services / Azure / APIM product subscriptions

An API Management product subscription binds a user/principal to an API product and holds the gateway API keys that authorize calls to the product's published APIs.

Subscriptions are the access-grant + credential construct of the APIM gateway; the keys themselves are credentials, but the subscription entity (without keys) is access-mapping metadata.

Microsoft.​ApiManagement/​service/​workspaces/​subscriptions/​write

Creating a subscription grants a controlled user authorized access to a product's APIs (a fresh credential binding) and updates subscription state, expanding access without legitimate approval.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links