Add post calls for auth key of authorization objects for expressrouteciruits and expressrouteports

[mshrimankar10]

ARM (Control Plane) API Specification Update Pull Request

Tip

Overwhelmed by all this guidance? See the Getting help section at the bottom of this PR description.

PR review workflow diagram

Please understand this diagram before proceeding. It explains how to get your PR approved & merged.

Purpose of this PR

What's the purpose of this PR? Check the specific option that applies. This is mandatory!

• New resource provider.
• New API version for an existing resource provider. (If API spec is not defined in TypeSpec, the PR should have been created in adherence to OpenAPI specs PR creation guidance).
• Update existing version for a new feature. (This is applicable only when you are revising a private preview API version.)
• Update existing version to fix OpenAPI spec quality issues in S360.
• Convert existing OpenAPI spec to TypeSpec spec (do not combine this with implementing changes for a new API version).
• Other, please clarify:
  • edit this with your clarification

Due diligence checklist

To merge this PR, you must go through the following checklist and confirm you understood
and followed the instructions by checking all the boxes:

• I confirm this PR is modifying Azure Resource Manager (ARM) related specifications, and not data plane related specifications.
• I have reviewed following Resource Provider guidelines, including
  ARM resource provider contract and
  REST guidelines (estimated time: 4 hours).
  I understand this is required before I can proceed to the diagram Step 2, "ARM API changes review", for this PR.
• X ] A release plan has been created. If not, please create one as it will help guide you through the REST API and SDK creation process.

Additional information

Viewing API changes

For convenient view of the API changes made by this PR, refer to the URLs provided in the table
in the Generated ApiView comment added to this PR. You can use ApiView to show API versions diff.

Suppressing failures

If one or multiple validation error/warning suppression(s) is detected in your PR, please follow the
suppressions guide to get approval.

Getting help

• First, please carefully read through this PR description, from top to bottom. Please fill out the Purpose of this PR and Due diligence checklist.
• If you don't have permissions to remove or add labels to the PR, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories
• To understand what you must do next to merge this PR, see the Next Steps to Merge comment. It will appear within few minutes of submitting this PR and will continue to be up-to-date with current PR state.
• For guidance on fixing this PR CI check failures, see the hyperlinks provided in given failure
  and https://aka.ms/ci-fix.
• For help with ARM review (PR workflow diagram Step 2), see https://aka.ms/azsdk/pr-arm-review.
• If the PR CI checks appear to be stuck in queued state, please add a comment with contents /azp run.
  This should result in a new comment denoting a PR validation pipeline has started and the checks should be updated after few minutes.
• If the help provided by the previous points is not enough, post to https://aka.ms/azsdk/support/specreview-channel and link to this PR.
• For guidance on SDK breaking change review, refer to https://aka.ms/ci-fix.

[github-actions]

Next Steps to Merge

✅ All automated merging requirements have been met! To get your PR merged, see aka.ms/azsdk/specreview/merge.

Comment generated by summarize-checks workflow run.

[Copilot]

Pull request overview

Adds POST actions for retrieving authorization keys from ExpressRoute circuit and port authorization resources.

Changes:

• Adds listKeys TypeSpec operations and response model.
• Generates corresponding OpenAPI endpoints and examples.
• Adds scoped resource-name validation suppressions.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
stable/2025-09-01/expressRoute.json	Adds both generated key-retrieval endpoints.
stable/2025-09-01/common.json	Adds the authorization-key response schema.
stable/2025-09-01/examples/ExpressRoutePortAuthorizationListKeys.json	Adds the port example.
stable/2025-09-01/examples/ExpressRouteCircuitAuthorizationListKeys.json	Adds the circuit example.
stable/2025-09-01/examples/ExpressRouteCircuitAuthorizationListKey.json	Adds an unreferenced circuit example.
readme.md	Adds resource-name suppressions.
Network/models.tsp	Defines the secret response model.
Network/ExpressRoutePortAuthorization.tsp	Defines the port action.
Network/ExpressRouteCircuitAuthorization.tsp	Defines the circuit action.
Network/examples/2025-09-01/ExpressRoutePortAuthorizationListKeys.json	Adds the source port example.
Network/examples/2025-09-01/ExpressRouteCircuitAuthorizationListKeys.json	Adds the source circuit example.

