[Microsoft.ApiManagement] AI Gateway 2026-11-01

[Alexander Zaslonov (azaslonov)]

ARM (Control Plane) API Specification Update Pull Request

Tip

Overwhelmed by all this guidance? See the Getting help section at the bottom of this PR description.

PR review workflow diagram

Please understand this diagram before proceeding. It explains how to get your PR approved & merged.

Purpose of this PR

What's the purpose of this PR? Check the specific option that applies. This is mandatory!

• New resource provider.
• New API version for an existing resource provider. (If API spec is not defined in TypeSpec, the PR should have been created in adherence to OpenAPI specs PR creation guidance).
• Update existing version for a new feature. (This is applicable only when you are revising a private preview API version.)
• Update existing version to fix OpenAPI spec quality issues in S360.
• Convert existing OpenAPI spec to TypeSpec spec (do not combine this with implementing changes for a new API version).
• Other, please clarify:
  • edit this with your clarification

Note

Draft. Supersedes #46997 and builds on merged #45799.

Adds stable API version 2026-11-01 to the Microsoft.ApiManagement AI Gateway TypeSpec project. The merged 2026-09-01-preview gateway-only OpenAPI and examples remain unchanged.

Resource types and operations introduced in November:

• aigateways/apiKeys: CRUD/list, listSecrets, regeneratePrimaryKey, regenerateSecondaryKey.
• aigateways/workspaces: predefined default workspace with GET, HEAD, and policy-only PATCH.
• aigateways/workspaces/modelProviders: CRUD, list by workspace, listCredentials.
• aigateways/workspaces/modelProviders/models: CRUD, list by model provider.
• aigateways/workspaces/models: list models across all providers in a workspace.
• aigateways/workspaces/toolServers: CRUD, list by workspace, listSecrets, and endpoint OAuth login-link retrieval.
• aigateways/workspaces/aliases: CRUD and list by workspace.
• aigateways/workspaces/telemetryExporters: CRUD and list by workspace.
• Location-scoped gateway name availability.

November carries forward all reviewed gateway and child-resource models, operations, and properties. Child models and interfaces are gated at November; existing wire contracts, secret visibility, and client customizations are preserved. November is the stable API version and default AutoRest tag (package-2026-11-01), with the September preview and its tag retained.

Local validation:

• TypeSpec 1.17.0 main/client compilation and stable OpenAPI generation complete without diagnostics.
• All 15 September tracked OpenAPI/example files remain unchanged.
• November stable OpenAPI preserves the complete reviewed child-resource contract after API-version normalization.
• All 60 November source examples and generated copies preserve their payloads after version-only retargeting; OAV semantic and example validation pass.
• Local Azure validation against the stable tag reports 0 errors and the 1 existing EnumInsteadOfBoolean warning.
• TypeSpec, JSON, README, and service-manifest formatting, version-reference checks, and whitespace checks pass.
• MCP validation was not run, per the existing authoring workflow preference.

Retained suppressions:

• TypeSpec: secret-prop on the non-secret counterKey; arm-resource-interface-requires-decorator on the cross-provider model list.
• AutoRest: all existing suppression rules and justifications are preserved and scoped to the November stable tag.

Due diligence checklist

To merge this PR, you must go through the following checklist and confirm you understood
and followed the instructions by checking all the boxes:

• I confirm this PR is modifying Azure Resource Manager (ARM) related specifications, and not data plane related specifications.
• I have reviewed following Resource Provider guidelines, including
  ARM resource provider contract and
  REST guidelines (estimated time: 4 hours).
  I understand this is required before I can proceed to the diagram Step 2, "ARM API changes review", for this PR.
• A release plan has been created. If not, please create one as it will help guide you through the REST API and SDK creation process.

Additional information

Viewing API changes

For convenient view of the API changes made by this PR, refer to the URLs provided in the table
in the Generated ApiView comment added to this PR. You can use ApiView to show API versions diff.

Suppressing failures

If one or multiple validation error/warning suppression(s) is detected in your PR, please follow the
suppressions guide to get approval.

Getting help

• First, please carefully read through this PR description, from top to bottom. Please fill out the Purpose of this PR and Due diligence checklist.
• If you don't have permissions to remove or add labels to the PR, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories
• To understand what you must do next to merge this PR, see the Next Steps to Merge comment. It will appear within few minutes of submitting this PR and will continue to be up-to-date with current PR state.
• For guidance on fixing this PR CI check failures, see the hyperlinks provided in given failure
  and https://aka.ms/ci-fix.
• For help with ARM review (PR workflow diagram Step 2), see https://aka.ms/azsdk/pr-arm-review.
• If the PR CI checks appear to be stuck in queued state, please add a comment with contents /azp run.
  This should result in a new comment denoting a PR validation pipeline has started and the checks should be updated after few minutes.
• If the help provided by the previous points is not enough, post to https://aka.ms/azsdk/support/specreview-channel and link to this PR.
• For guidance on SDK breaking change review, refer to https://aka.ms/ci-fix.

