Azure API Management with multiple backends

Question

I have an Azure API Management set and running. The API calls are made to a Docker container running FastAPI on an Azure virtual machine. This backend container is responsible for running some AI models based on the queries it receives. It all works fine for a single user.

The thing is: these AI models are defined in a config file inside the container and are user-specific.

I want to use Azure API Management to route requests based on, say, the user subscription. In other words, given a subscription, I want to know which backend to call (each backend would be a container running a specific AI model for that particular user/company on an Azure virtual machine).

What is the best way to approach this?

Answer 1

I found out that you can use inbound policies to specify which backend to use depending on what group the user belongs to. The reference to my answer comes from here .

Go to your API Management, choose Groups and create groups that are relevant to your users. Then add your users to their respective groups.

Go to your API, select inbound rules and specify your backends using something like this:

<policies>
<inbound>
    <choose>
        <when condition="@(context.User.Groups.Select(g => g.Name).Contains("org1"))">
            <set-backend-service base-url="https://abc-apim.azure-api.net/org1app" />
        </when>
        <when condition="@(context.User.Groups.Select(g => g.Name).Contains("org2"))">
            <set-backend-service base-url="https://abc-apim.azure-api.net/org2app" />
        </when>
        <otherwise>
            <return-response>
                <set-status code="401" reason="Unauthorized" />
                <set-header name="WWW-Authenticate" exists-action="override">
                    <value>Bearer error="Invalid user group"</value>
                </set-header>
            </return-response>
        </otherwise>
    </choose>
    <base />
</inbound>
<backend>
    <base />
</backend>
<outbound>
    <base />
</outbound>
<on-error>
    <base />
</on-error>
</policies>

I undestand this approach is not so elegant, since you have to hard code the backend routing in your policy. But it works.