Suppressed comments (3)

specification/network/resource-manager/Microsoft.Network/Network/Network/ExpressRouteCircuitAuthorization.tsp:90

• This action does not isolate the credential from normal resource reads. AuthorizationPropertiesFormat.authorizationKey remains in the circuit resource schema (models.tsp:10913-10918, emitted at expressRoute.json:5703-5710), so GET/list and write responses can still expose the same key. SEC-SECRET-DETECT requires retrievable secrets to be returned only through a list* POST action. In the new API version, remove/hide the key from the resource representation and expose it only through this operation.

  listKeys is ArmResourceActionSync<
    ExpressRouteCircuitAuthorization,
    void,
    ArmResponse<ExpressRouteAuthorizationKey>,
    Error = CloudError

specification/network/resource-manager/Microsoft.Network/Network/Network/ExpressRoutePortAuthorization.tsp:120

• This action does not isolate the credential from normal resource reads. ExpressRoutePortAuthorizationPropertiesFormat.authorizationKey remains read-visible (models.tsp:12177-12183, emitted at expressRoute.json:7475-7484), so GET/list responses still expose the key. SEC-SECRET-DETECT requires retrievable secrets to be returned only through a list* POST action. In the new API version, remove/hide the key from the resource representation and expose it only through this operation.

  listKeys is ExpressRoutePortAuthorizationOps.ActionSync<
    ExpressRoutePortAuthorization,
    void,
    ArmResponse<ExpressRouteAuthorizationKey>,
    OverrideErrorType = CloudError

specification/network/resource-manager/Microsoft.Network/Network/Network/ExpressRouteCircuitAuthorization.tsp:85

• listkeys permanently publishes a two-word action segment as all lowercase, while the operation itself is listKeys and existing actions in this project use camelCase segments such as listSharedKey, listIdpsSignatures, and listDeploymentStatus. Use the camelCase action path before this API is published, then regenerate the OpenAPI and update the suppression path.

  @action("listkeys")

[Sandip Shahane (sandipsh)]

The runtime-masking explanation may justify retaining non-secret schema semantics, but the placeholder reasons should be replaced with that concrete rationale. No Approved-TypeSpecSuppression label is present. Please note that this may become a breaking change requirement eventually while merging to main.

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Language	API Review for Package
TypeSpec	Microsoft.Network
Go	sdk/resourcemanager/network/armnetwork
JavaScript	@azure/arm-network
Java	com.azure.resourcemanager:azure-resourcemanager-network
Python	azure-mgmt-network

---

Comment generated by After APIView workflow run.

[github-actions]

ARM API Review Summary — PR #45679

Verification status: Independent review completed against head commit 93deb289dd5366bb336a8351d856a59a4931fce3 (base release-microsoft-network-2026-01-01). Iteration: 1. Critic review (Step 5.6) was attempted 3 times and could not be completed — the runtime Critic agent reports the required binding protocol files (arm-api-review-critic.agent.md, protocols/arm-api-review-critic.protocol.md, protocols/arm-api-review-critic-inputs.template.md) are absent from this environment. Per the fallback rule, no findings below are Blocking, so no downgrade was necessary; this run proceeds with critic: unknown, disclosed here.

Approval labels observed: none (no BreakingChange-Approved-*, Versioning-Approved-*, Approved-Suppression, or Approved-TypeSpecSuppression).

Scope: 10 changed files, all under specification/network/resource-manager/Microsoft.Network/Network/ — full review performed (no size-cap scoping needed).

