Build APIM inbound, outbound, and on-error policies for rate limiting, JWT, and CORS.
Last verified: May 2026
Output will appear here...The Azure API Management Policy Builder helps you construct APIM policy XML for inbound, backend, outbound, and on-error processing of API requests. APIM policies control rate limiting, authentication, transformation, caching, CORS, and many other API behaviors. This tool provides a visual interface for selecting and configuring policy elements, handling the XML syntax that can be verbose and error-prone when written manually.
Inbound policies execute before the request reaches the backend (authentication, rate limiting, transformation). Backend policies execute just before forwarding to the backend. Outbound policies execute on the response before sending to the client. On-error policies execute when an exception occurs during processing.
Yes. APIM supports policies at four scopes: Global (all APIs), Product (APIs in a product), API (all operations in an API), and Operation (single endpoint). Lower scopes inherit and can override higher scope policies using the <base /> element.
Your team's API has been getting hammered by a misbehaving client doing 10,000 req/sec. The builder helps you add a rate-limit-by-key policy at the global scope: 100 req/min per subscription key, with an HTTP 429 response. Within minutes of deploy, the offending client is throttled, the API recovers, and the operations team can reach out to the client to investigate. Without the tool, hand-crafting the XML for the right combination of conditions and response headers would take 30+ minutes during an active incident.
The builder generates APIM policy XML with the four sections (inbound, backend, outbound, on-error), each containing combinations of policy elements (rate-limit-by-key, validate-jwt, set-header, set-body, cache-store/lookup, retry, return-response). It validates that the XML is well-formed and that policy elements are placed in valid sections (e.g., <validate-jwt> only in inbound). Output includes the <base /> element appropriately to enable scope inheritance.
Always include the <base /> element in policy fragments at lower scopes. Without it, lower scopes silently override higher scopes entirely instead of inheriting them. A common mistake: an API-level policy that doesn't call <base /> inadvertently disables the global rate limiting policy you carefully configured.
validate-jwt is dramatically faster than calling out to an authentication backend in <send-request> for every API call. APIM caches JWKS keys (configurable) and verifies signatures locally. For high-traffic APIs, this can mean 50ms vs 500ms request latency.
Use the <set-variable> + <choose> pattern to implement complex conditional logic instead of nested <when> blocks. This makes policies dramatically more readable and debuggable. Most APIM policies that fail in production are 8+ levels of nested <when> that nobody fully understood.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.