type: string

Parameter: identityProviders.clientLibrary

The client library to be used in the developer portal. Only applies to AAD and AAD B2C Identity Provider.

• Required: No
• Type: string
• Allowed:

  [
    'ADAL'
    'MSAL-2'
  ]
  

Parameter: identityProviders.passwordResetPolicyName

Password Reset Policy Name. Only applies to AAD B2C Identity Provider.

• Required: No
• Type: string

Parameter: identityProviders.profileEditingPolicyName

Profile Editing Policy Name. Only applies to AAD B2C Identity Provider.

• Required: No
• Type: string

Parameter: identityProviders.signInPolicyName

Signin Policy Name. Only applies to AAD B2C Identity Provider.

• Required: No
• Type: string

Parameter: identityProviders.signInTenant

The TenantId to use instead of Common when logging into Active Directory.

• Required: No
• Type: string

Parameter: identityProviders.signUpPolicyName

Signup Policy Name. Only applies to AAD B2C Identity Provider.

• Required: No
• Type: string

Parameter: identityProviders.type

Identity Provider Type identifier.

• Required: No
• Type: string
• Allowed:

  [
    'aad'
    'aadB2C'
    'facebook'
    'google'
    'microsoft'
    'twitter'
  ]
  

Parameter: location

Location for all Resources.

• Required: No
• Type: string
• Default: [resourceGroup().location]

Parameter: lock

The lock settings of the service.

• Required: No
• Type: object

Optional parameters

Parameter: lock.kind

Specify the type of lock.

• Required: No
• Type: string
• Allowed:

  [
    'CanNotDelete'
    'None'
    'ReadOnly'
  ]
  

Parameter: lock.name

Specify the name of lock.

• Required: No
• Type: string

Parameter: lock.notes

Specify the notes of the lock.

• Required: No
• Type: string

Parameter: loggers

Loggers.

• Required: No
• Type: array

Required parameters

Conditional parameters

Optional parameters

Parameter: loggers.name

Resource Name.

• Required: Yes
• Type: string

Parameter: loggers.type

Logger type.

• Required: Yes
• Type: string
• Allowed:

  [
    'applicationInsights'
    'azureEventHub'
    'azureMonitor'
  ]
  

Parameter: loggers.credentials

The name and SendRule connection string of the event hub for azureEventHub logger. Instrumentation key for applicationInsights logger. Required if loggerType = applicationInsights or azureEventHub.

• Required: No
• Type: secureObject

Parameter: loggers.targetResourceId

Azure Resource Id of a log target (either Azure Event Hub resource or Azure Application Insights resource). Required if loggerType = applicationInsights or azureEventHub.

• Required: No
• Type: string

Parameter: loggers.description

Logger description.

• Required: No
• Type: string

Parameter: loggers.isBuffered

Whether records are buffered in the logger before publishing.

• Required: No
• Type: bool

Parameter: managedIdentities

The managed identity definition for this resource.

• Required: No
• Type: object

Optional parameters

Parameter: managedIdentities.systemAssigned

Enables system assigned managed identity on the resource.

• Required: No
• Type: bool

Parameter: managedIdentities.userAssignedResourceIds

The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption.

• Required: No
• Type: array

Parameter: minApiVersion

Limit control plane API calls to API Management service with version equal to or newer than this value.

• Required: No
• Type: string

Parameter: namedValues

Named values.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: namedValues.displayName

Unique name of NamedValue. It may contain only letters, digits, period, dash, and underscore characters.

• Required: Yes
• Type: string

Parameter: namedValues.name

The name of the named value.

• Required: Yes
• Type: string

Parameter: namedValues.keyVault

KeyVault location details of the namedValue.

• Required: No
• Type: object

Parameter: namedValues.secret

Determines whether the value is a secret and should be encrypted or not. Default value is false.

• Required: No
• Type: bool

Parameter: namedValues.tags

Tags that when provided can be used to filter the NamedValue list. - string.

• Required: No
• Type: array

Parameter: namedValues.value

Value of the NamedValue. Can contain policy expressions. It may not be empty or consist only of whitespace. This property will not be filled on 'GET' operations! Use '/listSecrets' POST request to get the value.

• Required: No
• Type: securestring

Parameter: newGuidValue

Necessary to create a new GUID.

