Repository navigation
[BUG] Publisher fails with LinkedAuthorizationFailed when deploying workspace link resources across environments #853
Description
Release version
APIOps Toolkit for Azure APIM v7.0.2
Describe the bug
All 4 workspace ILinkResource types store a fully-qualified ARM resource ID in their extracted JSON that is specific to the source environment. When the publisher sends these DTOs verbatim to a different target APIM instance, ARM's linked-scope authorization check fails because the embedded path still references the source service.
The affected files and properties are:
| File | Property | REST endpoint |
|---|---|---|
productGroupInformation.json |
groupId |
workspaces/{ws}/products/{p}/groupLinks |
productApiInformation.json |
apiId |
workspaces/{ws}/products/{p}/apiLinks |
tagApiInformation.json |
apiId |
workspaces/{ws}/tags/{t}/apiLinks |
tagProductInformation.json |
productId |
workspaces/{ws}/tags/{t}/productLinks |
Example extracted productGroupInformation.json:
{
"name": "6a02ee928bedff2038e046fb",
"properties": {
"groupId": "/subscriptions/<SOURCE-SUB>/resourceGroups/<SOURCE-RG>/providers/Microsoft.ApiManagement/service/<SOURCE-APIM>/groups/administrators"
}
}The publisher has no compensating logic to rewrite the ARM prefix to the target environment before the PUT.
Expected behavior
The publisher rewrites the absolute ARM prefix in the link body property to the target environment before the PUT.
Actual behavior
Publisher fails with HTTP 403:
LinkedAuthorizationFailed: The client has permission to perform
'workspaces/products/groupLinks/write' on the target scope, but does not have
permission to perform 'service/groups/write' on the linked scope
'.../service/<SOURCE-APIM>/groups/administrators'
or the linked scope is invalid.
Reproduction Steps
- Have two APIM instances with workspaces. Ensure the workspace link does not yet exist in the target.
- In the source, link a workspace product to a group (or API), or a workspace tag to an API or product.
- Run the extractor against the source — the extracted JSON contains an absolute ARM
groupId/apiId/productIdreferencing the source environment. - Run the publisher against the target — it fails with
LinkedAuthorizationFailed403.
Activity
github-actions commentedon May 13, 2026
guythetechie commentedon May 20, 2026
Michel V (@michelversluijs) - the publisher doesn't support rewriting APIM service names in links. It takes a JSON, applies any configuration overrides, and publishes the overridden JSON as-is. There are only two supported workarounds at the moment:
We try to extract relative IDs where possible in v7. Unfortunately, APIM doesn't support relative IDs for certain resources. We explicitly exclude them here:
apiops/src/common/Resource.FileSystem.cs
Line 221 in 64ffee2