[BUG] Publisher sends GraphQL schema to service-level API path instead of workspace path

Open

#861 opened on May 26, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 65/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Quiet
Tech stack: azure, csharp, graphql
Domain: api, cloud

Research direction

Start in the publisher's GraphQL schema PUT path construction and compare it with the workspace-aware API path described in the issue. Reproduce by publishing a GraphQL API in an APIM workspace, then verify the request uses workspaces/{workspaceId}/apis/{apiId}/schemas/graphql and the deployment succeeds without the 403 error.

Written by the indexing model from the issue text.

Description

Release version

APIOps Toolkit for Azure APIM v7.0.2

Describe the bug

When publishing a GraphQL API that belongs to a workspace, the publisher constructs the wrong URI for the GraphQL schema PUT. It targets the service-level API schemas endpoint instead of the workspace-scoped one, causing a 403 AuthorizationFailed error.

The failing request:

PUT .../service/{serviceName}/apis/{apiId}/schemas/graphql

Expected request:

PUT .../service/{serviceName}/workspaces/{workspaceId}/apis/{apiId}/schemas/graphql

Expected behavior

Publisher successfully PUTs the GraphQL schema to workspaces/{workspaceId}/apis/{apiId}/schemas/graphql and the API deploys without error.

Actual behavior

Publisher fails with HTTP 403:

System.Net.Http.HttpRequestException: HTTP request to URI
https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/
Microsoft.ApiManagement/service/{serviceName}/apis/{apiId}/schemas/graphql
?api-version=2024-05-01 failed with status code 403.
Content is '{"error":{"code":"AuthorizationFailed","message":"The client '...'
does not have authorization to perform action
'Microsoft.ApiManagement/service/apis/schemas/write' over scope
'.../service/{serviceName}/apis/{apiId}/schemas/graphql'
or the scope is invalid."}}'.

Reproduction Steps

Create a GraphQL API inside an APIM workspace.
Run the extractor — specification.graphql is written correctly (extractor is unaffected).
Run the publisher against a different environment — it fails with 403.

Dominant language: C#
Stars: 448
Forks: 247
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

CS0162 "Unreachable code detected" warning from a MSBuildTemp .tmp file in every game project Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 90/100

stride3d/stride#3477 · Opened Sep 23, 2026
docs: update contribution guidelines to account for AI-generated contributions Open

Type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

apache/arrow-adbc#4809 · Opened Sep 23, 2026
[quality-improver] CiRunSummaryAggregateReader.ValidateModule provenance cross-check guards are untested on the throwing path Open

type/automation type/tech-debt

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

microsoft/testfx#11477 · Opened Sep 23, 2026
.NET 11 isolated: feed entries using the new `Azure.Functions.Sdk` MSBuild SDK are misdetected as in-process, so no templates are found Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

microsoft/vscode-azurefunctions#5197 · 1 comment · Opened Sep 23, 2026
reactor-build-and-check says mur is 'selfhost only', but mur.exe ships in the same skill-kit zip as that skill Open

Difficulty 1/5 Under an hour Newbie friendliness 85/100

microsoft/microsoft-ui-reactor#1274 · Opened Sep 23, 2026

More C# issues