Azure / Azure/azure-rest-api-specs
[BUG]Key Vault Access Policy API returns capitalized permission values (e.g., Get) instead of lowercase (get) as defined in spec
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 444
Description
### API Spec link
https://github.com/Azure/azure-rest-api-specs/blob/main/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2024-11-01/keyvault.json#L1098
### API Spec version
2024-11-01
### Describe the bug
Description:
When querying Key Vault access policies via the Azure REST API, the permissions fields sometimes return permission values with a capitalized first letter (e.g., Get, List, Set), even though the OpenAPI specification defines these values as lowercase (e.g., get, list, set).
This is inconsistent with the schema defined at:
https://github.com/Azure/azure-rest-api-specs/blob/main/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2024-11-01/keyvault.json#L1098
Impact:
This inconsistency breaks downstream tooling and SDKs that rely on the spec, particularly the Azure Go SDK, which defines permission values as typed constants matching the lowercase enum values. When the API returns capitalized variants like Get, it prevents direct comparison against these constants and introduces case-sensitivity issues in access policy processing.
Request:
Please confirm and address this inconsistency at the API level, or clarify if the spec needs to be updated to allow both cases (ideally not).
### Expected behavior
Expected behavior:
The API should consistently return permission values using lowercase strings, as defined in the OpenAPI schema.
### Actual behavior
Actual behavior:
The API intermittently returns capitalized permission strings such as Get, List, or Delete.
### Reproduction Steps
Steps to reproduce:
Query an existing Key Vault access policy using the Azure REST API.
Observe the permission values in the response.
Compare them to the enum values in the OpenAPI spec.
Example response:
json
Copy
Edit
{
"permissions": {
"keys": ["Get", "List"],
"secrets": ["get", "list"]
}
}
### Environment
Environment:
API Version: 2024-11-01
Observed via: PowerShell, Azure Go SDK and direct REST calls
Contributor guide
Research direction
Inspect specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2024-11-01/keyvault.json around line 1098 and compare the declared permission enum values with the reported REST responses. Determine whether the inconsistency belongs in the API behavior or the specification; done means the API and schema have an agreed, consistent representation for permission values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100