Skip to content

Modify rule TenantLevelAPIsNotAllowed RPC-Uri-V1-11 from ARM error to warning #783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tejaswiMinnu merged 6 commits into from
Aug 18, 2025
Merged

Modify rule TenantLevelAPIsNotAllowed RPC-Uri-V1-11 from ARM error to warning #783

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9839ef2
Removed rule TenantLevelAPIsNotAllowed RPC-Uri-V1-11
tejaswiMinnu Aug 8, 2025
0ad00d7
Revert "Removed rule TenantLevelAPIsNotAllowed RPC-Uri-V1-11"
tejaswiMinnu Aug 12, 2025
6572d6e
Modified rule TenantLevelAPIsNotAllowed RPC-Uri-V1-11 to be a warning
tejaswiMinnu Aug 12, 2025
6d34391
Modified warning text
tejaswiMinnu Aug 12, 2025
b90d6a0
Modified warning text
tejaswiMinnu Aug 13, 2025
12dd9ab
Mispelled
tejaswiMinnu Aug 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 6 additions & 12 deletions docs/rules.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -942,12 +942,6 @@ For more detail, pls refer to https://github.com/microsoft/api-guidelines/blob/v

Please refer to [path-resource-type-name-camel-case.md](./path-resource-type-name-camel-case.md) for details.

### Post201Response

Using post for a create operation is discouraged.

Please refer to [post201-response.md](./post201-response.md) for details.

### PostOperationIdContainsUrlVerb

A POST operation's operationId should contain the verb indicated at the end of the corresponding url.
Expand All @@ -962,6 +956,12 @@ Long-running POST operations must have responses with 202 and default return cod

Please refer to [post-response-codes.md](./post-response-codes.md) for details.

### Post201Response

Using post for a create operation is discouraged.

Please refer to [post201-response.md](./post201-response.md) for details.

### PreviewVersionOverOneYear

Per [Retirement-of-Previews](https://dev.azure.com/msazure/AzureWiki/_wiki/wikis/AzureWiki.wiki/37683/Retirement-of-Previews), service, feature, API, and SKU in preview for over one year need to move to GA or retire.
Expand Down Expand Up @@ -1244,12 +1244,6 @@ Please refer to [system-data-in-properties-bag.md](./system-data-in-properties-b

Please refer to [tags-are-not-allowed-for-proxy-resources.md](./tags-are-not-allowed-for-proxy-resources.md) for details.

### TenantLevelAPIsNotAllowed

Tenant level APIs are strongly discouraged and subscription or resource group level APIs are preferred instead. The reason for this guidance is that tenant level APIs have a really broad scope and blast radius. We permit APIs to be at this broad scope under rare conditions. Some ARM feature sets also do not cover tenant level APIs such as the use of AFEC. Additionally, if you intend to bypass the standard RBAC constructs and make the APIs unauthorized, you will need an approval from the PAS team before the open API spec can be merged.

Please refer to [tenant-level-apis-not-allowed.md](./tenant-level-apis-not-allowed.md) for details.

### TopLevelResourcesListByResourceGroup

Per [ARM guidelines](https://github.com/Azure/azure-resource-manager-rpc/blob/master/v1.0/resource-api-reference.md), all the top-level resources must have a list by resource group operation which returns the collection of the resource.
Expand Down
51 changes: 0 additions & 51 deletions docs/tenant-level-apis-not-allowed.md
View file
Open in desktop

This file was deleted.

12 changes: 12 additions & 0 deletions packages/rulesets/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,17 @@
# Change Log - @microsoft.azure/openapi-validator-rulesets

## 2.1.8

### Patches

- Removed rule TenantLevelAPIsNotAllowed RPC-Uri-V1-11

## 2.1.7

### Patches

- Updated autorest package.json to 2.2.4

## 2.1.6

### Patches
Expand Down
34 changes: 0 additions & 34 deletions packages/rulesets/generated/spectral/az-arm.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2965,28 +2965,6 @@ const tagsAreNotAllowedForProxyResources = (definition, _opts, ctx) => {
return errors;
};

const tenantLevelAPIsNotAllowed = (pathItems, _opts, ctx) => {
if (pathItems === null || typeof pathItems !== "object") {
return [];
}
const path = ctx.path || [];
const apiPaths = Object.keys(pathItems);
if (apiPaths.length < 1) {
return [];
}
const errors = [];
for (const apiPath of apiPaths) {
if (pathItems[apiPath]["put"] && !apiPath.endsWith("/operations") && apiPath.startsWith("/providers")) {
errors.push({
message: `${apiPath} is a tenant level api. Tenant level APIs are strongly discouraged and subscription or resource group level APIs are preferred instead. If you cannot model your APIs at these levels, you will need to present your design and get an exception from PAS team.`,
path: [...path, apiPath],
});
break;
}
}
return errors;
};

