Skip to content

APIM policy: per-tenant token limit and token metric

Used by PB-AGT-11-02.

Apply at product scope, with one product per tenant tier. Each tenant has one APIM subscription in exactly one tier product. Limits come from APIM named values, so a tier change never edits this XML. Copy the policy for each tier and change only the two named values.

Both policies belong in the inbound section. llm-emit-token-metric is not valid in outbound. Keep the elements in the order the policy reference gives.

<policies>
  <inbound>
    <base />
    <llm-token-limit
        counter-key="@(context.Subscription.Id)"
        tokens-per-minute="{{tenant-tpm-standard}}"
        token-quota="{{tenant-quota-standard}}"
        token-quota-period="Monthly"
        estimate-prompt-tokens="true"
        remaining-tokens-header-name="x-remaining-tokens"
        remaining-quota-tokens-header-name="x-remaining-quota-tokens" />
    <llm-emit-token-metric namespace="agent-tokens">
      <dimension name="Subscription ID" />
      <dimension name="Product ID" />
      <dimension name="API ID" />
    </llm-emit-token-metric>
  </inbound>
  <backend>
    <base />
  </backend>
  <outbound>
    <base />
  </outbound>
  <on-error>
    <base />
  </on-error>
</policies>

Notes:

  • Subscription ID, Product ID and API ID are default dimension names, so they need no value. The policy allows at most 5 custom dimensions.
  • Each dimension tracks at most 100 unique values, and each namespace at most 1,000 active time series. Data beyond that is silently discarded. With more than 100 tenant subscriptions, the Subscription ID metric is incomplete; report chargeback from gateway logs instead.
  • token-quota-period="Monthly" is a fixed window that resets at the start of the UTC month.
  • On v2 tiers, keep tokens-per-minute identical wherever the same counter-key is used at more than one scope.