api-management-policy-reference.md

title	description	services	documentationcenter	author	manager	editor	ms.assetid	ms.service	ms.workload	ms.tgt_pltfrm	ms.devlang	ms.topic	ms.date	ms.author
Azure API Management Policy Reference	Learn about the policies available to configure API Management.	api-management		vladvino	erikre		9d4ac609-b221-4032-93ae-e27a1254d43d	api-management	mobile	na	na	article	12/15/2016	apipm

Azure API Management Policy Reference

This section provides an index for the policies in the API Management policy reference. For information on adding and configuring policies, see Policies in API Management.

Policy expressions can be used as attribute values or text values in any of the API Management policies, unless the policy specifies otherwise. Some policies such as the Control flow and Set variable policies are based on policy expressions. For more information, see Advanced policies and Policy expressions

Policy reference index

• Access restriction policies
  • Check HTTP header - Enforces existence and/or value of a HTTP Header.
  • Limit call rate by subscription - Prevents API usage spikes by limiting call rate, on a per subscription basis.
  • Limit call rate by key - Prevents API usage spikes by limiting call rate, on a per key basis.
  • Restrict caller IPs - Filters (allows/denies) calls from specific IP addresses and/or address ranges.
  • Set usage quota by subscription - Allows you to enforce a renewable or lifetime call volume and/or bandwidth quota, on a per subscription basis.
  • Set usage quota by key - Allows you to enforce a renewable or lifetime call volume and/or bandwidth quota, on a per key basis.
  • Validate JWT - Enforces existence and validity of a JWT extracted from either a specified HTTP Header or a specified query parameter.
• Advanced policies
  • Control flow - Conditionally applies policy statements based on the results of the evaluation of Boolean expressions.
  • Forward request - Forwards the request to the backend service.
  • Log to Event Hub - Sends messages in the specified format to a message target defined by a Logger entity.
  • Retry - Retries execution of the enclosed policy statements, if and until the condition is met. Execution will repeat at the specified time intervals and up to the specified retry count.
  • Return response - Aborts pipeline execution and returns the specified response directly to the caller.
  • Send one way request - Sends a request to the specified URL without waiting for a response.
  • Send request - Sends a request to the specified URL.
  • Set request method - Allows you to change the HTTP method for a request.
  • Set status - Changes the HTTP status code to the specified value.
  • Set variable - Persist a value in a named context variable for later access.
  • Trace - Adds a string into the API Inspector output.
  • Wait - Waits for enclosed Send request, Get value from cache, or Control flow policies to complete before proceeding.
• Authentication policies
  • Authenticate with Basic - Authenticate with a backend service using Basic authentication.
  • Authenticate with client certificate - Authenticate with a backend service using client certificates.
• Caching policies
  • Get from cache - Perform cache look up and return a valid cached response when available.
  • Store to cache - Caches response according to the specified cache control configuration.
  • Get value from cache - Retrieve a cached item by key.
  • Store value in cache - Store an item in the cache by key.
  • Remove value from cache - Remove an item in the cache by key.
• Cross domain policies
  • Allow cross-domain calls - Makes the API accessible from Adobe Flash and Microsoft Silverlight browser-based clients.
  • CORS - Adds cross-origin resource sharing (CORS) support to an operation or an API to allow cross-domain calls from browser-based clients.
  • JSONP - Adds JSON with padding (JSONP) support to an operation or an API to allow cross-domain calls from JavaScript browser-based clients.
• Transformation policies
  • Convert JSON to XML - Converts request or response body from JSON to XML.
  • Convert XML to JSON - Converts request or response body from XML to JSON.
  • Find and replace string in body - Finds a request or response substring and replaces it with a different substring.
  • Mask URLs in content - Re-writes (masks) links in the response body so that they point to the equivalent link via the gateway.
  • Set backend service - Changes the backend service for an incoming request.
  • Set body - Sets the message body for incoming and outgoing requests.
  • Set HTTP header - Assigns a value to an existing response and/or request header or adds a new response and/or request header.
  • Set query string parameter - Adds, replaces value of, or deletes request query string parameter.
  • Rewrite URL - Converts a request URL from its public form to the form expected by the web service.

Next steps

For more information on policy expressions, see the following video.

[!VIDEO https://channel9.msdn.com/Blogs/AzureApiMgmt/Policy-Expressions-in-Azure-API-Management/player]