Skip to content

Commit 6d9ac7f

Browse files
author
gitName
committed
[APIC] APIM synchronization
1 parent 8ced1ca commit 6d9ac7f

File tree

6 files changed

+283
-29
lines changed

6 files changed

+283
-29
lines changed

‎articles/api-center/import-api-management-apis.md

Lines changed: 10 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ az apim api export --api-id my-api --resource-group myResourceGroup \
5858
```
5959

6060
```azurecli
61-
#! PowerShell syntax
61+
# Formatted for PowerShell
6262
az apim api export --api-id my-api --resource-group myResourceGroup `
6363
--service-name myAPIManagement --export-format OpenApiJsonFile `
6464
--file-path '/path/to/folder'
@@ -76,7 +76,7 @@ link=$(az apim api export --api-id my-api --resource-group myResourceGroup \
7676
```
7777

7878
```azurecli
79-
# PowerShell syntax
79+
# Formatted for PowerShell
8080
$link=$(az apim api export --api-id my-api --resource-group myResourceGroup `
8181
--service-name myAPIManagement --export-format OpenApiJsonUrl --query properties.value.link `
8282
--output tsv)
@@ -107,7 +107,7 @@ az apic api definition import-specification \
107107
```
108108

109109
```azurecli
110-
# PowerShell syntax
110+
# Formatted for PowerShell
111111
az apic api definition import-specification `
112112
--resource-group myResourceGroup --service-name myAPICenter `
113113
--api-id my-api --version-id v1-0-0 `
@@ -128,29 +128,11 @@ When you add APIs from an API Management instance to your API center using `az a
128128

129129
### Add a managed identity in your API center
130130

131-
For this scenario, your API center uses a [managed identity](/entra/identity/managed-identities-azure-resources/overview) to access APIs in your API Management instance. Depending on your needs, configure either a system-assigned or one or more user-assigned managed identities.
132-
133-
The following examples show how to configure a system-assigned managed identity by using the Azure portal or the Azure CLI. At a high level, configuration steps are similar for a user-assigned managed identity.
134-
135-
#### [Portal](#tab/portal)
136-
137-
1. In the [portal](https://azure.microsoft.com), navigate to your API center.
138-
1. In the left menu, under **Security**, select **Managed identities**.
139-
1. Select **System assigned**, and set the status to **On**.
140-
1. Select **Save**.
141-
142-
#### [Azure CLI](#tab/cli)
143-
144-
Set the system-assigned identity in your API center using the following [az apic update](/cli/azure/apic#az-apic-update) command. Substitute the names of your API center and resource group:
145-
146-
```azurecli
147-
az apic update --name <api-center-name> --resource-group <resource-group-name> --identity '{"type": "SystemAssigned"}'
148-
```
149-
---
131+
[!INCLUDE [enable-managed-identity](includes/enable-managed-identity.md)]
150132

151133
### Assign the managed identity the API Management Service Reader role
152134

153-
To allow import of APIs, assign your API center's managed identity the **API Management Service Reader** role in your API Management instance. You can use the [portal](../role-based-access-control/role-assignments-portal-managed-identity.yml) or the Azure CLI.
135+
[!INCLUDE [configure-managed-identity-apim-reader](includes/configure-managed-identity-apim-reader.md)]
154136

155137
#### [Portal](#tab/portal)
156138

@@ -175,7 +157,7 @@ To allow import of APIs, assign your API center's managed identity the **API Man
175157
```
176158
177159
```azurecli
178-
# PowerShell syntax
160+
# Formatted for PowerShell
179161
$apicObjID=$(az apic show --name <api-center-name> `
180162
--resource-group <resource-group-name> `
181163
--query "identity.principalId" --output tsv)
@@ -189,7 +171,7 @@ To allow import of APIs, assign your API center's managed identity the **API Man
189171
```
190172
191173
```azurecli
192-
# PowerShell syntax
174+
# Formatted for PowerShell
193175
$apimID=$(az apim show --name <apim-name> --resource-group <resource-group-name> --query "id" --output tsv)
194176
```
195177
@@ -207,7 +189,7 @@ To allow import of APIs, assign your API center's managed identity the **API Man
207189
```
208190
209191
```azurecli
210-
#! PowerShell syntax
192+
# Formatted for PowerShell
211193
$scope=$apimID.substring(1)
212194
213195
az role assignment create `
@@ -238,7 +220,7 @@ az apic import-from-apim --service-name <api-center-name> --resource-group <reso
238220
```
239221