[github-actions]

Next Steps to Merge

Next steps that must be taken to merge this PR:

• ❌ This PR targets either the main branch of the public specs repo or the RPSaaSMaster branch of the private specs repo. These branches are not intended for iterative development. Therefore, you must acknowledge you understand that after this PR is merged, the APIs are considered shipped to Azure customers. Any further attempts at in-place modifications to the APIs will be subject to Azure's versioning and breaking change policies. Additionally, for control plane APIs, you must acknowledge that you are following all the best practices documented by ARM at aka.ms/armapibestpractices. If you do intend to release the APIs to your customers by merging this PR, add the PublishToCustomers label to your PR in acknowledgement of the above. Otherwise, retarget this PR onto a feature branch, i.e. with prefix release- (see aka.ms/azsdk/api-versions#release--branches).
• ❌ This PR is in purview of the ARM review (label: ARMReview). This PR must get ARMSignedOff label from an ARM reviewer.
  This PR has ARMChangesRequested label. Please address or respond to feedback from the ARM API reviewer.
  When you are ready to continue the ARM API review, please remove the ARMChangesRequested label.
  Automation should then add WaitForARMFeedback label.
  ❗If you don't have permissions to remove the label, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories.
  For details of the ARM review, see aka.ms/azsdk/pr-arm-review
  

Comment generated by summarize-checks workflow run.

[github-actions]

Contributor readiness: required access

Warning

Access issues can block approvals, Azure DevOps pipelines, or labeling.

User / area	Access issue	PR impact
🔴 alzaslon_microsoft	Azure membership not public. No repository write access.	Not determined.

Internal contributors: set up / renew access. Recheck: /azsdk check-access.

Contributors with verified access (1)

Public Azure membership and repository write access verified.

User	Roles
azaslonov	PR author

Non-blocking check; fix access issues to unblock affected actions.

Last updated: 2026-10-18T05:58:47.753Z

[github-actions]

TypeSpec suppressions requiring review

Status: ❌ Approval required — 9 suppressions

This PR adds or updates the TypeSpec suppressions listed below. Suppressions are strongly discouraged — they bypass linter rules that protect API quality and consistency. Authors should avoid adding new suppressions and prefer fixing the underlying issue; reviewers should approve only when there is a clear, compelling justification and no reasonable alternative. Review each linked rule and source location, then apply typespec-suppressions-approved only if every justification is acceptable. The Status column shows ✅ once the label is applied and ❌ while approval is pending.

New suppressions (9)

Status	Rule	Source	Justification
❌	@azure-tools/typespec-azure-resource-manager/arm-no-record Don't use Record types for ARM resources.	AIGatewayModel.tsp#L259	Existing functionality with heavy usage relies on the current string-dictionary contract for literal non-secret HTTP headers. Changing its JSON object shape would break existing customer integrations; exception approval is required.
❌	@azure-tools/typespec-azure-resource-manager/arm-no-record Don't use Record types for ARM resources.	AIGatewayModel.tsp#L273	Existing functionality with heavy usage relies on the current string-dictionary contract for literal non-secret HTTP headers. Changing its JSON object shape would break existing customer integrations; exception approval is required.
❌	@azure-tools/typespec-azure-resource-manager/arm-no-record Don't use Record types for ARM resources.	AIGatewayModel.tsp#L161	Existing functionality with heavy usage relies on the current string-dictionary contract for token claims. Changing its JSON object shape would break existing customer integrations; exception approval is required.
❌	@azure-tools/typespec-azure-resource-manager/arm-no-record Don't use Record types for ARM resources.	AIGatewayTelemetryExporter.tsp#L60	Existing functionality with heavy usage relies on the current string-dictionary contract for secret telemetry headers. Changing its JSON object shape would break existing customer integrations; exception approval is required.
❌	@azure-tools/typespec-azure-resource-manager/arm-no-record Don't use Record types for ARM resources.	AIGatewayModel.tsp#L371	Existing functionality with heavy usage relies on the current string-dictionary contract for literal non-secret HTTP headers. Changing its JSON object shape would break existing customer integrations; exception approval is required.

Showing 5 of 9 suppressions. See the full analysis log for the complete list.

For an overview of TypeSpec linting rules click here.
For a mapping from ARM lintdiff rules to corresponding TypeSpec linting rules click here.

