One catalogue. Follow every request.

Read the step before copying. Bash commands belong in Git Bash on Windows or Azure Cloud Shell set to Bash; PowerShell uses different syntax. A JSON, YAML, Bicep or application-code example belongs in the named file, not directly at the terminal prompt. Follow any shell-specific instructions below.

Keep the same terminal open so earlier variables remain available. Copy one complete command block without the terminal's $ prompt. A backslash continues a command onto the next line. If Bash shows a lone >, it is waiting for the rest of a quote, command or file block. Finish the complete block; if the paste was incomplete, press Ctrl+C and copy it again. Do not paste the next step into an unfinished command.

A line such as RG="training-group" stores a value without printing it. Output captured with $(...) is also stored; a blank screen alone does not prove failure. A sleep deliberately waits, and -o none suppresses normal output. Wait for your normal prompt, then run the step's checkpoint. After an error, stop and keep the exact command and message; later steps cannot repair a missing resource. Never share passwords, access tokens or secret values in a screenshot.

The warehouse wants the red jacket’s catalogue entry. Download the supplied OpenAPI contract. It has one GET operation and fictional data. You can complete the desk track without an Azure account. The optional mock track requires an API Management instance you are allowed to change; its tier and usage can cost money. Check the current feature and price information before creating one. This exercise does not deploy a real backend or configure production authentication.

1. Open the file. Find the path, method, 200 response and JSON example.

2. Write the request: GET /products/RJ-10. Write the expected example fields.

3. Explain why this request retrieves an item rather than creating an order.

1. Draw a partner calling the gateway, Ada changing its configuration, and a developer reading its portal.

2. Label gateway, management plane and developer portal separately.

3. Record which tier features your real networking and portal requirements would need. Use the current tier documentation, not a memorised price.

1. Optional Azure path: in your training APIM instance, choose APIs → Add API → OpenAPI. Import the supplied file and use catalogue as the API URL suffix.

2. Select its GET operation. In inbound processing, add the mock-response policy below. Keep the base element.

3. Use the operation’s Test tab, include the required subscription key if enabled, and send the request. Expect HTTP 200 and the example JSON; record the actual result.

4. Remove the mock before any real-backend exercise. A mock response proves the gateway path, not backend reachability.

<policies>
  <inbound><base /><mock-response status-code="200" content-type="application/json" /></inbound>
  <backend><base /></backend>
  <outbound><base /></outbound>
  <on-error><base /></on-error>
</policies>

Microsoft’s mock walkthrough explains the operation response and test controls.

Supplied desk trace:
Before subscription check: missing key
After valid key: token audience check fails
After valid caller checks: mock returns 200

1. Predict which requests should reach the success mock.

2. Explain why a 200 generated by an early mock cannot prove downstream validation.

3. In any real exercise, place required caller checks before the mock and collect a failing request as well as a success.

Warehouse: subscription W, active
Courier: subscription C, suspended
Both use the same catalogue API

1. Optional Azure path: add the training API to a training product that requires a subscription, then create two separately named training subscriptions.

2. Send the request with each subscription’s key. Keep keys out of saved screenshots and shared logs.

3. Suspend Courier and repeat both requests. Expect Courier refused and Warehouse still permitted; record the actual status.

Policy expects issuer I, audience catalogue-api, scope catalogue.read
Claims A: issuer I, audience catalogue-api, scope catalogue.read
Claims B: issuer I, audience payments-api, scope catalogue.read
Claims C: issuer I, audience catalogue-api, scope orders.write

1. Choose which claim set matches the supplied conditions.

2. Explain why these text claims cannot be pasted into a request as a valid signed token.

3. For a real auth lab, use an actual configured issuer, signed token and policy; check signature, validity and claims. Do not report this desk task as configured OAuth.

Partner → public gateway: reachable
Gateway → private backend: no route
Partner → backend public URL: reachable

1. Mark the failed leg and the gateway-bypass path.

2. Write the DNS, route and authentication checks for each leg.

3. Before changing public access, choose a supported APIM networking model and tier, prove the intended private route, and test both an allowed caller and a bypass attempt.

v1: {"sku":"RJ-10","name":"Red jacket"}
Candidate: {"sku":"RJ-10","displayName":"Red jacket"}
Warehouse reads the field name

1. Identify the breaking change.

2. Write a version plan that gives Warehouse time to migrate. Contrast it with a non-breaking revision.

3. Record gateway status, latency and caller identity needed to check the cutover, without logging keys or tokens.

Delete only the training API, product and subscriptions created for this exercise if the instance is shared. If you created a dedicated instance and group, remove those through your approved teardown and verify deletion. Keep a note separating the desk checks, mock requests you actually ran, and backend/authentication/network checks you have not run.