Azure API Management domain verification

To verify a domain hosted on Azure API Management (APIM), typically on azure-api.net, for a pentest, complete the steps below.

APIM does not let you upload static files directly, so instead of hosting an aikido.txt file you configure an inbound policy that returns the verification token when Aikido requests /aikido.txt.

1

Start the verification process

Go to the final step of the pentest onboarding flow, where you can configure domain verification.

2

Click verify

Find your Azure APIM domain and click Verify. This starts the file upload verification flow.

3

Copy the verification code

Copy the verification code shown in Aikido. You will paste this code into the APIM policy in the next step.

4

Add an inbound policy to your API

In the Azure portal, open your API Management instance, go to APIs, select the API that serves the domain you want to verify, and open the Design tab. In the Inbound processing section, click the code editor (</>) and replace the policy with the snippet below.

Replace AIKIDO_DOMAIN_VALIDATION_TOKEN_HERE with the verification code you copied from Aikido.

<policies>
  <inbound>
    <base />
    <choose>
      <when condition="@(context.Request.OriginalUrl.Path == "/aikido.txt")">
        <return-response>
          <set-status code="200" reason="OK" />
          <set-header name="Content-Type" exists-action="override">
            <value>text/plain</value>
          </set-header>
          <set-body>AIKIDO_DOMAIN_VALIDATION_TOKEN_HERE</set-body>
        </return-response>
      </when>
    </choose>
  </inbound>
  <backend>
    <base />
  </backend>
  <outbound>
    <base />
  </outbound>
</policies>

Save the policy so it takes effect.

5

Successful validation

If the validation succeeds, you will see a confirmation toast in Aikido. You can then remove the <when> block from the policy if you no longer need it.