{"id":29882805,"url":"https://github.com/ronaldbosma/call-apim-with-managed-identity","last_synced_at":"2026-07-01T17:01:10.897Z","repository":{"id":306395968,"uuid":"988954324","full_name":"ronaldbosma/call-apim-with-managed-identity","owner":"ronaldbosma","description":"An azd template using Bicep demonstrating OAuth-protected API calls using managed identities. Shows Azure Functions, Logic Apps and API Management calling APIs without secrets, plus CI/CD pipelines using federated credentials to call OAuth-protected APIs from integration tests.","archived":false,"fork":false,"pushed_at":"2026-05-15T11:14:46.000Z","size":786,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-15T12:21:19.635Z","etag":null,"topics":["api-management","azd","azure","azure-functions","azure-integration-services","azure-logic-apps","bicep","logic-apps","managed-identity","oauth"],"latest_commit_sha":null,"homepage":"","language":"Bicep","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ronaldbosma.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-05-23T10:28:46.000Z","updated_at":"2026-05-15T11:14:48.000Z","dependencies_parsed_at":"2026-01-08T19:05:12.455Z","dependency_job_id":null,"html_url":"https://github.com/ronaldbosma/call-apim-with-managed-identity","commit_stats":null,"previous_names":["ronaldbosma/call-apim-with-managed-identity"],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/ronaldbosma/call-apim-with-managed-identity","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ronaldbosma%2Fcall-apim-with-managed-identity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ronaldbosma%2Fcall-apim-with-managed-identity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ronaldbosma%2Fcall-apim-with-managed-identity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ronaldbosma%2Fcall-apim-with-managed-identity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ronaldbosma","download_url":"https://codeload.github.com/ronaldbosma/call-apim-with-managed-identity/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ronaldbosma%2Fcall-apim-with-managed-identity/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35015061,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-01T02:00:05.325Z","response_time":130,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-management","azd","azure","azure-functions","azure-integration-services","azure-logic-apps","bicep","logic-apps","managed-identity","oauth"],"created_at":"2025-07-31T12:44:21.049Z","updated_at":"2026-07-01T17:01:10.886Z","avatar_url":"https://github.com/ronaldbosma.png","language":"Bicep","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Call OAuth-Protected APIs on API Management with Managed Identity\n\nAn Azure Developer CLI (`azd`) template using Bicep that demonstrates how to call OAuth-Protected APIs on Azure API Management (APIM) from Azure Functions and Logic Apps using managed identity authentication with OAuth.\nIt also shows how one APIM API can securely call another APIM API using its managed identity, enabling secret-free, secure authentication between Azure services.\nAdditionally, the repository includes CI/CD pipelines that demonstrate how to call OAuth-protected APIs from a CI/CD pipeline using federated credentials.\n\n## Overview\n\nThis template deploys the following resources:\n\n![Overview](images/diagrams-overview.png)\n\n- **Azure API Management** service with two APIs:\n  - **Protected API**: A backend API that's protected with OAuth\n  - **Unprotected API**: A public API that calls the protected API using the system-assigned managed identity of API Management\n\n- **Azure Function App**: A .NET 10 function that calls the protected API using the system-assigned managed identity of the Function App\n\n- **Azure Logic App (Standard)**: A workflow that calls the protected API using the system-assigned managed identity of the Logic App\n\n- **Supporting resources**: Application Insights, Log Analytics workspace, Storage Account, and Entra ID app registrations\n\nThe template demonstrates how to authenticate between Azure services using managed identities instead of client secrets or certificates.\nThis approach provides better security and eliminates the need to manage and rotate secrets.\nSupported scenarios include:\n\n- [Call OAuth-Protected APIs with Managed Identity from API Management](https://ronaldbosma.github.io/blog/2025/09/29/call-oauth-protected-apis-with-managed-identity-from-api-management/)\n- [Call OAuth-Protected APIs with Managed Identity from Azure Functions (.NET)](https://ronaldbosma.github.io/blog/2025/09/20/call-oauth-protected-apis-with-managed-identity-from-.net/)\n- [Call OAuth-Protected APIs with Managed Identity from Logic Apps](https://ronaldbosma.github.io/blog/2025/09/24/call-oauth-protected-apis-with-managed-identity-from-logic-apps/)\n\nIf you can't use a managed identity, have a look at [Call API Management backend with OAuth](https://github.com/ronaldbosma/call-apim-backend-with-oauth) instead.