• Required: No
• Type: string
• Default: [newGuid()]

Parameter: notificationSenderEmail

The notification sender email address for the service.

• Required: No
• Type: string
• Default: 'apimgmt-noreply@mail.windowsazure.com'

Parameter: policies

Policies.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: policies.value

Contents of the Policy as defined by the format.

• Required: Yes
• Type: string

Parameter: policies.format

Format of the policyContent.

• Required: No
• Type: string
• Allowed:

  [
    'rawxml'
    'rawxml-link'
    'xml'
    'xml-link'
  ]
  

Parameter: policies.name

The name of the policy.

• Required: No
• Type: string

Parameter: portalsettings

Portal settings.

• Required: No
• Type: array
• Discriminator: name

The available variants are:

Variant: portalsettings.name-signin

The type for sign-in portal settings.

To use this variant, set the property name to signin.

Required parameters

Parameter: portalsettings.name-signin.name

The name of the portal-setting.

• Required: Yes
• Type: string
• Allowed:

  [
    'signin'
  ]
  

Parameter: portalsettings.name-signin.properties

The portal-settings contract properties.

• Required: Yes
• Type: object

Required parameters

Parameter: portalsettings.name-signin.properties.enabled

Redirect Anonymous users to the Sign-In page.

• Required: Yes
• Type: bool

Variant: portalsettings.name-signup

The type for sign-up portal settings.

To use this variant, set the property name to signup.

Required parameters

Parameter: portalsettings.name-signup.name

The name of the portal-setting.

• Required: Yes
• Type: string
• Allowed:

  [
    'signup'
  ]
  

Parameter: portalsettings.name-signup.properties

The portal-settings contract properties.

• Required: Yes
• Type: object

Optional parameters

Parameter: portalsettings.name-signup.properties.enabled

Allow users to sign up on a developer portal.

• Required: No
• Type: bool

Parameter: portalsettings.name-signup.properties.termsOfService

Terms of service contract properties.

• Required: No
• Type: object

Otional parameters

Parameter: portalsettings.name-signup.properties.termsOfService.consentRequired

Ask user for consent to the terms of service.

• Required: No
• Type: bool

Parameter: portalsettings.name-signup.properties.termsOfService.enabled

Display terms of service during a sign-up process.

• Required: No
• Type: bool

Parameter: portalsettings.name-signup.properties.termsOfService.text

A terms of service text.

• Required: No
• Type: string

Variant: portalsettings.name-delegation

The type for delegation portal settings.

To use this variant, set the property name to delegation.

Required parameters

Parameter: portalsettings.name-delegation.name

The name of the portal-setting.

• Required: Yes
• Type: string
• Allowed:

  [
    'delegation'
  ]
  

Parameter: portalsettings.name-delegation.properties

The portal-settings contract properties.

• Required: Yes
• Type: object

Optional parameters

Parameter: portalsettings.name-delegation.properties.subscriptions

Subscriptions delegation settings.

• Required: No
• Type: object

Required parameters

Parameter: portalsettings.name-delegation.properties.subscriptions.enabled

Enable or disable delegation for subscriptions.

• Required: Yes
• Type: bool

Parameter: portalsettings.name-delegation.properties.url

A delegation Url.

• Required: No
• Type: string

Parameter: portalsettings.name-delegation.properties.userRegistration

User registration delegation settings.

• Required: No
• Type: object

Required parameters

Parameter: portalsettings.name-delegation.properties.userRegistration.enabled

Enable or disable delegation for user registration.

• Required: Yes
• Type: bool

Parameter: portalsettings.name-delegation.properties.validationKey

A base64-encoded validation key to validate, that a request is coming from Azure API Management.

• Required: No
• Type: securestring

Parameter: privateEndpoints

Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: privateEndpoints.subnetResourceId

Resource ID of the subnet where the endpoint needs to be created.

• Required: Yes
• Type: string

Parameter: privateEndpoints.applicationSecurityGroupResourceIds

Application security groups in which the Private Endpoint IP configuration is included.

• Required: No
• Type: array

Parameter: privateEndpoints.customDnsConfigs

Custom DNS configurations.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: privateEndpoints.customDnsConfigs.ipAddresses

A list of private IP addresses of the private endpoint.

