API Management removes existing security schemes from OpenAPI spec

Question

When importing an OpenAPI specification into API Management, the existing securitySchemes is replaced, removing existing keys.

For example, given the following securitySchemes definition...

"securitySchemes": {
  "ApiKey": {
    "type": "apiKey",
    "description": "The API key to access the API",
    "name": "Authorization",
    "in": "header"
  }
}

If the spec is imported into API Management, and then exported, the securitySchemes is changed to...

"securitySchemes": {
    "apiKeyHeader": {
        "type": "apiKey",
        "name": "Ocp-Apim-Subscription-Key",
        "in": "header"
    },
    "apiKeyQuery": {
        "type": "apiKey",
        "name": "subscription-key",
        "in": "query"
    }
}

"ApiKey" is removed.

Is there some way to change the original spec, to indicate to API Management that "ApiKey" should be retained, in addition to the new keys?

This is confusing for developers who want to consume the API, as looking at the spec alone, there is no way to know that they need to provide that additional Authorization header to authenticate to the back-end service.

Answer 1

@Eugene O'Brien Thanks for your patience! When importing an OpenAPI specification into APIM, the securitySchemes section is replaced with APIM's default settings. This behavior is a known limitation and is documented in the official API Management documentation.

please refer: https://learn.microsoft.com/en-us/azure/api-management/api-management-api-import-restrictions

Currently, the product does not support editing the components part for securitySchemes during import or export operations. As a result, any custom securitySchemes defined in the original OpenAPI specification may be overwritten.

please feel free to leave your feedback at aka.ms/apimwish.

do let me know incase of further queries, I would be happy to assist you.