APIM custom domain disappearing after added

Hi Zack H,

Thanks for reaching out to Microsoft Q&A.

Please share below details:

• What APIM tier you’re on?
• Is it your first custom gateway hostname or a second one?
• Any errors in the Activity Log or portal notification
• On the Custom domains blade, after you fill in Hostname, PFX and password, you must click Add (for the endpoint) and then Save (top of the page). If you navigate away or refresh without hitting Save, the entry is discarded.

1. Basicv2 (I've added a custom domain to another environment that was also Basicv2 without issues)
2. It is the first custom domain hostname. there is also built-in gateway with a different hostname
3. No errors relating to the update/add. there is one that says Failed for "CALL MANAGEMENT API" with this but it might be unrelated.

      Request processing failed due to internal error.
   

   4. Yes I do click Add then Save.

In most cases, this issue occurs because the certificate isn’t in the correct format.

• The certificate must be a PFX containing the full chain and private key (not just the server certificate).
• It must use RSA (2048 or 4096 bits); ECC certificates are not supported.
• The PFX must be password-protected.
• The domain name must match the CN or SAN in the certificate.
• Custom domains are not supported on the Consumption tier.

Possible Fix Steps:

Re-export your SSL certificate properly:

Using Windows:

Import the certificate (with private key) into the Windows certificate store.

1. Open MMC =>Certificates =>Personal =>Certificates.
2. Right-click your certificate =>All Tasks =>Export.
3. Choose Yes, export the private key.
4. Select Include all certificates in the certification path.
5. Export as .pfx with a strong password.

Using OpenSSL (Bash):

openssl pkcs12 -export -out cert_bundle.pfx \
  -inkey your_domain.key \
  -in your_domain.crt \
  -certfile intermediate.crt

This ensures the PFX meets APIM requirements and should prevent the custom domain from disappearing after adding it.

Try via CLI/ARM if the portal still drops it:

   az apim update \
  --name MyApimService \
  --resource-group MyRG \
  --set hostnameConfigurations='[{
    "type":"Proxy",
    "hostName":"api.contoso.com",
    "certificate":{
      "encodedCertificate":"<base64-pfx>",
      "certificatePassword":"<your-password>"
    }
  }]'

I've re-exported it and it is still dropping from the portal. I checked Activity Log and see this in the JSON on error Failed for "CALL MANAGEMENT API".

 "errorMessage": "{\"error\":{\"code\":\"MethodNotAllowedInPricingTier\",\"message\":\"Method not allowed in BasicV2 pricing tier\",\"details\":null}}",

Tried using powershell and get a similar error:
Code: OperationSupportedInSkuForApiVersions

Message: Operation on BasicV2 SKU is only supported in the api-versions 2023-03-01-preview,2023-05-01-preview,2023-09-01-preview,2024-05-01,2024-06-01-preview,2024-10-01-preview,2025-03-01-preview,2025-09-01-preview.

Our Dev environment is also Basicv2 and did not give these errors when doing the same process.

"errorMessage": "{\"error\":{\"code\":\"MethodNotAllowedInPricingTier\",\"message\":\"Method not allowed in BasicV2 pricing tier\",\"details\":null}}",

The above error occurs because the method you're calling isn’t allowed in BasicV2 at the API version you’re using. Dev worked likely because it used a supported API version. The error is coming before the API even executes, meaning it’s a tier limitation, not a syntax or configuration problem.

Code: OperationSupportedInSkuForApiVersions

• PowerShell is explicitly telling which API versions support this operation on BasicV2.
• If you're using an older or different API version in the call, it will fail, even if the operation works in higher SKUs like Standard or Enterprise.

Use one of the supported API versions listed in the error (2024-05-01, 2024-06-01-preview, etc.) or upgrade your SKU to Standard or higher.