\n\n\u003e [!IMPORTANT]  \n\u003e This template is not production-ready; it uses minimal cost SKUs and omits network isolation, advanced security, governance and resiliency. Harden security, implement enterprise controls and/or replace modules with [Azure Verified Modules](https://azure.github.io/Azure-Verified-Modules/) before any production use.\n\nThis repository also includes CI/CD pipelines using GitHub Actions and Azure DevOps that automate the build, deployment, testing and cleanup process.\nThese pipelines demonstrate how to call OAuth-protected APIs from a CI/CD pipeline using federated credentials, eliminating the need for secrets in your automation workflows.\n\n![Overview](images/diagrams-overview-pipelines.png)\n\nPipeline scenarios include:\n\n- [Call OAuth-Protected APIs from GitHub Actions Using Federated Credentials](https://ronaldbosma.github.io/blog/2025/11/03/call-oauth-protected-apis-from-github-actions-using-federated-credentials/)\n- [Call OAuth-Protected APIs from Azure DevOps Using Federated Credentials](https://ronaldbosma.github.io/blog/2025/11/10/call-oauth-protected-apis-from-azure-devops-using-federated-credentials/)\n\nSee [pipeline](#pipeline) for more details.\n\n## Getting Started\n\n### Prerequisites\n\nBefore you can deploy this template, make sure you have the following tools installed and the necessary permissions:\n\n**Required Tools:**\n\n- [Azure Developer CLI (azd)](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/install-azd)  \n  Installing `azd` also installs the following tools:\n  - [GitHub CLI](https://cli.github.com)\n  - [Bicep CLI](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install)\n- [.NET 10 SDK](https://dotnet.microsoft.com/en-us/download/dotnet/10.0)\n- [npm CLI](https://nodejs.org/)\n  _(This template uses a workaround to deploy the Logic App workflow, which requires the npm CLI.)_\n- This template includes several hooks that run at different stages of the deployment process and require the following tools. For more details, see [Hooks](#hooks).\n  - [PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell)\n  - [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest)\n\n**Required Permissions:**\n\n- You need **Owner** or **Contributor** permissions on an Azure Subscription to deploy this template\n- You need **Application Administrator** or **Cloud Application Administrator** permissions to register the Entra ID app registrations\n  _(You already have enough permissions if 'Users can register applications' is enabled in your Entra tenant.)_\n\n### Deployment\n\nOnce the prerequisites are installed on your machine, you can deploy this template using the following steps:\n\n1. Run the `azd init` command in an empty directory with the `--template` parameter to clone this template into the current directory.\n\n   ```cmd\n   azd init --template ronaldbosma/call-apim-with-managed-identity\n   ```\n\n   When prompted, specify the name of the environment (for example, `managedidentity`). The maximum length is 32 characters.\n\n1. Run the `azd auth login` command to authenticate to your Azure subscription using the **Azure Developer CLI** _(if you haven't already)_.\n\n   ```cmd\n   azd auth login\n   ```\n\n1. Run the `az login` command to authenticate to your Azure subscription using the **Azure CLI** _(if you haven't already)_. This is required for the [hooks](#hooks) to function properly. Make sure to log into the same tenant as the Azure Developer CLI.\n\n   ```cmd\n   az login\n   ```\n\n1. Run the `azd up` command to provision the resources in your Azure subscription and Entra ID tenant. This deployment typically takes around 7 minutes to complete. _(Use `azd provision` to only deploy the infrastructure.)_\n\n   ```cmd\n   azd up\n   ```\n\n   See [Troubleshooting](#troubleshooting) if you encounter any issues during deployment.\n\n1. Once the deployment is complete, you can locally modify the application or infrastructure and run `azd up` again to update the resources in Azure.\n\n### Demo and Test\n\nThe [Demo Guide](demos/demo.md) provides a step-by-step walkthrough on how to test and demonstrate the deployed resources.\n\n### Clean up\n\nOnce you're done and want to clean up, run the `azd down` command. By including the `--purge` parameter, you ensure that the API Management service and Log Analytics workspace don't remain in a soft-deleted state, which could cause issues with future deployments of the same environment.\n\n```cmd\nazd down --purge\n```\n\n## Configuration\n\n### API Access for Users\n\nBy default, this template allows API access for users by adding a scope to the API Management app registration. This is configured through the `allowApiAccessForUsers` parameter in [main.parameters.json](/infra/main.parameters.json). The default is `true`.