240222
```azurecli
241-
# PowerShell syntax
223+
# Formatted for PowerShell
242224
az apic import-from-apim --service-name <api-center-name> --resource-group <resource-group-name> `
243225
--apim-name <api-management-name> --apim-resource-group <api-management-resource-group-name> `
244226
--apim-apis '*'
@@ -262,7 +244,7 @@ az apic import-from-apim --service-name <api-center-name> --resource-group <reso
262244

263245

264246
```azurecli
265-
# PowerShell syntax
247+
# Formatted for PowerShell
266248
az apic import-from-apim --service-name <api-center-name> --resource-group <resource-group-name> `
267249
--apim-name <api-management-name> --apim-resource-group <api-management-resource-group-name> `
268250
--apim-apis 'petstore-api'

‎articles/api-center/includes/api-center-service-limits.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ author: dlepow
77

88
ms.service: azure-api-center
99
ms.topic: include
10-
ms.date: 05/14/2024
10+
ms.date: 10/18/2024
1111
ms.author: danlep
1212
ms.custom: Include file
1313
---
@@ -24,7 +24,10 @@ ms.custom: Include file
2424
| Maximum number of child properties in custom metadata property of type "object" | 10 |10 |
2525
| Maximum requests per minute (data plane) | 3,000 | 6,000 |
2626
| Maximum number of API definitions [linted](../enable-managed-api-analysis-linting.md) per 4 hours | 10 | 100 |
27+
| Maximum number of linked API sources<sup>4</sup> | 1 | 3 |
28+
| Maximum number of API [synchronizations](../synchronize-api-management-apis.md)<sup>4</sup> per 4 hours | 1 | 10 |
2729

2830
<sup>1</sup> To increase a limit in the Standard plan, contact [support](https://azure.microsoft.com/support/options/).<br/>
2931
<sup>2</sup> In the Free plan, use of full service features including API analysis and access through the data plane API is limited to 5 APIs.<br/>
3032
<sup>3</sup> Custom metadata properties assigned to APIs, deployments, and environments.
33+
<sup>4</sup> API sources include API Management instances linked to the API center for synchronization.