• Required: Yes
• Type: array

Parameter: privateEndpoints.customDnsConfigs.fqdn

FQDN that resolves to private endpoint IP address.

• Required: No
• Type: string

Parameter: privateEndpoints.customNetworkInterfaceName

The custom name of the network interface attached to the Private Endpoint.

• Required: No
• Type: string

Parameter: privateEndpoints.enableTelemetry

Enable/Disable usage telemetry for module.

• Required: No
• Type: bool

Parameter: privateEndpoints.ipConfigurations

A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints.

• Required: No
• Type: array

Required parameters

Parameter: privateEndpoints.ipConfigurations.name

The name of the resource that is unique within a resource group.

• Required: Yes
• Type: string

Parameter: privateEndpoints.ipConfigurations.properties

Properties of private endpoint IP configurations.

• Required: Yes
• Type: object

Required parameters

Parameter: privateEndpoints.ipConfigurations.properties.groupId

The ID of a group obtained from the remote resource that this private endpoint should connect to.

• Required: Yes
• Type: string

Parameter: privateEndpoints.ipConfigurations.properties.memberName

The member name of a group obtained from the remote resource that this private endpoint should connect to.

• Required: Yes
• Type: string

Parameter: privateEndpoints.ipConfigurations.properties.privateIPAddress

A private IP address obtained from the private endpoint's subnet.

• Required: Yes
• Type: string

Parameter: privateEndpoints.isManualConnection

If Manual Private Link Connection is required.

• Required: No
• Type: bool

Parameter: privateEndpoints.location

The location to deploy the Private Endpoint to.

• Required: No
• Type: string

Parameter: privateEndpoints.lock

Specify the type of lock.

• Required: No
• Type: object

Optional parameters

Parameter: privateEndpoints.lock.kind

Specify the type of lock.

• Required: No
• Type: string
• Allowed:

  [
    'CanNotDelete'
    'None'
    'ReadOnly'
  ]
  

Parameter: privateEndpoints.lock.name

Specify the name of lock.

• Required: No
• Type: string

Parameter: privateEndpoints.lock.notes

Specify the notes of the lock.

• Required: No
• Type: string

Parameter: privateEndpoints.manualConnectionRequestMessage

A message passed to the owner of the remote resource with the manual connection request.

• Required: No
• Type: string

Parameter: privateEndpoints.name

The name of the Private Endpoint.

• Required: No
• Type: string

Parameter: privateEndpoints.privateDnsZoneGroup

The private DNS Zone Group to configure for the Private Endpoint.

• Required: No
• Type: object

Required parameters

Optional parameters

Parameter: privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs

The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones.

• Required: Yes
• Type: array

Required parameters

Optional parameters

Parameter: privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId

The resource id of the private DNS zone.

• Required: Yes
• Type: string

Parameter: privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name

The name of the private DNS Zone Group config.

• Required: No
• Type: string

Parameter: privateEndpoints.privateDnsZoneGroup.name

The name of the Private DNS Zone Group.

• Required: No
• Type: string

Parameter: privateEndpoints.privateLinkServiceConnectionName

The name of the private link connection to create.

• Required: No
• Type: string

Parameter: privateEndpoints.resourceGroupResourceId

The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used.

• Required: No
• Type: string

Parameter: privateEndpoints.roleAssignments

Array of role assignments to create.

• Required: No
• Type: array
• Roles configurable by name:
  • 'Contributor'
  • 'DNS Resolver Contributor'
  • 'DNS Zone Contributor'
  • 'Domain Services Contributor'
  • 'Domain Services Reader'
  • 'Network Contributor'
  • 'Owner'
  • 'Private DNS Zone Contributor'
  • 'Reader'
  • 'Role Based Access Control Administrator'

Required parameters

Optional parameters

Parameter: privateEndpoints.roleAssignments.principalId

The principal ID of the principal (user/group/identity) to assign the role to.

• Required: Yes
• Type: string

Parameter: privateEndpoints.roleAssignments.roleDefinitionIdOrName

The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.

• Required: Yes
• Type: string

Parameter: privateEndpoints.roleAssignments.condition

The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".

• Required: No
• Type: string

Parameter: privateEndpoints.roleAssignments.conditionVersion

Version of the condition.