const trackedExtensionResourcesAreNotAllowed = (apiPath, _opts, ctx) => {
var _a, _b, _c;
if (apiPath === null || typeof apiPath !== "string") {
Expand Down Expand Up @@ -3974,18 +3952,6 @@ const ruleset = {
function: noDuplicatePathsForScopeParameter,
},
},
TenantLevelAPIsNotAllowed: {
rpcGuidelineCode: "RPC-Uri-V1-11",
description: "Tenant level APIs are strongly discouraged and subscription or resource group level APIs are preferred instead. Design presentation and getting an exception from the PAS team is needed if APIs cannot be modelled at subscription or resource group level.",
message: "{{error}}",
severity: "error",
resolved: true,
formats: [oas2],
given: "$[paths,'x-ms-paths']",
then: {
function: tenantLevelAPIsNotAllowed,
},
},
TrackedExtensionResourcesAreNotAllowed: {
rpcGuidelineCode: "RPC-Uri-V1-12",
description: "Extension resources are always considered to be proxy and must not be of the type tracked.",
Expand Down
2 changes: 1 addition & 1 deletion packages/rulesets/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@microsoft.azure/openapi-validator-rulesets",
"version": "2.1.7",
"version": "2.1.8",
Copy link
Copy Markdown
Member

@AkhilaIlla AkhilaIlla Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we are doing version bump/prod release just for this 1 update?

Copy link
Copy Markdown
Member

@mikeharder mikeharder Aug 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is a shared repo, I think we should use a process where main is always "ready to release":

  1. Release version x.y.z
  2. In next PR to repo, update version to x.y.(z+1), either in a dedicated PR, or along with the next code change. Also update changelog.
  3. After PR is merged, main is "ready to release", but it doesn't mean "must release".
  4. If you don't want to release yet, keep merging more PRs, updating changelog, etc.
  5. If you do want to release, go ahead at any time. The release will include your all changes queued in main since last release.

Copy link
Copy Markdown
Member

@mikeharder mikeharder Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That said, why not be more agile, and publish and update the specs repo after each fix? It should be much easier than before:

  1. Trigger publish of azure-openapi-validator to npmjs
  2. Update package.json files in azure-rest-api-specs (manually or by triggering dependabot)

Copy link
Copy Markdown
Member Author

@tejaswiMinnu tejaswiMinnu Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Mike,
Hey @AkhilaIlla, this code is ready to release so I had to update the package

Copy link
Copy Markdown
Member

@AkhilaIlla AkhilaIlla Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @mikeharder for the details. However, I think we need to have a deeper discussion to figure out the right process for our use case.

Copy link
Copy Markdown
Member

@mikeharder mikeharder Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @mikeharder for the details. However, I think we need to have a deeper discussion to figure out the right process for our use case.

what is your proposed alternative strategy?

"description": "Azure OpenAPI Validator",
"main": "dist/index.js",
"scripts": {
Expand Down
15 changes: 0 additions & 15 deletions packages/rulesets/src/spectral/az-arm.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,6 @@ import { securityDefinitionsStructure } from "./functions/security-definitions-s
import skuValidation from "./functions/sku-validation"
import { systemDataInPropertiesBag } from "./functions/system-data-in-properties-bag"
import { tagsAreNotAllowedForProxyResources } from "./functions/tags-are-not-allowed-for-proxy-resources"
import { tenantLevelAPIsNotAllowed } from "./functions/tenant-level-apis-not-allowed"
import { trackedExtensionResourcesAreNotAllowed } from "./functions/tracked-extension-resources-are-not-allowed"
import trackedResourceTagsPropertyInRequest from "./functions/trackedresource-tags-property-in-request"
import { validQueryParametersForPointOperations } from "./functions/valid-query-parameters-for-point-operations"
Expand Down Expand Up @@ -946,20 +945,6 @@ const ruleset: any = {
function: noDuplicatePathsForScopeParameter,
},
},
// RPC Code: RPC-Uri-V1-11
TenantLevelAPIsNotAllowed: {
rpcGuidelineCode: "RPC-Uri-V1-11",
description:
"Tenant level APIs are strongly discouraged and subscription or resource group level APIs are preferred instead. Design presentation and getting an exception from the PAS team is needed if APIs cannot be modelled at subscription or resource group level.",
message: "{{error}}",
severity: "error",
resolved: true,
formats: [oas2],
given: "$[paths,'x-ms-paths']",
then: {
function: tenantLevelAPIsNotAllowed,
},
},
// RPC Code: RPC-Uri-V1-12
TrackedExtensionResourcesAreNotAllowed: {
rpcGuidelineCode: "RPC-Uri-V1-12",
Expand Down
27 changes: 0 additions & 27 deletions packages/rulesets/src/spectral/functions/tenant-level-apis-not-allowed.ts
View file
Open in desktop

This file was deleted.

115 changes: 0 additions & 115 deletions packages/rulesets/src/spectral/test/tenant-level-apis-not-allowed.test.ts
View file
Open in desktop

This file was deleted.

Loading
⚡