#	Finding	Classification	Severity	Status
1	@action("listkeys") in ExpressRouteCircuitAuthorization.tsp (L85) and ExpressRoutePortAuthorization.tsp (L115) emits an all-lowercase listkeys URL segment. Per Azure API Guidelines — URLs, action segments should use camelCase (e.g. listKeys, matching precedent such as Microsoft.Storage's /listKeys).	NEW	Warning	Already flagged as an active, unresolved inline comment by the prior automated review pass — not reposted here to avoid duplication.
2	New model ExpressRouteAuthorizationKey (models.tsp L10938-10948): both the model-level doc and its sole authorizationKey property repeat the identical text "The authorization key." with no distinguishing detail.	NEW	Warning	Already flagged as an active, unresolved inline comment by the prior automated review pass — not reposted here.
3	Three prior bot-review threads referencing stable/2025-09-01/... paths (@added(v2025_09_01) mismatch, missing x-ms-secret/format:password, orphaned singular example file) are marked outdated by GitHub and do not correspond to any file in this PR's diff (which only touches stable/2026-01-01/...). Verified: stable/2026-01-01/common.json already declares x-ms-secret: true and format: password on ExpressRouteAuthorizationKey.authorizationKey, and only the plural ...ListKeys.json example files exist in the current diff (no orphan).	Resolved-by-supersession	—	Treated as SKIP-COVERED; no action taken on these bot-authored, GitHub-flagged-outdated threads.
4	readme.md (L335-340) adds a ResourceNameRestriction suppression for the two new listkeys paths with a substantive, non-placeholder justification (references pre-existing path parameters and breaking-change rationale).	NEW	—	Compliant; no finding.
5	authorizationKey on the pre-existing AuthorizationPropertiesFormat / ExpressRoutePortAuthorizationPropertiesFormat models carries a pre-existing #suppress ... "FIXME: Update justification..." annotation that predates this PR.	EXISTING	Informational	Not attributed to this PR's author; noted for awareness only, not posted as a blocking/inline finding.

Findings on unchanged files: None.

posted-by: arm-api-reviewer-agent | rule: summary | severity: warning | classification: new | critic: unknown | head-sha: 93deb28

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

TypeSpec suppressions requiring review (testing, non-blocking)

Status: ❌ Approval required (currently under testing, review NOT enforced) — 4 suppressions

⚠️ This check is currently in testing mode and is non-blocking — it will not prevent this PR from merging. This PR adds or updates the TypeSpec suppressions listed below. Suppressions are strongly discouraged — they bypass linter rules that protect API quality and consistency. Authors should avoid adding new suppressions and prefer fixing the underlying issue; reviewers should approve only when there is a clear, compelling justification and no reasonable alternative. Review each linked rule and source location, then apply Approved-TypeSpecSuppression only if every justification is acceptable. The Status column shows ✅ once the label is applied and ❌ while approval is pending.

Changed suppressions (4)

Status	Rule	Source	Previous justification	New justification
❌	@azure-tools/typespec-azure-resource-manager/secret-prop RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with Madara (@secret) decorator.	models.tsp#L11359	FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details	Pre-existing GA property; changing its schema (e.g. adding format: password / x-ms-secret) would be a breaking change. Whether GET/LIST returns this authorization key unmasked or masked is enforced at runtime by the backend based on the caller's privileges, not by the API schema, so Madara (@secret) is intentionally not applied. The dedicated listKeys POST action returns the unmasked key via the Madara (@secret) ExpressRouteAuthorizationKey response model.
❌	@azure-tools/typespec-azure-resource-manager/secret-prop RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with Madara (@secret) decorator.	models.tsp#L12826	FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details	Pre-existing GA property; changing its schema (e.g. adding format: password / x-ms-secret) would be a breaking change. Whether GET/LIST returns this authorization key unmasked or masked is enforced at runtime by the backend based on the caller's privileges, not by the API schema, so Madara (@secret) is intentionally not applied. The dedicated listKeys POST action returns the unmasked key via the Madara (@secret) ExpressRouteAuthorizationKey response model.
❌	@azure-tools/typespec-azure-resource-manager/secret-prop RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with Madara (@secret) decorator.	models.tsp#L11359	FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details	Pre-existing GA property; changing its schema (e.g. adding format: password / x-ms-secret) would be a breaking change. Whether GET/LIST returns this authorization key unmasked or masked is enforced at runtime by the backend based on the caller's privileges, not by the API schema, so Madara (@secret) is intentionally not applied. The dedicated listKeys POST action returns the unmasked key via the Madara (@secret) ExpressRouteAuthorizationKey response model.
❌	@azure-tools/typespec-azure-resource-manager/secret-prop RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with Madara (@secret) decorator.	models.tsp#L12826	FIXME: Update justification, follow aka.ms/tsp/conversion-fix for details	Pre-existing GA property; changing its schema (e.g. adding format: password / x-ms-secret) would be a breaking change. Whether GET/LIST returns this authorization key unmasked or masked is enforced at runtime by the backend based on the caller's privileges, not by the API schema, so Madara (@secret) is intentionally not applied. The dedicated listKeys POST action returns the unmasked key via the Madara (@secret) ExpressRouteAuthorizationKey response model.