• Required: No
• Type: string
• Allowed:

  [
    '2.0'
  ]
  

Parameter: privateEndpoints.roleAssignments.delegatedManagedIdentityResourceId

The Resource Id of the delegated managed identity resource.

• Required: No
• Type: string

Parameter: privateEndpoints.roleAssignments.description

The description of the role assignment.

• Required: No
• Type: string

Parameter: privateEndpoints.roleAssignments.name

The name (as GUID) of the role assignment. If not provided, a GUID will be generated.

• Required: No
• Type: string

Parameter: privateEndpoints.roleAssignments.principalType

The principal type of the assigned principal ID.

• Required: No
• Type: string
• Allowed:

  [
    'Device'
    'ForeignGroup'
    'Group'
    'ServicePrincipal'
    'User'
  ]
  

Parameter: privateEndpoints.service

The subresource to deploy the Private Endpoint for. For example "vault" for a Key Vault Private Endpoint.

• Required: No
• Type: string

Parameter: privateEndpoints.tags

Tags to be applied on all resources/Resource Groups in this deployment.

• Required: No
• Type: object

Parameter: products

Products.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: products.displayName

API Management Service Products name. Must be 1 to 300 characters long.

• Required: Yes
• Type: string

Parameter: products.name

Product Name.

• Required: Yes
• Type: string

Parameter: products.apis

Names of Product APIs.

• Required: No
• Type: array

Parameter: products.approvalRequired

Whether subscription approval is required. If false, new subscriptions will be approved automatically enabling developers to call the products APIs immediately after subscribing. If true, administrators must manually approve the subscription before the developer can any of the products APIs. Can be present only if subscriptionRequired property is present and has a value of false.

• Required: No
• Type: bool

Parameter: products.description

Product description. May include HTML formatting tags.

• Required: No
• Type: string

Parameter: products.groups

Names of Product Groups.

• Required: No
• Type: array

Parameter: products.state

whether product is published or not. Published products are discoverable by users of developer portal. Non published products are visible only to administrators. Default state of Product is notPublished. - notPublished or published.

• Required: No
• Type: string

Parameter: products.subscriptionRequired

Whether a product subscription is required for accessing APIs included in this product. If true, the product is referred to as "protected" and a valid subscription key is required for a request to an API included in the product to succeed. If false, the product is referred to as "open" and requests to an API included in the product can be made without a subscription key. If property is omitted when creating a new product it's value is assumed to be true.

• Required: No
• Type: bool

Parameter: products.subscriptionsLimit

Whether the number of subscriptions a user can have to this product at the same time. Set to null or omit to allow unlimited per user subscriptions. Can be present only if subscriptionRequired property is present and has a value of false.

• Required: No
• Type: int

Parameter: products.terms

Product terms of use. Developers trying to subscribe to the product will be presented and required to accept these terms before they can complete the subscription process.

• Required: No
• Type: string

Parameter: publicIpAddressResourceId

Public Standard SKU IP V4 based IP address to be associated with Virtual Network deployed service in the region. Supported only for Developer and Premium SKU being deployed in Virtual Network.

• Required: No
• Type: string

Parameter: publicNetworkAccess

Whether or not public endpoint access is allowed for this API Management service. If set to 'Disabled', private endpoints are the exclusive access method. MUST be enabled during service creation.

• Required: No
• Type: string

Parameter: restore

Undelete API Management Service if it was previously soft-deleted. If this flag is specified and set to True all other properties will be ignored.

• Required: No
• Type: bool
• Default: False

Parameter: roleAssignments

Array of role assignments to create.

• Required: No
• Type: array
• Roles configurable by name:
  • 'API Management Developer Portal Content Editor'
  • 'API Management Service Contributor'
  • 'API Management Service Operator Role'
  • 'API Management Service Reader Role'
  • 'Contributor'
  • 'Owner'
  • 'Reader'
  • 'Role Based Access Control Administrator'
  • 'User Access Administrator'

Required parameters

Optional parameters

Parameter: roleAssignments.principalId

The principal ID of the principal (user/group/identity) to assign the role to.

• Required: Yes
• Type: string

Parameter: roleAssignments.roleDefinitionIdOrName

The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.

• Required: Yes
• Type: string

Parameter: roleAssignments.condition

The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".

