APIM get calling user details

Question

We have created few APIs which is used by multiple user with same subscription id. How can we track which user has used the APIs.

Do we have a way to overwrite the default implementation to identify the user?

Note : - https://learn.microsoft.com/en-us/answers/questions/944645/api-management

We want to create API usage report along with user details. Reference - https://learn.microsoft.com/en-us/rest/api/apimanagement/reports/list-by-user?view=rest-apimanagement-2024-05-01&tabs=HTTP

Answer 1

I think of APIM subscription keys as equivalent to client ID in other APIs or perhaps user name or API keys. As such your question is really, how can I tell user A used my API over user B when both are using the same client ID/user name/api key/subscription ID. I think the flaw here is that you're using the same subscription ID for "different" users. If you want to identify users differently then they should have their own subscription IDs. I'd argue for security reasons that each user should have their own subscription key anyway.

The only workaround that I can think of is to require an HTTP header as part of the request and that is where you store the extra data. Since APIM isn't based on OAuth2, in my experience, the more traditional approach of having extra fields in the authentication request wouldn't work. But if users are sharing subscription keys then nothing prevents user A from authenticating using user B's subscription key/info so it is not exactly secure.