💬 Have feedback on the TypeSpec suppression flow? Let us know.

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Language	API Review for Package
Swagger	Microsoft.ApiManagement-AIGateway
Go	sdk/resourcemanager/aigateway/armaigateway
Python	azure-mgmt-aigateway
JavaScript	@azure/arm-aigateway
Java	com.azure.resourcemanager:azure-resourcemanager-aigateway

---

Comment generated by After APIView workflow run.

[github-actions]

ARM API Review Summary

Reviewed PR #47156 at head SHA 738c96d7504eadd28c79740d2ee5f63b4ddb1563 | Triggered by: pull_request

Approval labels observed: API Management, WaitForARMFeedback, ARMReview, resource-manager, SuppressionReviewRequired, new-api-version, TypeSpec, typespec-suppressions-review-required; no Approved-Suppression, Approved-TypeSpecSuppression, breaking-change approval, or versioning approval label.

Category	Count
🔴 Blocking	1
🟠 Warning	2
🔵 Suggestion	0

The blocking issue is AiGatewayAliasTarget.resourceId modeled as plain string instead of a constrained armResourceIdentifier; the warnings are pending review of 11 TypeSpec suppressions and 9 version-scoped readme suppressions, including warning suppressions. The independent critic confirmed the blocking finding and the suppression counts at the pinned SHA; prior discussion surfaces contained no existing ARM finding threads.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: blocking | classification: new | critic: pass | head-sha: 738c96d

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review Summary

Reviewed PR #47156 at head SHA 8a815bc3bb9117d5e1ccf79fc4e246e0f3298bc9 | Triggered by: pull_request

Scoped review: 50 of 129 changed specification/ files reviewed (PR exceeds the automated-review size cap). Not reviewed: the remaining example-heavy and lower-risk generated/configuration files.

Approval labels observed: API Management, WaitForARMFeedback, ARMReview, resource-manager, SuppressionReviewRequired, new-api-version, TypeSpec, ARMModelingAutoSignedOff, typespec-suppressions-review-required, ARMManualSignoffRequired.

Category	Count
🔴 Blocking	4
🟠 Warning	2
🔵 Suggestion	0

The four existing unresolved blocking findings remain applicable and critic-verified: secret-bearing API-key, model-provider, tool-server, and telemetry exporter fields lack create/update-only visibility and remain in ordinary resource response schemas; two suppression-approval items remain warnings.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: blocking | classification: new | critic: pass | head-sha: 8a815bc

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review

Posting findings from the ARM API Reviewer agent (critic-verified, 1 iteration) against commit 8a815bc3bb9117d5e1ccf79fc4e246e0f3298bc9. Four currently applicable blocking findings are already present in unresolved inline discussions: API-key secrets, model-provider credentials, tool-server secrets, and telemetry exporter secrets remain reachable from ordinary GET/PUT/PATCH resource schemas. No duplicate inline comments were posted; see the existing inline discussions for findings 1-4.

Approval labels observed: API Management, WaitForARMFeedback, ARMReview, resource-manager, SuppressionReviewRequired, new-api-version, TypeSpec, ARMModelingAutoSignedOff, typespec-suppressions-review-required, ARMManualSignoffRequired.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: blocking | classification: new | critic: pass | head-sha: 8a815bc

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review Summary

Reviewed PR #47156 at head SHA 05444c004c1e4a01454438333c9410b975374e18 | Triggered by: pull_request

Scoped review: 47 of 129 changed specification/ files reviewed (PR exceeds the automated-review size cap). Not reviewed: duplicate source-example trees, lower-risk example-only files, and files outside the selected high-risk TypeSpec/generated-contract/configuration subset.

Approval labels observed: none.

Category	Count
🔴 Blocking	0
🟠 Warning	2
🔵 Suggestion	0

No blocking API-contract issues remain at this head; existing suppression-approval warnings remain for the package/readme suppressions and the TypeSpec secret-prop suppressions.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: warning | classification: existing | critic: pass | head-sha: 05444c0

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review Summary

Reviewed PR #47156 at head SHA 05444c004c1e4a01454438333c9410b975374e18 | Triggered by: pull_request

Scoped review: 47 of 129 changed specification/ files reviewed (PR exceeds the automated-review size cap). Not reviewed: duplicate source-example trees, lower-risk example-only files, and files outside the selected high-risk TypeSpec/generated-contract/configuration subset.

Approval labels observed: none.

