// Illustrative; not executed against a live workspace. Azure Monitor Logs.
// Adapt this SINGLE-OBJECT route to your API. Lists, GraphQL and exports need application audit.
// dcount is approximate; thresholds identify review candidates, not proven data theft.
let Start = ago(24h);
let End = now();
let TargetResource = "REPLACE_WITH_APIM_RESOURCE_ID";
let TargetApi = "REPLACE_WITH_API_ID";
let ReviewThreshold = 20;
ApiManagementGatewayLogs
| where TimeGenerated between (Start .. End)
| where _ResourceId =~ TargetResource and ApiId == TargetApi
| where Method == "GET" and ResponseCode between (200 .. 299)
| extend ObjectId = extract(@"^/v1/customers/([^/]+)$", 1, tostring(parse_url(Url).Path))
| where isnotempty(ObjectId)
| summarize Requests = count(), ApproxObjects = dcount(ObjectId),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by bin(TimeGenerated, 15m), UserId, ApimSubscriptionId, CallerIpAddress
| where ApproxObjects >= ReviewThreshold
| order by ApproxObjects desc
| take 100