Specific API is added to multiple Products in API Management, want to set 'Subscription required' on API level

Question

I have a couple of Products in my API Management instance, let's call them Product 1 and Product 2.
Both of these products have an API added called Inventory.

For Product 1 I have set Subscription required to true.
For Product 2 I have set Subscription required to false.

So far, this works great.

Now, I have set the Subscription required flag to true on my Inventory API also. I want to enforce people specify a valid subscription key when calling this API. What I'm noticing though, this flag on API-level isn't enforced (properly?). I'm still able to invoke the Inventory API without a subscription key.

My guess is, the Product 2 policy is overruling the Subscription required setting which is set on the API level. Is this correct?
And my actual question is, how to enforce a specific API that always requires a valid subscription key while still having an 'open' Product?

Answer 1

As long as the API is attached to an open product you can always call it without a subscription, this is by design. If you want to enforce a subscription key to be sent, you have either to remove it from that open product or mark it as a subscription required.

Adding a policy is really inefficient and dirty for the following reasons

1. You will need to keep track all the subscription keys values (removed, added, regenerated...etc).

2. All the other polices precedes the checking policy will be executed before the request is denied.

3. if you decide to change the subscription key header name, you will have to go through all the checking policies and modify them.

Answer 2

I test it in my side and also same feature as yours. When I use two products(one enable Requires subscription and the other disable Requires subscription) and both of them has one api in it. The api will not check subscription key even though I have enabled its Subscription required.

As a workaround, you can add a policy in your api <outbound> like below. The added policy is used to check the subscription key manually.