This article explains how to configure the Azure API Management (APIM) integration with the Cequence Unified API Protection (UAP) platform. It is intended for Azure administrators configuring the integration through the Azure Portal. You can enable the integration globally for all APIs or configure individual APIs separately.

Prerequisites

Before starting the configuration, ensure you have:

• Access to the Azure Portal with appropriate permissions
• The Cequence Bridge must be installed.
• Your Cequence Edge/Bridge endpoint URL
• OAuth2 credentials, needed when using Policy Auth Type, including the following values.
  • Token endpoint URL
  • Client ID
  • Client secret
• The Cequence APIM policy XML file (cequence-apim/policies/policy-all-apis.xml)
• An Azure API Management service instance
• Network connectivity between Azure API Management and the Cequence UAP platform endpoints

Azure Service Principal setup

Policy deployment automation requires a Service Principal with Contributor access at the subscription level. See The Azure Service Principal for the full procedure, including creating the Service Principal, generating client credentials, and granting permissions.

Add the resulting Client ID and Client secret to your config.jsonc file for automated deployments. A single Service Principal can manage multiple subscriptions when granted appropriate permissions on each.

Downloading and extracting the integration files

The Cequence policy XML files are distributed as a compressed archive. Complete the following steps before you configure the named values or the policy.

1. Download the Azure API Gateway integration archive from the Cequence Support Portal.
2. Extract the archive to a local directory.
3. Locate the policy file at cequence-apim/policies/policy-all-apis.xml. You'll add its content to the Backend policy field in the following sections.

Global plugin configuration

Follow these steps to enable the integration for all APIs in your APIM instance.

Step 1: Configure named values

1. Sign in to the Azure Portal, an external Microsoft site that may change over time.
2. Search for "API Management services" in the top search bar.
3. Select your APIM instance from the list.
4. In the left navigation menu, under APIs, select Named values.
5. Select + Add to create new named values.
6. Create the following required named values:

When you're using Policy Auth Type authentication, create these additional named values:

Generating the client ID and client secret

Several Cequence components must authenticate to the Cequence UAP platform in order to transmit and receive data. Create authentication credentials in the Cequence UAP platform to enable this authentication.

1. Log in to the UAP management portal UI.
   The URL for the management portal is typically of the form https://ui.<your-tenant-name>.<domain>. Replace <your-tenant-name> with the name of your Cequence tenant organization. Replace <domain> with your domain name.
2. Select General Settings > User Management.
   The User Management pane appears.
3. Click the Clients tab.
4. Click Add New Client.
   The new client dialog box appears.
5. Type the client name in the Client Name field.
   This name is the client ID. Note the client ID for later use.
6. Enable the Traffic Management toggle.
7. (Optional) To change the token lifespan from the default of 1800 seconds, type a whole number of seconds in Token Lifespan.
8. Click Save.
   A dialog box with the client secret appears.
9. Click the blue Copy icon to copy the secret to the clipboard, then click Close.
   The client is now set up. Note the client name for future use.
   The client list appears.
10. Note the value of the client secret for later use. This value will not be shown again later on the UI for security reasons.

Step 2: Apply the global policy

1. In the left navigation menu, select APIs.
2. Select All APIs at the top of the page.
3. Select Policies from the toolbar.
4. In the Backend policy section, add the content from the Cequence global policy XML file (cequence-apim/policies/policy-all-apis.xml).
5. Select Save.

Individual API configuration

To enable the integration for specific APIs only, follow these steps for each API.

Step 1: Configure named values

Follow the same steps as described in the Global plugin configuration section to create the required named values.

Step 2: Apply the policy to individual APIs

1. In the left navigation menu, select APIs.
2. Select the specific API you want to configure.
3. Select Policies from the toolbar.
4. Apply the policy based on your current configuration.

The policy content required depends on whether the API already has an existing policy attached.

For APIs without existing policies

In the Backend policy section, add the complete Cequence policy XML file (cequence-apim/policies/policy-all-apis.xml).

For APIs with existing policies

To preserve your existing policies while adding Cequence integration:

1. Copy the <inbound></inbound> section from cequence-apim/policies/policy-all-apis.xml.
2. Paste it at the beginning of your existing policy's inbound section to capture unmodified request metadata.
3. Copy the <outbound></outbound> section from cequence-apim/policies/policy-all-apis.xml.
4. Paste it at the end of your existing policy's outbound section to capture unmodified response metadata.

After applying the policy configuration, select Save.

Verifying the configuration

To verify your configuration is working correctly:

1. Generate traffic to the configured APIs.
2. Access the Dashboard in your Cequence UAP platform.
3. Confirm that API activity appears correctly in Live Activity.
4. Confirm that detections and posture data are being collected.

Disabling the integration

Complete the following steps to temporarily disable the Cequence integration without removing the named values.

1. Navigate to APIs > All APIs in your APIM instance.
2. Remove the Cequence policy from the Backend policy field.
3. Select Save.

Disabling the integration stops the Cequence UAP platform from receiving transaction data for the affected APIs until you re-enable the policy.

Troubleshooting

If API activity doesn't appear in the Cequence UAP dashboard:

• Verify all named values are correctly configured
• Ensure the policy XML is properly applied and confirm using Azure Diagnostics
• Check that your Cequence Edge/Bridge endpoint is accessible
• Confirm OAuth2 credentials are valid when using Policy Auth Type
• Review Azure APIM diagnostic logs for errors
• Ensure outbound internet access is enabled for the subnet where your Azure API Management service is deployed
• Verify that no network security group (NSG) or firewall rule is blocking outbound access to the Cequence URLs on port 443 (HTTPS)
• Use nslookup or dig to confirm the Cequence domains resolve correctly from your environment
• Test connectivity to the edge endpoint and the token endpoint using curl
• When traffic appears in Live Activity but not in Detection or Posture Management, verify that the traffic type is not being ignored by a filter in the Traffic Management section