Snippets

KQL snippet: correlate APIM errors on a private API

A short query to separate subscription or key issues, private backend routing, APIM policy failure and application-side API errors.

19 Jun 2026 azureapimprivate-apiprivate-endpointkqllogsgatewayrunbookmonitoring

When a private API exposed through APIM returns 401, 403, 404 or 5xx, inspect the gateway before changing the backend or network rules.

kusto apim-private-api-gateway-errors.kql

let Window = 2h;
let ApiPath = "/orders";
AzureDiagnostics
| where TimeGenerated > ago(Window)
| where ResourceProvider == "MICROSOFT.APIMANAGEMENT"
| where Category == "GatewayLogs"
| where requestUrl_s has ApiPath or backendUrl_s has ApiPath
| project TimeGenerated,
        operationName_s,
        method_s,
        requestUrl_s,
        responseCode_d,
        backendUrl_s,
        backendResponseCode_d,
        cache_s,
        callerIpAddress_s,
        userId_s,
        productId_s,
        apiId_s,
        correlationId_g
| order by TimeGenerated desc

Quick read: responseCode_d at 401/403 with an empty backend points to subscription, key or APIM policy; backendResponseCode_d in 5xx points to the API; an empty backend with 404 may signal a missing APIM route or a wrong path rewrite.