Is there any way to define a "Service Contributor" role per API?

Allan Xu 0
Viewed 47

I like to have User-A can contribute to the API-A but doesn't have access to the API-B.

When I look at the Azure APIM Built-in roles (link below) I am noticing that the API Management Service Contributor role is defined for all APIs.

Is it possible to to define a "Service Contributor" role per API as opposed with all APIS? If not, is there any other technique that help me to achieve the same goal

azure-api-management
1 Answers

AFAIK, you can restrict the user to specific set of APIs.

1) Through Product Level where you can add the APIs and allow all APIS to the specific set of users by keeping the Scope level to Product for the users.

  1. Created 2 different APIs in APIM Instance like the below: enter image description here

  2. Open the New APIM Developer Portal after adding the APIs and publish the APIM instance > Portal Overview under Developer Portal.

  3. In APIM Instance > Products > Added new product "Dotnet6FunctionAPIs" - Added the Net 6 Function App APIs > Checked the options "Requires Subscription", "Requires approval" and then published the product.

enter image description here 4. In APIM Instance > Users - created a user and in Products > Dotnet6FunctionAPIs Product > Access control > Allowed the access to Developers group.

  1. Login to the developer portal with the new user login credentials https://<apiminstance_name>.portal.azure-api.net/ > Products > Dotnet6FunctionAPIs product > Click on Subscribe.

enter image description here

Here the Admin can approve the access of that product APIs to the user and can cancel the subscription whenever admin wants to.

After Subscription approval, the user can test the API present in the product. enter image description here

If you observe here, I have allowed the users (under Developer group) to the product "Dotnet6FunctionAPIs" that contains specific APIs added to it.

This is one of the ways to restrict users from not accessing the other APIs by adding only specific APIs to the product and giving that product access to the users.

Updated Answer:

As Markus told, there are 3 built-in roles in APIM. API Management Service Contributor is for CRUD access to Complete APIM Instance (all APIS & Operations) and cannot be restricted to specific APIs. I have seen the permissions given to API Management Service Contributor built-in role. Among those permissions, I believe we need to modify at API Policy Level which is Write (Access) - Set API policy configuration (Permissions) - Creates or updates policy configuration for the API.

APIMServiceContributorRolePermissionsLookup

Hari Krishna0
Related