Managing built-in cache in Azure API Management

 Azure API Management offers caching possibilities to improve performance. 

There are 2 caching options:

1. Response Caching - Useful for caching entire HTTP responses
2. Value Caching - To cache arbitrary pieces of data from within policy definitions.

When it comes to the actual store, APIM supports:

1. Built-in cache
2. External Redis Compatible cache

In this blog I will focus on how to manage "Value Caching".

How do we set/retrieve/delete values using APIM policies?

Typically, Value storage is used for fragment caching - where responses contain data that is expensive to determine and yet remains fresh for a reasonable amount of time. Also, within the APIM policies, we want to cache certain values e.g. OAuth tokens, key-vault secrets, etc. because these remain relatively fresh for a longer period of time.

With caching comes the need to manage the cache specially when you need to clear cached values because they are stale. 

In some scenarios, where OAuth tokens or secrets are cached, you can create a fallback scenario that when authN fails, the cache for the key is purged and a new token is obtained or a fresh read from the key-vault is forced. In addition, there might be other such cached values that might need immediate purging in the cache.

With external Redis Compatible Caches, this is a simple task. We can use the Redis Console and issue a "del" command to immediately purge a key and its value from the cache.

However, there is no such interface when it comes to the in-built cache. All interactions with the in-built cache take place through the APIM policies.

Since the in-built cache is shared by all units in the same region in the same API Management instance, we can create a API that works as a Cache Management Endpoint for that instance.

First let us look at the traces generated by APIM when we call an API that caches a value.

Policy for our sample API

Scenario: Cache not set

Scenario: Cache Set after first run

Now it might be required that we need to invalidate the cache before the set cache expiration. This could be due to several reasons. 

One of the ways to do this could be to update the policy of the API to include a remove-cache policy so that the cache is invalidated. Then you also need to roll back the policy after the next call when the cache needs to work again. This might be tedious since you need to change this for API where you have this requirement.

An easier option is to create a simple CacheMangement API in the APIM instance that does the job without the need to change the policies of individual APIs. We use the fact that the internal cache is shared by all APIs in the instance.

So, we can add a new API to our instance and set the following policy to its operation.

We can now make a simple HTTP call to this API and pass the cache key that we want to clear as a querystring. This also opens up a number of possibilities to script around this to invalidate multiple cache values.

e.g. Invoke-WebRequest -Uri https://<<your apim url>>/managecache/clearkey?key=<<mykey>>