\n\nTo disable it, run the following command before deploying the template:\n\n```cmd\nazd env set ALLOW_API_ACCESS_FOR_USERS=false\n```\n\n### Service Management Reference\n\nIn an enterprise environment (for tenants with Entra IDs enabled by Service Tree management), the `ServiceManagementReference` field on an application (app registration) is mandatory.\nIf you're deploying this template in such an environment, you can set this field through the `serviceManagementReference` parameter in [main.parameters.json](/infra/main.parameters.json). The default is an empty string.\n\nUse the following command to set a valid Service Management Reference ID before deploying the template:\n\n```cmd\nazd env set AZURE_SERVICE_MANAGEMENT_REFERENCE \u003cid\u003e\n```\n\nReplace `\u003cid\u003e` with the valid Service Tree ID.\nIf you don't provide a valid ID, the deployment will fail with the following error: `Value for ServiceManagementReference must be a valid GUID`.\n\n\n## Contents\n\nThe repository consists of the following files and directories:\n\n```\n├── .azdo\n│   └── pipelines              [ Azure DevOps pipeline(s) ]\n├── .devcontainer              [ Development container configuration files ]\n├── .github\n│   └── workflows              [ GitHub Actions workflow(s) ]\n├── .vscode                    [ Visual Studio Code configuration files ]\n├── demos                      [ Demo guide(s) ]\n├── hooks                      [ AZD Hooks to execute at different stages of the deployment process ]\n├── images                     [ Images used in the README and demo guide ]\n├── infra                      [ Infrastructure As Code files ]\n│   ├── functions              [ Bicep user-defined functions ]\n│   ├── modules\n│   │   ├── application        [ Protected and unprotected APIs ]\n│   │   ├── entra-id           [ Modules for all Entra ID resources ]\n│   │   └── services           [ Modules for all Azure services ]\n│   │   └── shared             [ Shared modules ]\n│   ├── types                  [ Bicep user-defined types ]\n│   ├── main.bicep             [ Main infrastructure file ]\n│   └── main.parameters.json   [ Parameters file ]\n├── src\n│   ├── functionApp            [ Azure Function that calls the protected API ]\n│   └── logicApp               [ Logic App workflow that calls the protected API ]\n├── tests\n│   ├── IntegrationTests       [ Integration tests for automatically verifying different scenarios ]\n│   └── *.http                 [ HTTP request files for testing different scenarios ]\n├── azure.yaml                 [ Describes the apps and types of Azure resources ]\n└── bicepconfig.json           [ Bicep configuration file ]\n```\n\n## Hooks\n\nThis template has several hooks that are executed at different stages of the deployment process. The following hooks are included:\n\n### Pre-down hooks\n\nThese PowerShell scripts are executed before the resources are removed.\n\n- [predown-remove-app-registrations.ps1](hooks/predown-remove-app-registrations.ps1):\n  Removes the app registrations created during the deployment process, because `azd` doesn't support deleting Entra ID resources yet.\n  See the related GitHub issue: https://github.com/Azure/azure-dev/issues/4724.\n  The Entra ID resources have a custom tag `azd-env-id: \u003cenvironment-id\u003e`, so we can find and delete them.\n\n## Pipeline\n\nThis template includes a GitHub Actions workflow that automates the build, deployment and cleanup process. The workflow is defined in [azure-dev.yml](.github/workflows/azure-dev.yml) and provides a complete CI/CD pipeline for this template using the Azure Developer CLI.\n\n![GitHub Actions Workflow Summary](images/github-actions-workflow-summary.png)\n\nThe pipeline consists of the following jobs:\n\n- **Build, Verify and Package**: This job sets up the build environment, validates the Bicep template and packages the Function App, Logic App and integration tests.\n- **Deploy to Azure**: This job provisions the Azure infrastructure and deploys the packaged applications to the created resources.\n- **Verify Deployment**: This job runs automated [integration tests](#integration-tests) on the deployed resources to verify correct functionality.\n- **Clean Up Resources**: This job removes all deployed Azure resources.\n\n  By default, cleanup runs automatically after the deployment. This can be disabled via an input parameter when the workflow is triggered manually.\n\n  ![GitHub Actions Manual Trigger](images/github-actions-workflow-manual-trigger.png)\n\nFor draft PRs, only the 'Build, Verify and Package' job is executed to avoid deploying from work-in-progress branches. When the PR is marked ready for review, the workflow will trigger and execute all jobs.