‎articles/api-center/includes/configure-managed-identity-apim-reader.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
title: Include file
3+
description: Include file
4+
services: api-center
5+
author: dlepow
6+
7+
ms.service: azure-api-center
8+
ms.topic: include
9+
ms.date: 10/18/2024
10+
ms.author: danlep
11+
ms.custom: Include file
12+
---
13+
14+
To allow import of APIs, assign your API center's managed identity the **API Management Service Reader** role in your API Management instance. You can use the [portal](../role-based-access-control/role-assignments-portal-managed-identity.yml) or the Azure CLI.
15+
16+
#### [Portal](#tab/portal)
17+
18+
1. In the [portal](https://azure.microsoft.com), navigate to your API Management instance.
19+
1. In the left menu, select **Access control (IAM)**.
20+
1. Select **+ Add role assignment**.
21+
1. On the **Add role assignment** page, set the values as follows:
22+
1. On the **Role** tab - Select **API Management Service Reader**.
23+
1. On the **Members** tab, in **Assign access to** - Select **Managed identity** > **+ Select members**.
24+
1. On the **Select managed identities** page - Select the system-assigned managed identity of your API center that you added in the previous section. Click **Select**.
25+
1. Select **Review + assign**.
26+
27+
#### [Azure CLI](#tab/cli)
28+
29+
1. Get the principal ID of the identity. For a system-assigned identity, use the [az apic show](/cli/azure/apic#az-apic-show) command.
30+
31+
```azurecli
32+
#! /bin/bash
33+
apicObjID=$(az apic show --name <api-center-name> \
34+
--resource-group <resource-group-name> \
35+
--query "identity.principalId" --output tsv)
36+
```
37+
38+
```azurecli
39+
# Formatted for PowerShell
40+
$apicObjID=$(az apic show --name <api-center-name> `
41+
--resource-group <resource-group-name> `
42+
--query "identity.principalId" --output tsv)
43+
```
44+
45+
1. Get the resource ID of your API Management instance using the [az apim show](/cli/azure/apim#az-apim-show) command.
46+
47+
```azurecli
48+
#! /bin/bash
49+
apimID=$(az apim show --name <apim-name> --resource-group <resource-group-name> --query "id" --output tsv)
50+
```
51+
52+
```azurecli
53+
# Formatted for PowerShell
54+
$apimID=$(az apim show --name <apim-name> --resource-group <resource-group-name> --query "id" --output tsv)
55+
```
56+
57+
1. Assign the managed identity the **API Management Service Reader** role in your API Management instance using the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command.
58+
59+
```azurecli
60+
#! /bin/bash
61+
scope="${apimID:1}"
62+
63+
az role assignment create \
64+
--role "API Management Service Reader Role" \
65+
--assignee-object-id $apicObjID \
66+
--assignee-principal-type ServicePrincipal \
67+
--scope $scope
68+
```
69+
70+
```azurecli
71+
# Formatted for PowerShell
72+
$scope=$apimID.substring(1)
73+
74+
az role assignment create `
75+
--role "API Management Service Reader Role" `
76+
--assignee-object-id $apicObjID `
77+
--assignee-principal-type ServicePrincipal `
78+
--scope $scope
79+
---

‎articles/api-center/includes/enable-managed-identity.md

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
title: Include file
3+
description: Include file
4+
services: api-center
5+
author: dlepow
6+
7+
ms.service: azure-api-center
8+
ms.topic: include
9+
ms.date: 10/18/2024
10+
ms.author: danlep
11+
ms.custom: Include file
12+
---
13+
14+
For this scenario, your API center uses a [managed identity](/entra/identity/managed-identities-azure-resources/overview) to access APIs in your API Management instance. Depending on your needs, configure either a system-assigned or one or more user-assigned managed identities.
15+
16+
The following examples show how to configure a system-assigned managed identity by using the Azure portal or the Azure CLI. At a high level, configuration steps are similar for a user-assigned managed identity.
17+
18+
#### [Portal](#tab/portal)
19+
20+
1. In the [portal](https://azure.microsoft.com), navigate to your API center.
21+
1. In the left menu, under **Security**, select **Managed identities**.
22+
1. Select **System assigned**, and set the status to **On**.
23+
1. Select **Save**.
24+
25+
#### [Azure CLI](#tab/cli)
26+
27+
Set the system-assigned identity in your API center using the following [az apic update](/cli/azure/apic#az-apic-update) command. Substitute the names of your API center and resource group:
28+
29+
```azurecli
30+
az apic update --name <api-center-name> --resource-group <resource-group-name> --identity '{"type": "SystemAssigned"}'
31+
```
32+
---
33+
34+
### Assign the managed identity the API Management Service Reader role
35+
36+
To allow import of APIs, assign your API center's managed identity the **API Management Service Reader** role in your API Management instance. You can use the [portal](../role-based-access-control/role-assignments-portal-managed-identity.yml) or the Azure CLI.
37+
38+
#### [Portal](#tab/portal)
39+
40+
1. In the [portal](https://azure.microsoft.com), navigate to your API Management instance.
41+
1. In the left menu, select **Access control (IAM)**.
42+
1. Select **+ Add role assignment**.
43+
1. On the **Add role assignment** page, set the values as follows:
44+
1. On the **Role** tab - Select **API Management Service Reader**.
45+
1. On the **Members** tab, in **Assign access to** - Select **Managed identity** > **+ Select members**.
46+
1. On the **Select managed identities** page - Select the system-assigned managed identity of your API center that you added in the previous section. Click **Select**.
47+
1. Select **Review + assign**.
48+
49+
#### [Azure CLI](#tab/cli)
50+
51+
1. Get the principal ID of the identity. For a system-assigned identity, use the [az apic show](/cli/azure/apic#az-apic-show) command.
52+
53+
```azurecli
54+
#! /bin/bash
55+
apicObjID=$(az apic show --name <api-center-name> \
56+
--resource-group <resource-group-name> \
57+
--query "identity.principalId" --output tsv)
58+
```
59+
60+
```azurecli
61+
# Formatted for PowerShell
62+
$apicObjID=$(az apic show --name <api-center-name> `
63+
--resource-group <resource-group-name> `
64+
--query "identity.principalId" --output tsv)
65+
```
66+
67+
1. Get the resource ID of your API Management instance using the [az apim show](/cli/azure/apim#az-apim-show) command.
68+
69+
```azurecli
70+
#! /bin/bash
71+
apimID=$(az apim show --name <apim-name> --resource-group <resource-group-name> --query "id" --output tsv)
72+
```
73+
74+
```azurecli
75+
# Formatted for PowerShell
76+
$apimID=$(az apim show --name <apim-name> --resource-group <resource-group-name> --query "id" --output tsv)
77+
```
78+
79+
1. Assign the managed identity the **API Management Service Reader** role in your API Management instance using the [az role assignment create](/cli/azure/role/assignment#az-role-assignment-create) command.
80+
81+
```azurecli
82+
#! /bin/bash
83+
scope="${apimID:1}"
84+
85+
az role assignment create \
86+
--role "API Management Service Reader Role" \
87+
--assignee-object-id $apicObjID \
88+
--assignee-principal-type ServicePrincipal \
89+
--scope $scope
90+
```
91+
92+
```azurecli
93+
# Formatted for PowerShell
94+
$scope=$apimID.substring(1)
95+
96+
az role assignment create `
97+
--role "API Management Service Reader Role" `
98+
--assignee-object-id $apicObjID `
99+
--assignee-principal-type ServicePrincipal `
100+
--scope $scope
101+
---

