What are the relations among API policies defined at product level, API level, and operation level?

Azure API Management allows you to define policies at 3 levels:

• Top Level policy - Policy defined at top level can be shared amount all APIs. You can use the "base" policy statement in the API policy to call the top level policy.
• API level policy - Policy defined at API level can be shared amount all operations associated to the API. You can use the "base" policy statement in the operation policy to call the API policy.
• Operation level policy - Policy defined at API level is only applied to the operation.

The "base" Policy statement allows you to call the same policy block in the next upper level of the policy hierarchy. The "base" policy statement is a simple <base/> with no attributes and no content.

For example, the following "inbound" policy defined at the operation level will call the "inbound" policy defined at the operation level.

	<inbound>
		<base />
		... operation own policy statement
	</inbound>

The following "backend" policy defined in an operation will not call the API "backend" policy. Azure API management will not forward this operation to any backend system, because is have no policy statement:

	<backend>
	</backend>

Assuming we have the following 3 policies defined:

Operation inbound policy:
	<inbound>
		<base /> <!-- calling the API inbound policy
		<trace source="DEBUG">Hello from Operation Z!</trace>
	</inbound>
	
API inbound policy:
	<inbound>
		<base /> <!-- calling the product inbound policy
		<trace source="DEBUG">Hello from API Y!</trace>
	</inbound>
	
Product inbound policy:
	<inbound>
		<trace source="DEBUG">Hello from Product X!</trace>
	</inbound>

When Azure API management process the inbound request from a client system, it will produce DEBUG trace messages in order listed below:

Hello from Product X!
Hello from API Y!
Hello from Operation Z!

 

⇒ API Level Policy for All Operations

⇐ Azure API Policy XML Document Structure

⇑ Using Azure API Policy

⇑⇑ Microsoft Azure API Management Tutorials