\n\nSee [GitHub Actions Workflow for Azure Developer CLI (azd) Templates](https://ronaldbosma.github.io/blog/2026/03/02/github-actions-workflow-for-azure-developer-cli-azd-templates/) for a detailed explanation of the workflow.\n\n\u003e [!NOTE]\n\u003e An Azure DevOps pipeline is also included in [.azdo/pipelines/azure-dev.yml](.azdo/pipelines/azure-dev.yml) that implements the same jobs as the GitHub Actions workflow.\n\n### Setting Up the Pipeline\n\nTo set up the pipeline in your own repository, run the following command (add ` --provider azdo` if you want to create an Azure DevOps pipeline):\n\n```cmd\nazd pipeline config\n```\n\nFollow the instructions and choose **Federated Service Principal (SP + OIDC)**, as OpenID Connect (OIDC) is the authentication method used by the pipeline, and only a **service principal** can be granted the necessary permissions in Entra ID.\n\nAfter the service principal has been created:\n\n- Add the Microsoft Graph permissions **Application.ReadWrite.All**, **AppRoleAssignment.ReadWrite.All** and **DelegatedPermissionGrant.ReadWrite.All** to the app registration of the service principal, and grant admin consent for these permissions. Use the **application permissions** type, not delegated permissions type. These permissions are necessary to deploy the Entra ID resources with the Microsoft Graph Bicep Extension.\n- Assign the service principal either the **Application Administrator** or **Cloud Application Administrator** role if it's not already assigned. One of these roles is necessary for the [hooks](#hooks) to successfully remove the Entra ID resources during cleanup.\n\nFor detailed guidance, refer to:\n\n- [Explore Azure Developer CLI support for CI/CD pipelines](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/configure-devops-pipeline)\n- [Create a GitHub Actions CI/CD pipeline using the Azure Developer CLI](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/pipeline-github-actions)  \n  or [Create an Azure DevOps CI/CD pipeline using the Azure Developer CLI](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/pipeline-azure-pipelines)\n\n\u003e [!TIP]\n\u003e By default, `AZURE_CLIENT_ID`, `AZURE_TENANT_ID` and `AZURE_SUBSCRIPTION_ID` are created as variables in GitHub when running `azd pipeline config`. However, [Microsoft recommends](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect) using secrets for these values to avoid exposing them in logs. The workflow supports both approaches, so you can manually create secrets and remove the variables if desired.\n\n\u003e [!NOTE]\n\u003e In the GitHub Actions workflow, the environment name in the `AZURE_ENV_NAME` variable is suffixed with `-pr{id}` for pull requests. This prevents conflicts when multiple PRs are open and avoids accidental removal of environments, because the environment name tag is used when removing resources.\n\n## Integration Tests\n\nThe project includes integration tests built with **.NET 10** that validate various scenarios through the deployed Azure services. The tests implement the same scenarios described in the [Demo](./demos/demo.md) and are located in [IntegrationTests](tests/IntegrationTests).\n\nSome things to note about the integration tests:\n\n- The tests automatically locate your azd environment's `.env` file if available, to retrieve necessary configuration. In the [pipeline](#pipeline) they rely on environment variables set in the workflow.\n- The [Logic App integration tests](./tests/IntegrationTests/LogicAppTests.cs) use [Azure.ResourceManager.AppService](https://learn.microsoft.com/en-us/dotnet/api/azure.resourcemanager.appservice?view=azure-dotnet) to retrieve the Logic App workflow callback URL, leveraging Azure CLI or Azure Developer CLI authentication.\n- The [Pipeline integration tests](./tests/IntegrationTests/PipelineCredentialsTests.cs) use Azure CLI or Azure Developer CLI credentials to call the OAuth-protected API directly.\n\n## Troubleshooting\n\n### API Management deployment failed because the service already exists in soft-deleted state\n\nIf you've previously deployed this template and deleted the resources, you may encounter the following error when redeploying the template. This error occurs because the API Management service is in a soft-deleted state and needs to be purged before you can create a new service with the same name.\n\n```json\n{\n  \"code\": \"DeploymentFailed\",\n  \"target\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-managedidentity-nwe-i2jdr/providers/Microsoft.Resources/deployments/apiManagement\",\n  \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.