Generates Azure API Management policy XML for authentication, rate limiting, CORS, error handling and transformations, consulting Azure best-practice and documentation tools first.
$ npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install thomast1906/github-copilot-agent-skills apim-policy-authoring --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/thomast1906/github-copilot-agent-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/apim-policy-authoring .claude/skills/apim-policy-authoring && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "apim-policy-authoring" agent skill from https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoring into .claude/skills/apim-policy-authoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apim-policy-authoring", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoringType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install thomast1906/github-copilot-agent-skills apim-policy-authoring --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/thomast1906/github-copilot-agent-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/skills/apim-policy-authoring .agents/skills/apim-policy-authoring && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "apim-policy-authoring" agent skill from https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoring into .agents/skills/apim-policy-authoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apim-policy-authoring", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install thomast1906/github-copilot-agent-skills apim-policy-authoring --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/thomast1906/github-copilot-agent-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/skills/apim-policy-authoring .cursor/skills/apim-policy-authoring && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "apim-policy-authoring" agent skill from https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoring into .cursor/skills/apim-policy-authoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apim-policy-authoring", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/thomast1906/github-copilot-agent-skills.git --path .github/skills/apim-policy-authoring--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install thomast1906/github-copilot-agent-skills apim-policy-authoring --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/thomast1906/github-copilot-agent-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/skills/apim-policy-authoring .gemini/skills/apim-policy-authoring && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "apim-policy-authoring" agent skill from https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoring into .gemini/skills/apim-policy-authoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apim-policy-authoring", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install thomast1906/github-copilot-agent-skills apim-policy-authoringInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/thomast1906/github-copilot-agent-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/skills/apim-policy-authoring .github/skills/apim-policy-authoring && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "apim-policy-authoring" agent skill from https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoring into .github/skills/apim-policy-authoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apim-policy-authoring", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install thomast1906/github-copilot-agent-skills apim-policy-authoring --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/thomast1906/github-copilot-agent-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/skills/apim-policy-authoring .opencode/skills/apim-policy-authoring && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "apim-policy-authoring" agent skill from https://github.com/thomast1906/github-copilot-agent-skills/tree/main/.github/skills/apim-policy-authoring into .opencode/skills/apim-policy-authoring/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "apim-policy-authoring", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
apim-policy-authoringGenerates Azure API Management policy XML for authentication, rate limiting, CORS, error handling and transformations, consulting Azure best-practice and documentation tools first.
The agent writes API Management policies for OAuth 2.0, JWT validation and hybrid auth with subscription keys, per-user or per-subscription throttling, CORS for browser clients, standardized error responses with correlation IDs, header and body transformations and security headers. Three ready templates live in `references/POLICY_TEMPLATES.md`: hybrid authentication with a subscription key fallback for public APIs, OAuth only with Entra ID for internal APIs, and subscription key only for simple read-only APIs. Policies follow the inbound, backend, outbound and on-error flow.
Before writing any policy the agent must call an Azure MCP tool for best practices on the relevant topic, and it searches the Azure documentation for specific elements such as the validate-jwt reference. The skill shows snippets for JWT validation against an Entra ID OpenID configuration, per-user rate limiting keyed on the token subject, correlation ID generation and a standardized on-error response. The excerpt ends in the error-response example.
7 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 554ac0b. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md (its code samples are xml).
From the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
login.microsoftonline.comAlso links to:
learn.microsoft.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Azure APIM Policy Authoring loads about 1.5k tokens when it runs, and up to ~6k if it reads all its reference files. Until then it costs about 78 tokens; SKILL.md has 308 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from thomast1906/github-copilot-agent-skills at commit 554ac0b, republished under its MIT licence (© thomast1906). 308 words, ~1,488 tokens.
.claude/skills/apim-policy-authoring/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.Generates production-ready Azure API Management policy XML with authentication, rate limiting, CORS, error handling, correlation IDs, and security headers.
