Skip to content

Self hosted repository prerequisities

When hosting your API repository in your own DevOps project there are some permissions to set, allowing the api-management-apis Build Service (LKAB) create and contribute to the repository.

Step 1 Set repository permissions

  1. Open your DevOps project -> Select Project settings in the left menu pane
  2. In the Repos section -> Select Repositories
  3. On the All Repositories page, Select the Security tab
  4. In the Search for users and groups input field, enter api-management-apis Build Service (LKAB) to find the build user account
  5. Select the api-management-apis Build Service (LKAB) user and set permissions to match these settings Repository permissions
  6. Do the same procedure for the Mockingbird Build Service (LKAB) user.
  7. Verify permissions match the above

Step 2 Invite to contribute

  1. Open your DevOps project -> Select Project settings in the left menu pane
  2. In the General section -> Select Permissions
  3. On the Permissions page -> Select Contributors Add contributor
  4. On the [Your project name]\Contributor page -> Select the Members tab
  5. Click the Add button and search and select api-management-apis Build Service (LKAB) and Mockingbird Build Service (LKAB) in the search field Invite contributor
  6. Click Save
  7. Select Pipelines in the left menu pane and add permissions for Contributors to edit pipelines Pipeline permissions Pipeline permissions

Step 3 Setup Deploy access

Your API deployment pipeline (created in later steps) need permissions to publish your API to Azure. This is accomplished via Service connections in your DevOps project. These service connections are created by the Add Azure APIM Deploy Access pipeline found in the Mockingbird DevOps project.

Note that this step requires access to the Mockingbird DevOps project. If you don't have access (you probably don't), reach out to the API Management team by sending an email and ask for assistance.

Use this pipeline link or open the Mockingbird project in DevOps, select Pipelines in the left menu pane and click on the Add Azure APIM Deploy Access pipeline. Then click the Run pipeline button. Run deploy access pipeline

In the dialog that opens, edit the devOpsProjectName parameter, ie. replace the $(System.TeamProject) text with the name of your DevOps project. Then hit the Run button.

Edit deploy access pipeline

When the pipeline finishes all jobs should be successful, as in the image below. If all fails maybe there is an error that needs to be fixed by the API Management Team but if it's only one or two (or three) you can try to hit the Rerun failed jobs button. Successful summary

Updating Service connection key

When Service connections are created they contain a Service principal key (a password) with limited lifetime. When they expire the deploy pipeline no longer have the possibility to publish changes to Azure. When this happens, contact the API Management Team for a new key.

When you have received a new key you must update the Service connection.

  1. Go to Project settings and then Service connections under the Pipeline section.
  2. Click on the service connection in question and then the Edit button in the upper right corner.
  3. Paste the new key in the Service principal key field.
  4. Click on the Verify and save button.
  5. Possibly repeat for the other Service connections if you have updated keys for them too

Update Service connection

Step 4 Continue with repository creation

Now that all permissions are in place you can continue creating the repository at Step 1 - Prepare and run the Create API Repo pipeline.

Step 5 Clean up

This step is optional, if you don't mind you can leave the permissions as-is.

When the repository is created the above permissions for api-management-apis Build Service (LKAB) and Mockingbird Build Service (LKAB) can be removed from the project.

  1. Go the Project settings and select Repositories under the Repos section
  2. Select the Security tab
  3. Click on api-management-apis Build Service (LKAB) and the trash bin icon.
  4. Click on Mockingbird Build Service (LKAB) and the trash bin icon.
  5. Go to Permissions under the General section
  6. Click on Contributors and the Members tab
  7. Use the three dot menu on each row to remove api-management-apis Build Service (LKAB) and Mockingbird Build Service (LKAB) via the Remove action.