florinbobis/heimdall repository overview

⁠Heimdall

A local, offline emulator of the Azure API Management (APIM) data plane, with a live policy-trace console.

Azure API Management has no official local emulator. Every policy change means a live cloud instance, a deploy, and a guess. Heimdall runs APIM locally: docker run, point it at your policy XML and OpenAPI spec, and the edit-to-test loop drops from minutes to under 2 seconds, fully offline, no Azure account.

It is not a mock. Real C# policy expressions evaluated with Roslyn. Real validate-jwt, rate-limit, set-backend-service, choose/when, caching, named values, subscription keys. For the supported policy set, the gateway behaves like production APIM: same 401/429 shapes, same header/body transforms.

⁠Quickstart

# Run the gateway against a config directory (policy XML + OpenAPI + config.json)
docker run -p 8080:8080 -v "$(pwd)/samples:/config" florinbobis/heimdall --config /config

# Send a request through it
curl -H "Ocp-Apim-Subscription-Key: <key>" http://localhost:8080/catalog/items

# Open the console (live trace, config explorer, request playground)
#   http://localhost:8080/_apim/

⁠What you get

• A real policy engine, not a mock. C# @() expressions compiled and cached with Roslyn; the four-stage pipeline (inbound, backend, outbound, on-error) runs ~25 tier-1 policies with <base/> flattening across global, product, API, and operation scope.
• A live trace console. Watch every request stream across Frontend, Inbound, Backend, Outbound in real time, with per-policy timings, branch decisions, before/after transforms, and a live metrics strip.
• A config explorer and request playground. Browse APIs, products, subscriptions, and named values; import a Postman or .http collection and replay it through the live gateway.
• Loaders for artifacts you already have. Raw policy XML + OpenAPI, or an APIOps v6 extractor folder, the same output your APIM CI/CD produces.
• Fully offline and container-ready. No Azure account, no cloud calls. Single image, with a headless mode for CI.

⁠Supported policies (tier 1)

Control flow choose/when/otherwise, set-variable, include-fragment · Transform set-header, set-body, set-method, rewrite-uri, set-query-parameter, set-backend-service, find-and-replace · Auth/security validate-jwt, check-header, ip-filter, cors · Rate/quota rate-limit, rate-limit-by-key, quota, quota-by-key · Routing/response forward-request, return-response, mock-response, set-status · Caching cache-lookup/cache-store · Subscription keys · Named values {{name}}.

Unsupported policies fail loudly with a clear error, never silently skipped.

⁠Links

• Source and docs: https://github.com/twentytwokhz/heimdall⁠
• License: MIT