Activate this skill when users need:
See references/POLICY_TEMPLATES.md for complete production-ready XML templates:
INBOUND → BACKEND → OUTBOUND → ON-ERROR
1. INBOUND: Authentication, rate limiting, CORS, headers
2. BACKEND: Forwarding, retry, circuit breaker
3. OUTBOUND: Response transform, security headers, cleanup
4. ON-ERROR: Structured errors, logging, correlation IDBefore ANY policy generation, call:
Tool: mcp_azure_mcp_get_azure_bestpractices
Intent: "Azure API Management policy best practices for [authentication|rate-limiting|CORS|error-handling]"For specific policy elements:
Tool: mcp_azure_mcp_documentation search
Query: "APIM validate-jwt policy reference"<validate-jwt header-name="Authorization">
<openid-config url="https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration" />
<audiences>
<audience>api://{client-id}</audience>
</audiences>
</validate-jwt><set-variable name="userId" value="@(context.Request.Headers.GetValueOrDefault('Authorization','').AsJwt()?.Subject)" />
<rate-limit-by-key calls="1000" renewal-period="3600" counter-key="@((string)context.Variables['userId'])" /><set-variable name="correlationId" value="@(Guid.NewGuid().ToString())" />
<set-header name="X-Correlation-ID" exists-action="override">
<value>@((string)context.Variables["correlationId"])</value>
</set-header><on-error>
<set-body>@{
return new JObject(
new JProperty("error", new JObject(
new JProperty("code", context.LastError.Source),
new JProperty("message", context.LastError.Message),
new JProperty("correlationId", context.Variables["correlationId"]),
new JProperty("timestamp", DateTime.UtcNow.ToString("o"))
))
).ToString();
}</set-body>
</on-error><set-header name="X-Content-Type-Options" exists-action="override">
<value>nosniff</value>
</set-header>
<set-header name="X-Frame-Options" exists-action="override">
<value>DENY</value>
</set-header>
<set-header name="Strict-Transport-Security" exists-action="override">
<value>max-age=31536000; includeSubDomains</value>
</set-header>| API Type | Authentication | Rate Limit | Use Case |
|---|---|---|---|
| Public Read-Only | Subscription Keys | 500 req/hour | Weather API, Public Holidays |
| Internal Corporate | OAuth (Entra ID) | 10,000 req/hour | Employee Directory, HR Systems |
| Sensitive Public | OAuth (Entra External ID) | 1,000 req/hour | Payment, Health Records |
| Hybrid | OAuth + Keys Fallback | 1,000/500 req/hour | APIs with free/premium tiers |
Before deploying, verify:
<inbound>, included in response + error<on-error> block with structured JSONX-Powered-By, Server in <outbound>Skill Version: 1.0
Last Updated: 29 January 2026
Primary Knowledge: APIM_PLATFORM_BASELINE_POLICIES.md, references/POLICY_TEMPLATES.md
© thomast1906, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 1 other file (references) in .github/skills/apim-policy-authoring of thomast1906/github-copilot-agent-skills.
Open the folder on GitHubat commit 554ac0b
Azure APIM Policy Authoring next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Azure APIM Policy Authoring this skillthomast1906/github-copilot-agent-skills | 202 | — | ~1.5k | Automated safety check: Pass | MIT | |
| API Security Designvinayaklatthe/microsoft-security-skills | 175 | — | ~2.2k | Automated safety check: Pass | MIT | |
| Frontmcp Configagentfront/frontmcp | 146 | — | ~7k | Automated safety check: Pass | Apache-2.0 | |
| Discover APIrand/cc-polymath | 181 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Maui Authenticationdavidortinau/maui-skills | 175 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Frappe Core APIImpertio-Studio/Frappe_Claude_Skill_Package | 189 | — | ~3.2k | Automated safety check: Pass | MIT |
vinayaklatthe/microsoft-security-skills
Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…
agentfront/frontmcp
A skill your agent uses when configuring a FrontMCP server through frontmcp.config or the @FrontMcp options.
rand/cc-polymath
Automatically discover API design skills when working with REST APIs, GraphQL schemas, API authentication, OAuth, JWT, rate limiting, API versioning, error handling, or endpoint design.
davidortinau/maui-skills
Add authentication to .NET MAUI apps. An agent skill from davidortinau/maui-skills.
