Chapter 2 of 6
Architecture at a glance#
Bicep deploys API Center, its metadata schema, the default workspace, the direct agent API, and its Foundry runtime location. API Center's system identity receives API Management Service Reader Role on the exact APIM gateway service. The source integration then imports APIM APIs, definitions, environments, and deployments.
The API program owner registers the approved remote MCP server in the portal. Asset owners maintain metadata on the synchronized and portal-created entries.
Live requests stay on the APIM path. The MCP security configuration uses the MCP entry and runtime location for tool-security work.
Design choices and tradeoffs#
| Decision | Chosen approach | Benefits | Costs and limitations |
|---|---|---|---|
| Inventory scope | Direct agent API, linked APIM instance, and one approved remote MCP server | Gives the three selected assets one searchable inventory | Every API in the APIM instance is imported and needs an owner |
| APIM access | One-way sync with API Management Service Reader Role | Keeps definitions aligned without APIM write access | Initial sync can take up to 24 hours |
| MCP registration | Native portal flow | Uses the supported MCP asset model | A person must maintain the entry |
| Authoritative state | Design metadata in API Center; runtime state in each service | Keeps inventory and runtime health separate | Owners must update metadata after service changes |
| Plan | Record Free or Standard, then confirm it in the portal | Keeps support and cost explicit | Stable Bicep does not set the plan |