[Microsoft.ApiManagement] AI Gateway 2026-09-01-preview: child resources (workspaces, model providers, models, tool servers, API keys)

[Alexander Zaslonov (azaslonov)]

ARM (Control Plane) API Specification Update Pull Request

Tip

Overwhelmed by all this guidance? See the Getting help section at the bottom of this PR description.

PR review workflow diagram

Please understand this diagram before proceeding. It explains how to get your PR approved & merged.

Purpose of this PR

What's the purpose of this PR? Check the specific option that applies. This is mandatory!

• New resource provider.
• New API version for an existing resource provider. (If API spec is not defined in TypeSpec, the PR should have been created in adherence to OpenAPI specs PR creation guidance).
• Update existing version for a new feature. (This is applicable only when you are revising a private preview API version.)
• Update existing version to fix OpenAPI spec quality issues in S360.
• Convert existing OpenAPI spec to TypeSpec spec (do not combine this with implementing changes for a new API version).
• Other, please clarify:
  • edit this with your clarification

Note

Draft. Builds on #45799 (aigateways only) and includes its changes. Review the child resources here after #45799 merges; this branch will then be updated so only the child-resource diff remains.

Adds the AI Gateway child resources to the 2026-09-01-preview API version of Microsoft.ApiManagement (TypeSpec project specification/apimanagement/resource-manager/Microsoft.ApiManagement/AIGateway).

New resource types (all proxy, nested under aigateways):

• aigateways/apiKeys: CRUD, listSecrets, regeneratePrimaryKey, regenerateSecondaryKey.
• aigateways/workspaces: CRUD, list by gateway.
• aigateways/workspaces/modelProviders: CRUD, list by workspace, listCredentials.
• aigateways/workspaces/modelProviders/models: CRUD, list by model provider.
• aigateways/workspaces/models: list models across all providers in a workspace.
• aigateways/workspaces/toolServers: CRUD, list by workspace, listSecrets.

Validation completed locally:

• TypeSpec compile (no warnings) and tsp format
• OAV semantic validation and example validation
• Prettier and cspell

Suppressions:

• TypeSpec: arm-no-record (tool-server headers and OAuth parameters), secret-prop (model counterKey), arm-resource-interface-requires-decorator (cross-provider models list), patch-envelope (sku on aigateways).
• readme.md: ArmResourcePropertiesBag, AvoidAdditionalProperties, EnumInsteadOfBoolean, ProvisioningStateMustBeReadOnly, XMSSecretInResponse, each with a reason.

Due diligence checklist

To merge this PR, you must go through the following checklist and confirm you understood
and followed the instructions by checking all the boxes:

• I confirm this PR is modifying Azure Resource Manager (ARM) related specifications, and not data plane related specifications.
• I have reviewed following Resource Provider guidelines, including
  ARM resource provider contract and
  REST guidelines (estimated time: 4 hours).
  I understand this is required before I can proceed to the diagram Step 2, "ARM API changes review", for this PR.
• A release plan has been created. If not, please create one as it will help guide you through the REST API and SDK creation process.

Additional information

Viewing API changes

For convenient view of the API changes made by this PR, refer to the URLs provided in the table
in the Generated ApiView comment added to this PR. You can use ApiView to show API versions diff.

Suppressing failures

If one or multiple validation error/warning suppression(s) is detected in your PR, please follow the
suppressions guide to get approval.

Getting help

• First, please carefully read through this PR description, from top to bottom. Please fill out the Purpose of this PR and Due diligence checklist.
• If you don't have permissions to remove or add labels to the PR, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories
• To understand what you must do next to merge this PR, see the Next Steps to Merge comment. It will appear within few minutes of submitting this PR and will continue to be up-to-date with current PR state.
• For guidance on fixing this PR CI check failures, see the hyperlinks provided in given failure
  and https://aka.ms/ci-fix.
• For help with ARM review (PR workflow diagram Step 2), see https://aka.ms/azsdk/pr-arm-review.
• If the PR CI checks appear to be stuck in queued state, please add a comment with contents /azp run.
  This should result in a new comment denoting a PR validation pipeline has started and the checks should be updated after few minutes.
• If the help provided by the previous points is not enough, post to https://aka.ms/azsdk/support/specreview-channel and link to this PR.
• For guidance on SDK breaking change review, refer to https://aka.ms/ci-fix.

[azure-pipelines]

Azure Pipelines:
Successfully started running 8 pipeline(s).
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

TypeSpec suppressions requiring review

Status: ❌ Approval required — 2 suppressions

This PR adds or updates the TypeSpec suppressions listed below. Suppressions are strongly discouraged — they bypass linter rules that protect API quality and consistency. Authors should avoid adding new suppressions and prefer fixing the underlying issue; reviewers should approve only when there is a clear, compelling justification and no reasonable alternative. Review each linked rule and source location, then apply typespec-suppressions-approved only if every justification is acceptable. The Status column shows ✅ once the label is applied and ❌ while approval is pending.

