Implementation | Session 06: Azure API Management AI gateway design and implementation

Chapter 5 of 6

Implement#

1. Record the design#

Complete gateway-design-record.json with the scope, APIM instance, backend, identities, network paths, Content Safety decision, telemetry boundary, runtime controls, restore path, owners, and readiness gaps. Complete gateway-control.json, sandbox.json, and model-routing-decision.md with the implementation values.

Set the live endpoint values in the shell, not in source control:

PowerShell

$approvedSubscriptionId = $env:AZURE_SUBSCRIPTION_ID
$primaryAgentBaseUrl = $env:session06_PRIMARY_AGENT_BASE_URL
$secondaryAgentBaseUrl = $env:session06_SECONDARY_AGENT_BASE_URL

Bash

approved_subscription_id="${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID.}"
primary_agent_base_url="${session06_PRIMARY_AGENT_BASE_URL:?Set session06_PRIMARY_AGENT_BASE_URL.}"
secondary_agent_base_url="${session06_SECONDARY_AGENT_BASE_URL:-}"

2. Run preflight and inspect the preview#

PowerShell

.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -PrimaryAgentBaseUrl $primaryAgentBaseUrl `
  -SecondaryAgentBaseUrl $secondaryAgentBaseUrl

Bash

./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --primary-agent-base-url "$primary_agent_base_url" \
  --secondary-agent-base-url "$secondary_agent_base_url"

Preflight validates the local design record first. It then checks the backend, identity, network, roles, Content Safety backend, logger, existing marker, and ARM what-if.

To run either check by itself, use the paired helper commands:

PowerShell

.\scripts\preflight-design.ps1 -DesignRecordPath .\artifacts\gateway-design-record.json

Bash

./scripts/preflight-design.sh --design-record-path artifacts/gateway-design-record.json

PowerShell

.\scripts\preflight-implementation.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -PrimaryAgentBaseUrl $primaryAgentBaseUrl `
  -SecondaryAgentBaseUrl $secondaryAgentBaseUrl

Bash

./scripts/preflight-implementation.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --primary-agent-base-url "$primary_agent_base_url" \
  --secondary-agent-base-url "$secondary_agent_base_url"

3. Deploy the controlled route#

PowerShell

.\scripts\deploy.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -PrimaryAgentBaseUrl $primaryAgentBaseUrl `
  -SecondaryAgentBaseUrl $secondaryAgentBaseUrl

Bash

./scripts/deploy.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --primary-agent-base-url "$primary_agent_base_url" \
  --secondary-agent-base-url "$secondary_agent_base_url"

The script reruns preflight and deploys the marked API, product, named values, backend pool, policy, and body-free diagnostics.