‎articles/api-center/media/synchronize-api-management-apis/environment-link-list.png

52 KB
Loading

‎articles/api-center/synchronize-api-management-apis.md

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
title: Synchronize APIs from Azure API Management to Azure API Center
3+
description: Link an API Management instance to Azure API Center and automatically synchronize APIs from API Management to inventory.
4+
author: dlepow
5+
ms.service: azure-api-center
6+
ms.topic: how-to
7+
ms.date: 10/18/2024
8+
ms.author: danlep
9+
ms.custom: devx-track-azurecli
10+
# Customer intent: As an API program manager, I want to link my Azure API Management instance to my API center and synchronize API Management APIs to my inventory.
11+
---
12+
13+
# Link an API Management instance to your API center and synchronize APIs
14+
15+
This article shows how to create a link (preview) to an API Management instance in your [API center](overview.md) using the Azure portal.
16+
17+
Linking an API Management instance automates the regular synchronization of APIs from API Management to your API center inventory. This makes the API Management APIs easily discoverable and accessible to developers, API program managers, and other stakeholders.
18+
19+
## About linking an API Management instance
20+
21+
While you can export APIs from Azure API Management and [import](import-api-management-apis.md) them to Azure API Center using the Azure CLI as a one-time operation, linking an API Management instance ensures regular, automatic synchronization.
22+
23+
When you link an API Management instance to an API center, the following happens:
24+
25+
* All APIs and related API specifications from the API Management instance are imported to the API center inventory.
26+
* An [environment](key-concepts.md#environment) is created in the API center.
27+
28+
API Management APIs automatically synchronize to the API center whenever there are changes detected to existing API properties, new versions are added, new APIs are created, or APIs are deleted. This synchronization is one-way from API Management to your Azure API center, meaning API updates in the API center are not synchronized back to the API Management instance.
29+
30+
> [!NOTE]
31+
> * Certain properties of API Management APIs such as the name, description, and API definition can't be edited in the API center.
32+
> * Links to API Management instances are subject to [certain limits](../azure-resource-manager/management/azure-subscription-service-limits.md?toc=/azure/api-center/toc.json&bc=/azure/api-center/breadcrumb/toc.json#api-center-limits) on number of links and frequency of synchronization.
33+
34+
35+
## Prerequisites
36+
37+
* An API center in your Azure subscription. If you haven't created one, see [Quickstart: Create your API center](set-up-api-center.md).
38+
39+
* One or more instances of Azure API Management, in the same or a different subscription. The resources must be in the same directory.
40+
41+
* One or more APIs managed in your API Management instance that you want to synchronize to your API center.
42+
43+
* For Azure CLI:
44+
[!INCLUDE [include](~/reusable-content/azure-cli/azure-cli-prepare-your-environment-no-header.md)]
45+
46+
[!INCLUDE [install-apic-extension](includes/install-apic-extension.md)]
47+
48+
> [!NOTE]
49+
> Azure CLI command examples in this article can run in PowerShell or a bash shell. Where needed because of different variable syntax, separate command examples are provided for the two shells.
50+
51+
52+
## Add a managed identity in your API center
53+
54+
[!INCLUDE [enable-managed-identity](includes/enable-managed-identity.md)]
55+
56+
## Assign the managed identity the API Management Service Reader role
57+
58+
[!INCLUDE [configure-managed-identity-apim-reader](includes/configure-managed-identity-apim-reader.md)]
59+
60+
## Link an API Management instance
61+
62+
You can create a link to an API Management in the portal.
63+
64+
1. In the [portal](https://portal.azure.com), navigate to your API center.
65+
1. Under **Assets**, select **Environments**.
66+
1. Select **Links (preview)** > **+ Create a link**.
67+
68+
A link is added in the list of links. The API Management APIs are imported to the API center inventory and an environment is created.
69+
70+
:::image type="content" source="media/synchronize-api-management-apis/environment-link-list.png" alt-text="Screenshot of link to API Management in the portal.":::
71+
72+
## Unlink an API Management instance
73+
74+
You can delete a link to an API Management instance. When you unlink an API Management instance from your API center:
75+
76+
* All the APIs in the inventory from API Management are deleted
77+
* The environment associated with the API Management instance is deleted
78+
79+
To delete a link:
80+
81+
1. In the [portal](https://portal.azure.com), navigate to your API center.
82+
1. Under **Assets**, select **Environments** > **Links (preview)**.
83+
1. Select the link, and then select **Delete** (trash can icon).
84+
85+
## Related content
86+
87+
* [Manage API inventory with Azure CLI commands](manage-apis-azure-cli.md)
88+
* [Import APIs from API Management to your Azure API center](import-api-management-apis.md)
89+
* [Azure API Management documentation](../api-management/index.yml)

0 commit comments

Comments
 (0)