Category	Count
🔴 Blocking	0
🟠 Warning	2
🔵 Suggestion	0

No blocking API-contract issues remain at this head. Existing warnings remain for approval of the October-scoped package/readme suppressions and TypeSpec suppressions; historical ARM resource-reference, secret-visibility, and immutable-property findings are fixed and were not duplicated.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: warning | classification: existing | critic: pass | head-sha: 05444c0

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review

Posting findings from the ARM API Reviewer agent (critic-verified, 3 iterations, no standalone findings) against commit 05444c004c1e4a01454438333c9410b975374e18. All findings are reported in the summary comment.

Approval labels observed: none.

The independent critic confirmed no currently applicable Blocking API-contract issue. Two existing Warning process gates remain covered by prior discussions: October-scoped package/readme suppressions and TypeSpec suppression review. Historical ARM resource-reference, secret-visibility, and immutable-property findings are fixed at this head and were not reposted.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: warning | classification: existing | critic: pass | head-sha: 05444c0

🔍 ARM API review by ARM API Review: Automated Workflow

[Ravi Eda (ravimeda)]

ARM API Review

Posting findings from the ARM API Reviewer agent (critic-verified, 2 iteration(s), converged) against commit 05444c0. See inline comments for findings 1-8.

Approval labels observed: none.

[github-actions]

ARM API review

Scoped review completed for PR #47156 at head 9e7a31e632ad98283c1a5c75f4863885f1946d9c. The PR exceeds the automated full-review limits (136 specification files; 6,418 changed specification lines), so the review covered the highest-risk AI Gateway TypeSpec sources, generated 2026-10-01-preview OpenAPI, configuration, examples, base-version deltas, and all existing discussion surfaces.

Result: no currently applicable blocking ARM API contract findings. The ARM API Review Critic independently verified that historical resource-ID, secret-visibility, immutable-PATCH, check-name, and nested-resource findings are fixed at this head and were not duplicated. Existing review threads were reconciled; remaining suppression discussions are covered by prior threads and are process gates, not new semantic findings.

Approval context: SuppressionReviewRequired and typespec-suppressions-review-required remain present, while no applicable Approved-Suppression or Approved-TypeSpecSuppression label was observed. No approval label is required for the clean semantic result; the existing suppression approval process remains outstanding.

posted-by: arm-api-reviewer-agent | rule: summary | category: summary | severity: warning | classification: existing | critic: pass | head-sha: 9e7a31e

🔍 ARM API review by ARM API Review: Automated Workflow

[Ravi Eda (ravimeda)]

ARM API Review

Posting findings from the ARM API Reviewer agent (critic-verified, 2 iteration(s), converged) against commit 9e7a31e. See inline comments for findings 1-2.

Approval labels observed: none.

[Ravi Eda (ravimeda)]

[NEW] 🔴 Blocking [ARM Section 2.6] AIGatewayModelProvider.tsp — line 177 — Provider and telemetry-exporter kind are inside the properties bag.

Classification reasoning: Both resource types and their kind properties are new in October; neither exists in the September API at the pinned base SHA.

Issue: AiGatewayModelProviderProperties.kind emits $.definitions.AiGatewayModelProviderProperties.properties.kind (openapi.json line 4946). AiGatewayTelemetryExporterProperties.kind has the same placement (AIGatewayTelemetryExporter.tsp line 162; $.definitions.AiGatewayTelemetryExporterProperties.properties.kind, openapi.json line 6125). ARM Section 2.6 explicitly requires kind at the resource root, alongside id/name/type, rather than in resource-specific properties. Their create/read-only mutability is now correct, but it does not fix placement.

Suggested fix: Move each existing kind declaration from its Properties model into its corresponding ProxyResource model. Preserve the union types and Lifecycle.Read/Lifecycle.Create visibility, and retain the existing ResourceNameParameter and EntityTagProperty spreads. The moved members are:

// Member of AiGatewayModelProviderResource, not its Properties model:
@visibility(Lifecycle.Read, Lifecycle.Create)
kind: AiGatewayModelProviderKind;

// Member of AiGatewayTelemetryExporterResource, not its Properties model:
@visibility(Lifecycle.Read, Lifecycle.Create)
kind: AiGatewayTelemetryExporterKind;

Update request/response examples to place kind beside properties and regenerate OpenAPI.

[Mark Cowlishaw (markcowl)]

What is this 'kind' proeprty for? This looks like a property for a polymorphic resource, but, in that case, you would have (1) A union of the known values for resource kinds; (2) A leaf model type for each of the concrete models for the polymorphic type, which would have kind be a specific value of the 'kind' union.

If this 'kind' is meant as a discriminator, then putting it as a direct property of the reosurce seems like a bad idea - that would mean that the envelope properties could change based on the kind, when for a single resource type, the set of possible envelope properties should not change from resource instance to resource instance.