A2A managed endpoint returns empty/404 while runtime endpoint works

Summary

The APIM-managed A2A endpoint path (/ks/a2a-managed) appears non-functional in our current configuration, while the policy-backed runtime path (/ks/a2a-weather) works reliably.

Environment

• Repo: Azure/apiops-cli
• APIM target service: bvt-7i6mlsfka5aec-tgt-apim
• API: src-a2a-weather-agent (type a2a)
• API version: 2025-09-01-preview

Current Config (deployed)

src-a2a-weather-agent on target shows:

• properties.path = ks/a2a-managed
• a2aProperties.agentCardBackendUrl = https://bvt-7i6mlsfka5aec-tgt-apim.azure-api.net/ks/a2a-weather/.well-known/agent-card.json
• jsonRpcProperties.backendUrl = https://bvt-7i6mlsfka5aec-tgt-apim.azure-api.net
• jsonRpcProperties.path = /ks/a2a-weather

Operation resources also exist on the managed API:

• GET /.well-known/agent-card.json
• POST /
  with policy present for get-agent-card.

Repro

1. Publish extracted artifacts with bvt-target.overrides.yaml.
2. Call managed URL:
   • GET https://bvt-7i6mlsfka5aec-tgt-apim.azure-api.net/ks/a2a-managed/.well-known/agent-card.json
   • POST https://bvt-7i6mlsfka5aec-tgt-apim.azure-api.net/ks/a2a-managed with valid JSON-RPC body.
3. Call runtime URL:
   • GET https://bvt-7i6mlsfka5aec-tgt-apim.azure-api.net/ks/a2a-weather/.well-known/agent.json
   • POST https://bvt-7i6mlsfka5aec-tgt-apim.azure-api.net/ks/a2a-weather

Actual

• Managed endpoint:
  • GET /ks/a2a-managed/.well-known/agent-card.json => 200 with empty body
  • POST /ks/a2a-managed => 404 Resource not found
• Runtime endpoint:
  • Returns valid agent card and JSON-RPC responses.

Expected

Managed endpoint should be fully usable for discovery + invocation:

• Non-empty agent-card JSON on managed card route
• JSON-RPC request should route and return valid task response on managed root

Impact

• APIM UI suggests using managed A2A URL, but runtime behavior requires using /ks/a2a-weather.
• Causes confusion for Foundry/tool onboarding and demo instructions.

Notes / Potential Direction

A robust architecture likely requires a2a-managed pointing to an external runtime backend (App Service/Function/Container App) rather than APIM self-referencing paths, to avoid internal routing/preview gaps.