Detects when the same API Management subscription key (apim_subscription_id) is used from source IPs in two or more countries within a lookback window that implies impossible travel (distance between first and last geo-locations >= 500 km and inferred travel speed >= 800 km/h). The rule groups events by apim_subscription_id, api_id, operation_id, resource name, and URL, requiring a non-null subscription key and available client IP and geo data. It computes first/last geolocations, distance, time window, and travel speed, and triggers when at least two distinct countries are observed with the distance and speed thresholds. The alert body includes subscription ID, API, operation, resource, domain/path, source IP, and supporting values such as geo details and user agent. It relies on Microsoft Foundry integration collecting Azure API Management GatewayLogs with the client IP; logs are ingested from an Event Hub and must include source.ip and source.geo.location. The rule is intended to surface credential abuse or token misuse across geographies, supporting triage with detailed fields for investigation. Triage steps emphasize confirming legitimacy of distant IPs, reviewing token usage, and regenerating the subscription key if unauthorized. False positives include legitimate use from a VPN/cloud egress or a single shared key used across multiple countries. The rule maps to MITRE ATT&CK techniques (T1528 Steal Application Access Token; T1078 Valid Accounts in cloud accounts) and MITRE ATLAS techniques (AML.T0091 Use Alternate Authentication Material; AML.T0012 Valid Accounts; AML.TA0004 Initial Access; AML.TA0015 Lateral Movement). Setup notes specify enabling Foundry integration, using GatewayLogs category, and capturing source IP and source geo data for distance calculations.