Policy to validate API Subscription Key received in Request Body from Google Ads Lead Form Extension using Webhook integration

Question

Azure API Management checks for Subscription Key in either the Header or Query, but Google Ads Lead Form extension sends the key in the request body google_key

Sample body:

    {
  "lead_id": "TeSter-123-ABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz-0123456789-AaBbCcDdEeFfGgHhIiJjKkLl",
  "api_version": "1.0",
  "form_id": 2,
  "campaign_id": 281492028602095,
  "google_key": "HERE IS THE KEY",
  "is_test": true,
  "gcl_id": "TeSter-123-ABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz-0123456789-AaBbCcDdEeFfGgHhIiJjKkLl",
  "adgroup_id": 20000000000,
  "creative_id": 30000000000
}

How can we configure a custom policy in Azure API Management to validate the key in the request body?

Answer 1

There is built-in architecture in Azure API Management to validate subscription keys that cannot be accessed outside of the built-in Subscription validation.

To use validate the subscription, I created two APIs in Azure API Management. 1 has no security, 2 is secured by Subscription Key and is rate limited.

1. Restructure the request by Appending the Key to the Request Header and removing it from the Request Body

   <inbound>
   <base />
   <set-header name="google_key" exists-action="append">
       <value>@{
               var reqBody = context.Request.Body.As<JObject>(preserveContent: true);
               if(reqBody.ContainsKey("google_key"))
               {
                   return reqBody.GetValue("google_key").ToString();
               }
               else
               {
                   return "";
               }
           }</value>
   </set-header>
   <set-body template="none">@{
               var reqBody = context.Request.Body.As<JObject>(preserveContent: true);
   
               if(reqBody.ContainsKey("google_key"))
               {
                   reqBody.Remove("google_key");
               }
               return JsonConvert.SerializeObject(reqBody);
   }</set-body>
   

2. Send the restructured request to the secured API which validates the subscription key.