[Bug]: Provide support to generate API key without a provided value for REST APIs

[thivindu]

Please select the area the issue is related to

Platform API

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Description

POST /rest-apis/{restApiId}/api-keys currently requires the caller to supply the plaintext key value - marks apiKey as required [1], and APIKeyHandler.CreateAPIKey [2] rejects the request with API key value is required when it's empty. The endpoint is effectively inject-only: it exists so external platforms can push an already-minted key to hybrid gateways.

Current behaviour

• apiKey is required on both CreateAPIKeyRequest and UpdateAPIKeyRequest.
• CreateAPIKeyResponse [3] returns only status, message, and keyId - never key material, since the server never generated any.
• Omitting apiKey returns 400 API key value is required.

{"status":"error","code":"VALIDATION_FAILED","message":"API key value is required"}

[1]

api-platform/platform-api/resources/openapi.yaml

Lines 6211 to 6253 in 092bf35

	CreateAPIKeyRequest:
	type: object
	required:
	- displayName
	- apiKey
	properties:
	id:
	type: string
	description: |
	Unique identifier for this API key within the API (optional; if omitted,
	generated from displayName)
	minLength: 3
	maxLength: 40
	example: "production-key-01"
	displayName:
	type: string
	description: Human-readable name for the API key
	minLength: 1
	maxLength: 128
	example: "Production API Key"
	apiKey:
	type: string
	description: The plain text API key value that will be hashed before storage
	example: "sk_example_1234567890abcdef"
	externalRefId:
	type: string
	description: Optional reference ID for tracing purposes (from external platforms)
	nullable: true
	example: "ext-ref-12345"
	expiresAt:
	type: string
	format: date-time
	description: Optional expiration time in ISO 8601 format
	nullable: true
	example: "2026-12-31T23:59:59Z"
	expiresIn:
	$ref: '#/components/schemas/ExpirationDuration'
	description: Optional expiration duration
	issuer:
	type: string
	description: Identifier of the API Portal that provisioned this API key. Null if not provided.
	nullable: true
	example: "api-platform-devportal"

[2]

api-platform/platform-api/internal/handler/api_key.go

Line 90 in 092bf35

if req.ApiKey == "" {

[3]

api-platform/platform-api/resources/openapi.yaml

Lines 6255 to 6273 in 092bf35

	CreateAPIKeyResponse:
	type: object
	required:
	- status
	- message
	properties:
	status:
	type: string
	description: Status of the operation
	enum: [success, error]
	example: success
	message:
	type: string
	description: Additional details about the operation result
	example: "API key created and broadcasted to gateways successfully"
	keyId:
	type: string
	description: The internal ID generated for tracking
	example: "production-key-01"

Steps to Reproduce

1. Create a REST API in the Platform API. (Use the REST APIs)
2. Try to create a API key without a value.

curl -X POST 'https://localhost:9243/api/v0.9/rest-apis/{yourRestApiId}/api-keys' \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Content-Type: application/json' \
  --data-raw '{
      "displayName": "api-key-1-test"
    }' -k

3. Observe the error.

Severity Level of the Issue

Severity/Critical (Core functionality is broken but there is a workaround. Need urgent attention)

Environment Details (with versions)

No response