You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Members of a workspace in Azure API Management can collaborate to manage and productize their own APIs.
4
+
author: dlepow
5
+
ms.topic: how-to
6
+
ms.service: api-management
7
+
ms.author: danlep
8
+
ms.date: 03/10/2023
9
+
ms.custom:
10
+
---
11
+
12
+
# Manage APIs and other resources in your API Management workspace
13
+
14
+
This article is an introduction to managing APIs, products, subscriptions, and other API Management resources in a *workspace*. A workspace is a place where a development team can own, manage, update, and productize their own APIs, while a central API platform team manages the API Management infrastructure. Learn about the [workspace features](workspaces-overview.md)
> * Workspaces are a preview feature of API Management and subject to certain [limitations](workspaces-overview.md#preview-limitations).
20
+
> * This feature is being released during March and April 2023.
21
+
> * Workspaces are supported in API Management REST API version 2022-09-01-preview or later.
22
+
> * For pricing considerations, see [API Management pricing](https://azure.microsoft.com/pricing/details/api-management/).
23
+
24
+
## Prerequisites
25
+
26
+
* An API Management instance. If needed, ask an administrator to [create one](get-started-create-service-instance.md).
27
+
* A workspace. If needed, ask an administrator of your API Management instance to [create one](how-to-create-workspace.md).
28
+
* Permissions to collaborate in the workspace. If needed, ask a workspace owner to assign you appropriate [roles](api-management-role-based-access-control.md#built-in-workspace-roles) in the workspace.
29
+
30
+
## Go to the workspace - portal
31
+
32
+
1. Sign in to the [Azure portal](https://portal.azure.com), and navigate to your API Management instance.
33
+
34
+
1. In the left menu, select **Workspaces** (preview), and select the name of your workspace.
35
+
36
+
:::image type="content" source="media/api-management-in-workspace/workspace-in-portal.png" alt-text="Screenshot of workspaces in API Management instance in the portal." lightbox="media/api-management-in-workspace/workspace-in-portal-expanded.png":::
37
+
38
+
1. The workspace appears. The available resources and settings appear in the menu on the left.
39
+
40
+
:::image type="content" source="media/api-management-in-workspace/workspace-menu.png" alt-text="Screenshot of API Management workspace menu in the portal." lightbox="media/api-management-in-workspace/workspace-menu-expanded.png":::
41
+
42
+
43
+
## Get started with your workspace
44
+
45
+
Depending on your role in the workspace, you might have permissions to create APIs, products, subscriptions, and other resources, or you might have read-only access to some or all of them.
46
+
47
+
To get started managing, protecting, and publishing APIs in your workspaces, see the following guidance.
48
+
49
+
50
+
51
+
|Resource |Guide |
52
+
|---------|---------|
53
+
|APIs |[Tutorial: Import and publish your first API](import-and-publish.md)|
54
+
|Products |[Tutorial: Create and publish a product](api-management-howto-add-products.md)|
55
+
|Subscriptions |[Subscriptions in Azure API Management](api-management-subscriptions.md)<br/><br/>[Create subscriptions in API Management](api-management-howto-create-subscriptions.md)|
56
+
|Policies |[Tutorial: Transform and protect your API](transform-api.md)<br/><br/>[Policies in Azure API Management](api-management-howto-policies.md)<br/><br/>[Set or edit API Management policies](set-edit-policies.md)|
57
+
|Named values |[Manage secrets using named values](api-management-howto-properties.md)|
58
+
|Policy fragments |[Reuse policy configurations in your API Management policy definitions](policy-fragments.md)|
|`context`|[`Api`](#ref-context-api): [`IApi`](#ref-iapi)<br /><br /> [`Deployment`](#ref-context-deployment)<br /><br /> Elapsed: `TimeSpan` - time interval between the value of `Timestamp` and current time<br /><br /> [`LastError`](#ref-context-lasterror)<br /><br /> [`Operation`](#ref-context-operation)<br /><br /> [`Product`](#ref-context-product)<br /><br /> [`Request`](#ref-context-request)<br /><br /> `RequestId`: `Guid` - unique request identifier<br /><br /> [`Response`](#ref-context-response)<br /><br /> [`Subscription`](#ref-context-subscription)<br /><br /> `Timestamp`: `DateTime` - point in time when request was received<br /><br /> `Tracing`: `bool` - indicates if tracing is on or off <br /><br /> [User](#ref-context-user)<br /><br /> [`Variables`](#ref-context-variables): `IReadOnlyDictionary<string, object>`<br /><br /> `void Trace(message: string)`|
@@ -217,9 +217,10 @@ The `context` variable is implicitly available in every policy [expression](api-
217
217
|<a id="ref-imessagebody"></a>`IMessageBody`|`As<T>(bool preserveContent = false): Where T: string, byte[], JObject, JToken, JArray, XNode, XElement, XDocument` <br /><br /> - The `context.Request.Body.As<T>` and `context.Response.Body.As<T>` methods read a request or response message body in specified type `T`. <br/><br/> - Or - <br/><br/>`AsFormUrlEncodedContent(bool preserveContent = false)` <br/></br>- The `context.Request.Body.AsFormUrlEncodedContent()` and `context.Response.Body.AsFormUrlEncodedContent()` methods read URL-encoded form data in a request or response message body and return an `IDictionary<string, IList<string>` object. The decoded object supports `IDictionary` operations and the following expressions: `ToQueryString()`, `JsonConvert.SerializeObject()`, `ToFormUrlEncodedContent().` <br/><br/> By default, the `As<T>` and `AsFormUrlEncodedContent()` methods:<br /><ul><li>Use the original message body stream.</li><li>Render it unavailable after it returns.</li></ul> <br />To avoid that and have the method operate on a copy of the body stream, set the `preserveContent` parameter to `true`, as shown in examples for the [set-body](set-body-policy.md#examples) policy.|
