Narrow APIKeyUpdateRequest schema to remove immutable fields from update endpoints
@Arshardh is already working on this.
Since Mar 30, 2026.
- Dominant language
- Go
- Stars
- 71
- Forks
- 111
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 110
Description
Summary
The APIKeyUpdateRequest schema currently inherits from APIKeyCreationRequest (via allOf), which exposes create-only/immutable fields (name, issuer, externalRefId) on update operations. The update flow in the gateway ignores these fields and copies them from the existing key, but the OpenAPI contract incorrectly documents them as writable.
Affected Endpoints
PUT /rest-apis/{id}/api-keys/{apiKeyName}PUT /llm-providers/{id}/api-keys/{apiKeyName}PUT /llm-proxies/{id}/api-keys/{apiKeyName}
Required Changes
- Introduce a dedicated
APIKeyPatchRequestschema (or similar) that omitsname,issuer, andexternalRefId. - Update the
requestBodyschema references for all three update endpoints ingateway/gateway-controller/api/management-openapi.yamlto use the new narrowed schema. - Update the corresponding Go type aliases in
gateway/gateway-controller/pkg/api/management/generated.go(e.g.,UpdateAPIKeyJSONRequestBody,UpdateLLMProviderAPIKeyJSONRequestBody,UpdateLLMProxyAPIKeyJSONRequestBody) to reflect the new schema after regeneration.
Background
This was identified during code review in PR #1567 (adding API key management for LLM entities). Agreed to address in a follow-up PR for consistency across all API key update endpoints.
References:
- PR: https://github.com/wso2/api-platform/pull/1567
- Comment: https://github.com/wso2/api-platform/pull/1567#discussion_r3008377540
- Requested by: @Arshardh
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.