Azure / Azure/apiops

[BUG] Publisher sends GraphQL schema to service-level API path instead of workspace path

Open
#861 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
448
Forks
247
PR merge metrics
No merged PRs in 30d

Description

### Release version

APIOps Toolkit for Azure APIM v7.0.2

### Describe the bug

When publishing a GraphQL API that belongs to a workspace, the publisher constructs the wrong URI for the GraphQL schema PUT. It targets the service-level API schemas endpoint instead of the workspace-scoped one, causing a 403 `AuthorizationFailed` error.

The failing request:
```
PUT .../service/{serviceName}/apis/{apiId}/schemas/graphql
```

Expected request:
```
PUT .../service/{serviceName}/workspaces/{workspaceId}/apis/{apiId}/schemas/graphql
```

### Expected behavior

Publisher successfully PUTs the GraphQL schema to `workspaces/{workspaceId}/apis/{apiId}/schemas/graphql` and the API deploys without error.

### Actual behavior

Publisher fails with HTTP 403:

```
System.Net.Http.HttpRequestException: HTTP request to URI
https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/
Microsoft.ApiManagement/service/{serviceName}/apis/{apiId}/schemas/graphql
?api-version=2024-05-01 failed with status code 403.
Content is '{"error":{"code":"AuthorizationFailed","message":"The client '...'
does not have authorization to perform action
'Microsoft.ApiManagement/service/apis/schemas/write' over scope
'.../service/{serviceName}/apis/{apiId}/schemas/graphql'
or the scope is invalid."}}'.
```

### Reproduction Steps

1. Create a GraphQL API inside an APIM workspace.
2. Run the extractor — `specification.graphql` is written correctly (extractor is unaffected).
3. Run the publisher against a different environment — it fails with 403.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.