Policy to validate API Subscription Key received in Request Body from Google Ads Lead Form Extension using Webhook integration - azure-api-management

Question

Azure API Management checks for Subscription Key in either the Header or Query, but Google Ads Lead Form extension sends the key in the request body google_key
Sample body:
{
"lead_id": "TeSter-123-ABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz-0123456789-AaBbCcDdEeFfGgHhIiJjKkLl",
"api_version": "1.0",
"form_id": 2,
"campaign_id": 281492028602095,
"google_key": "HERE IS THE KEY",
"is_test": true,
"gcl_id": "TeSter-123-ABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz-0123456789-AaBbCcDdEeFfGgHhIiJjKkLl",
"adgroup_id": 20000000000,
"creative_id": 30000000000
}
How can we configure a custom policy in Azure API Management to validate the key in the request body?

Answer 1

There is built-in architecture in Azure API Management to validate subscription keys that cannot be accessed outside of the built-in Subscription validation.
To use validate the subscription, I created two APIs in Azure API Management. 1 has no security, 2 is secured by Subscription Key and is rate limited.
Restructure the request by Appending the Key to the Request Header and removing it from the Request Body
<inbound>
<base />
<set-header name="google_key" exists-action="append">
<value>#{
var reqBody = context.Request.Body.As<JObject>(preserveContent: true);
if(reqBody.ContainsKey("google_key"))
{
return reqBody.GetValue("google_key").ToString();
}
else
{
return "";
}
}</value>
</set-header>
<set-body template="none">#{
var reqBody = context.Request.Body.As<JObject>(preserveContent: true);
if(reqBody.ContainsKey("google_key"))
{
reqBody.Remove("google_key");
}
return JsonConvert.SerializeObject(reqBody);
}</set-body>
Send the restructured request to the secured API which validates the subscription key.