wso2 / wso2/api-platform

Narrow APIKeyUpdateRequest schema to remove immutable fields from update endpoints

Open
#1,579 0 comments 0 reactions 1 assignee View on GitHub

@Arshardh is already working on this.

Since Mar 30, 2026.

Dominant language
Go
Stars
71
Forks
111
Avg merge
1d 14h
Merged PRs (30d)
110

Description

Summary

The APIKeyUpdateRequest schema currently inherits from APIKeyCreationRequest (via allOf), which exposes create-only/immutable fields (name, issuer, externalRefId) on update operations. The update flow in the gateway ignores these fields and copies them from the existing key, but the OpenAPI contract incorrectly documents them as writable.

Affected Endpoints

  • PUT /rest-apis/{id}/api-keys/{apiKeyName}
  • PUT /llm-providers/{id}/api-keys/{apiKeyName}
  • PUT /llm-proxies/{id}/api-keys/{apiKeyName}

Required Changes

  1. Introduce a dedicated APIKeyPatchRequest schema (or similar) that omits name, issuer, and externalRefId.
  2. Update the requestBody schema references for all three update endpoints in gateway/gateway-controller/api/management-openapi.yaml to use the new narrowed schema.
  3. Update the corresponding Go type aliases in gateway/gateway-controller/pkg/api/management/generated.go (e.g., UpdateAPIKeyJSONRequestBody, UpdateLLMProviderAPIKeyJSONRequestBody, UpdateLLMProxyAPIKeyJSONRequestBody) to reflect the new schema after regeneration.

Background

This was identified during code review in PR #1567 (adding API key management for LLM entities). Agreed to address in a follow-up PR for consistency across all API key update endpoints.

References:

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.