218
218
|<aid="ref-iprivateendpointconnection"></a>`IPrivateEndpointConnection`|`Name`: `string`<br /><br /> `GroupId`: `string`<br /><br /> `MemberName`: `string`<br /><br />For more information, see the [REST API](/rest/api/apimanagement/current-ga/private-endpoint-connection/list-private-link-resources).|
|<aid="ref-context-variables"></a>`T context.Variables.GetValueOrDefault<T>(variableName: string, defaultValue: T)`|`variableName`: `string`<br /><br /> `defaultValue`: `T`<br /><br /> Returns variable value cast to type `T` or `defaultValue` if the variable isn't found.<br /><br /> This method throws an exception if the specified type doesn't match the actual type of the returned variable.|
224
225
|`BasicAuthCredentials AsBasic(input: this string)`|`input`: `string`<br /><br /> If the input parameter contains a valid HTTP Basic Authentication authorization request header value, the method returns an object of type `BasicAuthCredentials`; otherwise the method returns null.|
225
226
|`bool TryParseBasic(input: this string, result: out BasicAuthCredentials)`|`input`: `string`<br /><br /> `result`: `out BasicAuthCredentials`<br /><br /> If the input parameter contains a valid HTTP Basic Authentication authorization value in the request header, the method returns `true` and the result parameter contains a value of type `BasicAuthCredentials`; otherwise the method returns `false`.|
Copy file name to clipboardExpand all lines: articles/api-management/api-management-role-based-access-control.md
+23-9Lines changed: 23 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,26 +4,21 @@ description: Learn how to use the built-in roles and create custom roles in Azur
4
4
services: api-management
5
5
documentationcenter: ''
6
6
author: dlepow
7
-
manager: erikre
8
-
editor: ''
9
7
10
-
ms.assetid: 364cd53e-88fb-4301-a093-f132fa1f88f5
11
8
ms.service: api-management
12
-
ms.workload: mobile
13
-
ms.tgt_pltfrm: na
14
9
ms.topic: article
15
-
ms.date: 05/18/2021
10
+
ms.date: 02/15/2023
16
11
ms.author: danlep
17
12
ms.custom: devx-track-azurepowershell
18
13
19
14
---
20
-
# How to use Role-Based Access Control in Azure API Management
15
+
# How to use role-based access control in Azure API Management
21
16
22
17
Azure API Management relies on Azure role-based access control (Azure RBAC) to enable fine-grained access management for API Management services and entities (for example, APIs and policies). This article gives you an overview of the built-in and custom roles in API Management. For more information on access management in the Azure portal, see [Get started with access management in the Azure portal](../role-based-access-control/overview.md).
API Management currently provides three built-in roles and will add two more roles in the near future. These roles can be assigned at different scopes, including subscription, resource group, and individual API Management instance. For instance, if you assign the "API Management Service Reader" role to a user at the resource-group level, then the user has read access to all API Management instances inside the resource group.
29
24
@@ -39,6 +34,25 @@ The following table provides brief descriptions of the built-in roles. You can a
39
34
40
35
<sup>[2] Write access to API Management services and entities except the following operations: instance creation, deletion, and scaling; VPN configuration; and custom domain setup.</sup>
41
36
37
+
38
+
## Built-in workspace roles
39
+
40
+
API Management provides the following built-in roles for collaborators in [workspaces](workspaces-overview.md) in an API Management instance.
41
+
42
+
A workspace collaborator must be assigned both a workspace-scoped role and a service-scoped role.
43
+
44
+
45
+
|Role |Scope |Description |
46
+
|---------|---------|---------|
47
+
|API Management Workspace Owner | workspace | Can modify workspace details, manage members and their role assignments; has read and write access to all entities within the workspace. This role should be assigned on the workspace scope. |
48
+
|API Management Workspace Contributor | workspace | Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope. |
49
+
|API Management Workspace Reader | workspace | Has read-only access to entities in the workspace. This role should be assigned on the workspace scope. |
50
+
|API Management Workspace API Developer | workspace | Has read access to entities in the workspace and read and write access to entities for editing APIs. This role should be assigned on the workspace scope. |
51
+
|API Management Workspace API Product Manager | workspace | Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope. |
52
+
| API Management Workspace API Developer | service | Has read access to tags and products and write access to allow: <br/><br/> ▪️ Assigning APIs to products<br/> ▪️ Assigning tags to products and APIs<br/><br/> This role should be assigned on the service scope. |
53
+
| API Management Service Workspace API Product Manager | service | Has the same access as API Management Service Workspace API Developer as well as read access to users and write access to allow assigning users to groups. This role should be assigned on the service scope. |
54
+
55
+
42
56
## Custom roles
43
57
44
58
If none of the built-in roles meet your specific needs, custom roles can be created to provide more granular access management for API Management entities. For example, you can create a custom role that has read-only access to an API Management service, but only has write access to one specific API. To learn more about custom roles, see [Custom roles in Azure RBAC](../role-based-access-control/custom-roles.md).
0 commit comments