Azure / Azure/azure-rest-api-specs

[BUG]Key Vault Access Policy API returns capitalized permission values (e.g., Get) instead of lowercase (get) as defined in spec

Open
#34,772 0 comments 0 reactions 0 assignees View on GitHub
bug customer-reported KeyVault Mgmt question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

### API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2024-11-01/keyvault.json#L1098

### API Spec version

2024-11-01

### Describe the bug

Description:

When querying Key Vault access policies via the Azure REST API, the permissions fields sometimes return permission values with a capitalized first letter (e.g., Get, List, Set), even though the OpenAPI specification defines these values as lowercase (e.g., get, list, set).

This is inconsistent with the schema defined at:
https://github.com/Azure/azure-rest-api-specs/blob/main/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2024-11-01/keyvault.json#L1098

Impact:
This inconsistency breaks downstream tooling and SDKs that rely on the spec, particularly the Azure Go SDK, which defines permission values as typed constants matching the lowercase enum values. When the API returns capitalized variants like Get, it prevents direct comparison against these constants and introduces case-sensitivity issues in access policy processing.

Request:
Please confirm and address this inconsistency at the API level, or clarify if the spec needs to be updated to allow both cases (ideally not).

### Expected behavior

Expected behavior:
The API should consistently return permission values using lowercase strings, as defined in the OpenAPI schema.

### Actual behavior

Actual behavior:
The API intermittently returns capitalized permission strings such as Get, List, or Delete.

### Reproduction Steps

Steps to reproduce:

Query an existing Key Vault access policy using the Azure REST API.

Observe the permission values in the response.

Compare them to the enum values in the OpenAPI spec.

Example response:

json
Copy
Edit
{
"permissions": {
"keys": ["Get", "List"],
"secrets": ["get", "list"]
}
}

### Environment

Environment:

API Version: 2024-11-01

Observed via: PowerShell, Azure Go SDK and direct REST calls

Contributor guide

Open the contributing guide

Research direction

Inspect specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2024-11-01/keyvault.json around line 1098 and compare the declared permission enum values with the reported REST responses. Determine whether the inconsistency belongs in the API behavior or the specification; done means the API and schema have an agreed, consistent representation for permission values.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.