Impertio-Studio/Frappe_Claude_Skill_Package
A skill your agent uses when building ERPNext/Frappe API integrations (v14/v15/v16) including REST API, RPC API, authentication, webhooks, and rate limiting.
affaan-m/ECC
Quarkus security implementation patterns: JWT and OIDC authentication, @RolesAllowed RBAC and SecurityIdentity checks, Bean Validation and custom validators, parameterized Panache queries, BCrypt…
thomast1906/github-copilot-agent-skills
Guides creating, updating, reviewing and validating GitHub Copilot agent skills, from deciding whether a skill is the right tool to structuring bundled resources.
thomast1906/github-copilot-agent-skills
Audits an Azure API Management setup against the OWASP API Security Top 10 and Azure Security Benchmark, covering policies, network layout and identity.
thomast1906/github-copilot-agent-skills
Supplies Bicep and Terraform templates, CI/CD pipeline patterns and phased promotion plans for deploying Azure API Management with APIOps workflows.
thomast1906/github-copilot-agent-skills
Creates and edits architecture diagrams through the Draw.io MCP tool, with guidance for rendering Azure icons correctly and laying out network diagrams.
thomast1906/github-copilot-agent-skills
Looks up live Azure retail prices by SKU, service or region through the Azure MCP pricing tool, estimates template costs and compares regions, price types and savings plans.
thomast1906/github-copilot-agent-skills
Create and edit diagrams on a live Excalidraw canvas using the Excalidraw MCP server.
Works with
Categories
Generates Azure API Management policy XML for authentication, rate limiting, CORS, error handling and transformations, consulting Azure best-practice and documentation tools first. 0, JWT validation and hybrid auth with subscription keys, per-user or per-subscription throttling, CORS for browser clients, standardized error responses with correlation IDs, header and body transformations and security headers.md`: hybrid authentication with a subscription key fallback for public APIs, OAuth only with Entra ID for internal APIs, and subscription key only for simple read-only APIs.
Azure APIM Policy Authoring fits situations like: securing an API in Azure API Management with JWT or OAuth validation; adding per-user rate limiting to an API policy; setting up CORS and security headers for a browser-facing API; standardizing error responses with correlation IDs.
Run `npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a claude-code`. Or copy the skill folder (.github/skills/apim-policy-authoring in thomast1906/github-copilot-agent-skills) into .claude/skills/apim-policy-authoring in your project. Claude Code loads it when a task matches its description.
Run `npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a codex`. Or copy the skill folder (.github/skills/apim-policy-authoring in thomast1906/github-copilot-agent-skills) into .agents/skills/apim-policy-authoring in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add thomast1906/github-copilot-agent-skills --skill apim-policy-authoring -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/apim-policy-authoring, .gemini/skills/apim-policy-authoring, .github/skills/apim-policy-authoring and .opencode/skills/apim-policy-authoring in your project.
SKILL.md names no scripts, command-line tools or credentials: Azure APIM Policy Authoring is instructions for the agent only. Our summary lists: Azure MCP tools for best practices and documentation; An Azure API Management service to apply the policies to.
SKILL.md names 2 domains. In commands or code: login.microsoftonline.com; the agent is likely to contact it when it follows the instructions. As links in the text: learn.microsoft.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Azure APIM Policy Authoring is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.5k tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Azure APIM Policy Authoring: API Security Design (vinayaklatthe/microsoft-security-skills, 175 stars), Frontmcp Config (agentfront/frontmcp, 146 stars), Discover API (rand/cc-polymath, 181 stars) and Maui Authentication (davidortinau/maui-skills, 175 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
thomast1906 (a GitHub user) maintains it in thomast1906/github-copilot-agent-skills, which has 202 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on October 7, 2026.
Source: thomast1906/github-copilot-agent-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