• Required: No
• Type: string

Parameter: roleAssignments.conditionVersion

Version of the condition.

• Required: No
• Type: string
• Allowed:

  [
    '2.0'
  ]
  

Parameter: roleAssignments.delegatedManagedIdentityResourceId

The Resource Id of the delegated managed identity resource.

• Required: No
• Type: string

Parameter: roleAssignments.description

The description of the role assignment.

• Required: No
• Type: string

Parameter: roleAssignments.name

The name (as GUID) of the role assignment. If not provided, a GUID will be generated.

• Required: No
• Type: string

Parameter: roleAssignments.principalType

The principal type of the assigned principal ID.

• Required: No
• Type: string
• Allowed:

  [
    'Device'
    'ForeignGroup'
    'Group'
    'ServicePrincipal'
    'User'
  ]
  

Parameter: sku

The pricing tier of this API Management service.

• Required: No
• Type: string
• Default: 'Premium'
• Allowed:

  [
    'Basic'
    'BasicV2'
    'Consumption'
    'Developer'
    'Premium'
    'Standard'
    'StandardV2'
  ]
  

Parameter: subnetResourceId

The full resource ID of a subnet in a virtual network to deploy the API Management service in.

• Required: No
• Type: string

Parameter: subscriptions

Subscriptions.

• Required: No
• Type: array

Required parameters

Optional parameters

Parameter: subscriptions.displayName

API Management Service Subscriptions name. Must be 1 to 100 characters long.

• Required: Yes
• Type: string

Parameter: subscriptions.name

Subscription name.

• Required: Yes
• Type: string

Parameter: subscriptions.allowTracing

Determines whether tracing can be enabled.

• Required: No
• Type: bool

Parameter: subscriptions.ownerId

User (user ID path) for whom subscription is being created in form /users/{userId}.

• Required: No
• Type: string

Parameter: subscriptions.primaryKey

Primary subscription key. If not specified during request key will be generated automatically.

• Required: No
• Type: string

Parameter: subscriptions.scope

Scope type to choose between a product, "allAPIs" or a specific API. Scope like "/products/{productId}" or "/apis" or "/apis/{apiId}".

• Required: No
• Type: string

Parameter: subscriptions.secondaryKey

Secondary subscription key. If not specified during request key will be generated automatically.

• Required: No
• Type: string

Parameter: subscriptions.state

Initial subscription state. If no value is specified, subscription is created with Submitted state. Possible states are "" active "?" the subscription is active, "" suspended "?" the subscription is blocked, and the subscriber cannot call any APIs of the product, * submitted ? the subscription request has been made by the developer, but has not yet been approved or rejected, * rejected ? the subscription request has been denied by an administrator, * cancelled ? the subscription has been cancelled by the developer or administrator, * expired ? the subscription reached its expiration date and was deactivated. - suspended, active, expired, submitted, rejected, cancelled.

• Required: No
• Type: string

Parameter: tags

Tags of the resource.

• Required: No
• Type: object

Parameter: virtualNetworkType

The type of VPN in which API Management service needs to be configured in. None (Default Value) means the API Management service is not part of any Virtual Network, External means the API Management deployment is set up inside a Virtual Network having an internet Facing Endpoint, and Internal means that API Management deployment is setup inside a Virtual Network having an Intranet Facing Endpoint only.

• Required: No
• Type: string
• Default: 'None'
• Allowed:

  [
    'External'
    'Internal'
    'None'
  ]
  

Outputs

Cross-referenced modules

This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).

Notes

The latest version of this module only includes supported versions of the API Management resource. All unsupported versions of API Management have been removed from the related parameters. See the API Management stv1 platform retirement article for more details.

Parameter Usage: apiManagementServicePolicy

"apiManagementServicePolicy": {
    "value": {
        "value":"<policies> <inbound> <rate-limit-by-key calls='250' renewal-period='60' counter-key='@(context.Request.IpAddress)' /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>",
        "format":"xml"
    }
}

apiManagementServicePolicy: {
    value:'<policies> <inbound> <rate-limit-by-key calls=\'250\' renewal-period='60' counter-key=\'@(context.Request.IpAddress)\' /> </inbound> <backend> <forward-request /> </backend> <outbound> </outbound> </policies>'
    format:'xml'
}

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.