The Kladde protects its API itself: sign-in with Entra ID (lesson 2.6.2), permissions per endpoint (2.6.3), a rate limit for booking (2.6.6). For an API with many foreign callers, a layer in front is added, an API gateway. It accepts all requests, checks and limits them, and only what gets through reaches the Kladde. In Azure that is Azure API Management (APIM). This lesson is an exercise: you put the contacts API behind API Management once, see what the gateway can do, and tear it down again afterward. The Kladde itself doesn't need it today.

What a gateway takes over

API Management consists of three parts:

  • The gateway accepts the requests. It has an address of its own, say https://kladde-apim.azure-api.net/kladde/api/contacts, and forwards to the actual API, the backend, here the Kladde in Container Apps from lesson 2.9.5.
  • The management plane in the Azure portal and through the Azure CLI: APIs, products, subscriptions, policies.
  • The developer portal: a website where callers read the APIs, register and fetch their keys. It is built from the imported OpenAPI documents.

Then there are the terms with which API Management manages callers:

  • A product bundles one or more APIs, say “Kladde for partners”. Callers subscribe to products, not to single APIs.
  • A subscription gives a caller a subscription key, which it sends along in the header Ocp-Apim-Subscription-Key. The key says who is calling, not whether they may; for permissions, sign-in remains.
  • Policies are small XML programs that the gateway runs on every request and response: check tokens, limit, set or remove headers, cache responses.

What of this does the Kladde already do itself? Sign-in and rate limiting. The gateway doesn't replace that, it comes in front: the Kladde keeps checking every token and every permission, because whoever bypasses the gateway and talks to the container app directly must gain nothing. What the gateway adds are subscriptions per caller, limits per subscription, a portal for strangers and one place where many APIs are treated alike.