\",\n  \"details\": [\n    {\n      \"code\": \"ServiceAlreadyExistsInSoftDeletedState\",\n      \"message\": \"Api service apim-managedidentity-nwe-i2jdr was soft-deleted. In order to create the new service with the same name, you have to either undelete the service or purge it. See https://aka.ms/apimsoftdelete.\"\n    }\n  ]\n}\n```\n\nUse the [az apim deletedservice list](https://learn.microsoft.com/en-us/cli/azure/apim/deletedservice?view=azure-cli-latest#az-apim-deletedservice-list) Azure CLI command to list all deleted API Management services in your subscription. Locate the service that is in a soft-deleted state and purge it using the [purge](https://learn.microsoft.com/en-us/cli/azure/apim/deletedservice?view=azure-cli-latest#az-apim-deletedservice-purge) command. See the following example:\n\n```cmd\naz apim deletedservice purge --location \"swedencentral\" --service-name \"apim-managedidentity-nwe-i2jdr\"\n```\n\n### Function App deployment failed because of quota limitations\n\nIf you already have a Consumption tier (`SKU=Y1`) Function App deployed in the same region, you may encounter the following error when deploying the template. This error occurs because you have reached the region's quota for your subscription.\n\n```json\n{\n  \"code\": \"InvalidTemplateDeployment\",\n  \"message\": \"The template deployment 'functionApp' is not valid according to the validation procedure. The tracking id is '00000000-0000-0000-0000-000000000000'. See inner errors for details.\",\n  \"details\": [\n    {\n      \"code\": \"ValidationForResourceFailed\",\n      \"message\": \"Validation failed for a resource. Check 'Error.Details[0]' for more information.\",\n      \"details\": [\n        {\n          \"code\": \"SubscriptionIsOverQuotaForSku\",\n          \"message\": \"This region has quota of 1 instances for your subscription. Try selecting different region or SKU.\"\n        }\n      ]\n    }\n  ]\n}\n```\n\nUse the `azd down --purge` command to delete the resources, then deploy the template in a different region.\n\n### Logic App deployment failed because of quota limitations\n\nIf you already have a Workflow Standard WS1 tier (`SKU=WS1`) Logic App deployed in the same region, you may encounter the following error when deploying the template. This error occurs because you have reached the region's quota for your subscription.\n\n```json\n{\n  \"code\": \"InvalidTemplateDeployment\",\n  \"message\": \"The template deployment 'logicApp' is not valid according to the validation procedure. The tracking id is '00000000-0000-0000-0000-000000000000'. See inner errors for details.\",\n  \"details\": [\n    {\n      \"code\": \"ValidationForResourceFailed\",\n      \"message\": \"Validation failed for a resource. Check 'Error.Details[0]' for more information.\",\n      \"details\": [\n        {\n          \"code\": \"SubscriptionIsOverQuotaForSku\",\n          \"message\": \"This region has quota of 1 instances for your subscription. Try selecting different region or SKU.\"\n        }\n      ]\n    }\n  ]\n}\n```\n\nUse the `azd down --purge` command to delete the resources, then deploy the template in a different region.\n\n### Deployment fails with BadRequest: ServiceManagementReference field is required for Update, but is missing in the request\n\nIn an enterprise environment (for tenants with Entra IDs enabled by Service Tree management), the `ServiceManagementReference` field on an application (app registration) is mandatory.\nIf you're deploying this template in such an environment, you may encounter the following error during deployment:\n\n```\nERROR: error executing step command 'provision': deployment failed: error deploying infrastructure: deploying to subscription:\nDeployment Error Details:\nBadRequest: ServiceManagementReference field is required for Update, but is missing in the request.\nRefer to the TSG `https://aka.ms/service-management-reference-error` for resolving the error\nGraph client request id: \u003crequest-id\u003e.\nGraph request time: 2025-11-20T12:34:56.789Z.\nTraceID: \u003ctrace-id\u003e\n```\n\nThis template provides an optional parameter to set the `ServiceManagementReference` field on app registrations if required by your tenant.\nUse the following command to set the `AZURE_SERVICE_MANAGEMENT_REFERENCE` environment variable in your azd environment:\n\n```cmd\nazd env set AZURE_SERVICE_MANAGEMENT_REFERENCE \u003cid\u003e\n```\n\nReplace `\u003cid\u003e` with the valid Service Tree ID.\nIf you don't provide a valid ID, the deployment will fail with the following error: `Value for ServiceManagementReference must be a valid GUID`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fronaldbosma%2Fcall-apim-with-managed-identity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fronaldbosma%2Fcall-apim-with-managed-identity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fronaldbosma%2Fcall-apim-with-managed-identity/lists"}