New suppressions (2)

Status	Rule	Source	Justification
❌	@azure-tools/typespec-azure-resource-manager/secret-prop RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with Madara (@secret) decorator.	AIGatewayModel.tsp#L141	The counter key selects a public request attribute and is not a credential.
❌	@azure-tools/typespec-azure-resource-manager/secret-prop RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with Madara (@secret) decorator.	AIGatewayModel.tsp#L211	The counter key selects a public request attribute and is not a credential.

For an overview of TypeSpec linting rules click here.
For a mapping from ARM lintdiff rules to corresponding TypeSpec linting rules click here.

💬 Have feedback on the TypeSpec suppression flow? Let us know.

[github-actions]

Package Name Review Required

Plane: Management Plane

Language	Package Name	Namespace	Format	Status	Approvers
dotnet	Azure.ResourceManager.AIGateway	Azure.ResourceManager.AIGateway	✅	⏳ Pending	Arthur Ma (@ArthurMa1978), m-nash, JoshLove-msft
java	com.azure.resourcemanager:azure-resourcemanager-aigateway	com.azure.resourcemanager.aigateway	✅	⏳ Pending	Arthur Ma (@ArthurMa1978), m-nash, JoshLove-msft
python	azure-mgmt-aigateway	azure.mgmt.aigateway	✅	⏳ Pending	Arthur Ma (@ArthurMa1978), m-nash, JoshLove-msft
typescript	@azure/arm-aigateway	@azure/arm-aigateway	✅	⏳ Pending	Arthur Ma (@ArthurMa1978), m-nash, JoshLove-msft
go	sdk/resourcemanager/aigateway/armaigateway	sdk/resourcemanager/aigateway/armaigateway	✅	⏳ Pending	Arthur Ma (@ArthurMa1978), m-nash, JoshLove-msft

How to approve:

• Per language: apply package-name-<language>-approved label
• All at once: apply package-name-approved-all label (shortcut for mgmt plane)

Merge is blocked until all languages are approved.

Approver list: .github/protected-labels.yml
Process: .github/workflows/src/package-name-approval/PACKAGE-NAME-REVIEW-PROCESS.md
Package names extracted via tsp compile with typespec-metadata emitter

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Language	API Review for Package
Swagger	Microsoft.ApiManagement-AIGateway
Java	com.azure.resourcemanager:azure-resourcemanager-aigateway
Go	sdk/resourcemanager/aigateway/armaigateway
JavaScript	@azure/arm-aigateway
Python	azure-mgmt-aigateway

---

Comment generated by After APIView workflow run.

[github-actions]

Next Steps to Merge

Next steps that must be taken to merge this PR:

• ❌ This PR targets either the main branch of the public specs repo or the RPSaaSMaster branch of the private specs repo. These branches are not intended for iterative development. Therefore, you must acknowledge you understand that after this PR is merged, the APIs are considered shipped to Azure customers. Any further attempts at in-place modifications to the APIs will be subject to Azure's versioning and breaking change policies. Additionally, for control plane APIs, you must acknowledge that you are following all the best practices documented by ARM at aka.ms/armapibestpractices. If you do intend to release the APIs to your customers by merging this PR, add the PublishToCustomers label to your PR in acknowledgement of the above. Otherwise, retarget this PR onto a feature branch, i.e. with prefix release- (see aka.ms/azsdk/api-versions#release--branches).
• ❌ This PR has at least one change violating Azure versioning policy (label: VersioningReviewRequired).
  To unblock this PR, either a) introduce a new API version with these changes instead of modifying an existing API version, or b) follow the process at aka.ms/brch.
• ❌ The required check named Swagger BreakingChange has failed. To unblock this PR, follow the process at aka.ms/brch.

Comment generated by summarize-checks workflow run.

[github-actions]

Contributor readiness: required access

Warning

The access issues below can prevent PR approvals from counting or block Azure DevOps pipeline runs.

User / area	Access issue	PR impact
🔴 alzaslon_microsoft	Azure membership not public. No repository write access.	Not determined.

Internal contributors: setup / renew required access. Recheck: /azsdk check-access.

Contributors with verified access (1)

Public Azure membership and repository write access verified.

User	Roles
azaslonov	PR author

Non-blocking report; external fork contributions are allowed. GitHub review rules still apply.

[Alexander Zaslonov (azaslonov)]

Superseded by #47156, which introduces the child resources in 2026-10-01-preview and preserves the merged 2026-09-01-preview gateway-only contract unchanged.