For an overview of TypeSpec linting rules click here.
For a mapping from ARM lintdiff rules to corresponding TypeSpec linting rules click here.

💬 Have feedback on the TypeSpec suppression flow? Let us know.

[github-actions]

ARM API Review Summary

Reviewed PR #45679 at head SHA 535d98d88b0afb3f694f455ff1b112578ac69c8b | Triggered by: workflow_run

Approval labels observed: none.

Category	Count
🔴 Blocking	0
🟠 Warning	0
🔵 Suggestion	0

Reconciliation against all existing discussion surfaces (inline review threads, top-level comments, and review bodies) found no new, uncovered findings for the current head SHA. The one still-active inline thread (duplicate/uninformative "The authorization key." description on ExpressRouteAuthorizationKey and its authorizationKey property in models.tsp) remains open and unresolved — no new duplicate finding was posted (SKIP-COVERED). Four other bot-authored threads referencing the prior stable/2025-09-01 version-folder path, an @added version mismatch, missing secret markers, and an orphaned example file are GitHub-marked outdated and superseded by the current push to stable/2026-01-01 (verified: x-ms-secret: true/format: password are present on the new ExpressRouteAuthorizationKey.authorizationKey schema in stable/2026-01-01/common.json, and only the plural ...ListKeys.json example files exist in the current diff), so no action was taken on them. The previously flagged listkeys lowercase action-segment issue has been fixed in the current push (both TypeSpec files now use @action("listKeys")).

Note: The Mandatory Critic Review (Step 5.6) subagent reported that its required binding protocol files are unavailable in this environment and returned a FAIL/no-verdict response after being dispatched. Since no Blocking findings were candidates for posting in this run, no downgrade was necessary; critic: unknown is disclosed here per the fallback rule.

posted-by: arm-api-reviewer-agent | rule: summary | severity: suggestion | classification: existing | critic: unknown | head-sha: 535d98d

🔍 ARM API review by ARM API Review: Automated Workflow

[Sandip Shahane (sandipsh)]

Correction to the earlier conclusions in #45679 (comment): the ResourceNameRestriction suppression was described as compliant, and the two secret-prop suppressions as informational only. Those conclusions are superseded by the current evidence at 535d98d88b0afb3f694f455ff1b112578ac69c8b.

The two new readme.md suppressions at lines 5170-5175 are file-wide because they omit where:. Please remove each broad entry, rerun LintDiff, and, if suppression remains justified, scope it to the exact jsonpath reported by that run. Otherwise future violations anywhere in expressRoute.json can be hidden. No Approved-Suppression label is currently present.

The authorizationKey properties at models.tsp lines 10917 and 12181 also still suppress secret-prop. Because these are credential signals, please use @secret on both, regenerate, and confirm GET/LIST never returns an unmasked key; otherwise SDK and logging tooling treat them as ordinary strings. No Approved-TypeSpecSuppression label is currently present.

If an approval label covers either exact finding, please apply it and resolve the corresponding concern; otherwise address or obtain approval for it.

[mshrimankar10]

1. Scoped the suppressions (readme.md)
   The two LintDiff suppressions are no longer file-wide — each now carries a where: targeting only the two new /listKeys paths, so they can't mask violations anywhere else in expressRoute.json:

ResourceNameRestriction (error) — scoped to:
…/expressRouteCircuits/{circuitName}/authorizations/{authorizationName}/listKeys
…/expressRoutePorts/{expressRoutePortName}/authorizations/{authorizationName}/listKeys
LatestVersionOfCommonTypesMustBeUsed (warning) — scoped to the same two paths.
circuitName, authorizationName, and expressRoutePortName are existing parent/resource path parameters that shipped in prior GA versions without a pattern restriction; adding one now would be a breaking change, and they're referenced by all existing ExpressRoute circuit/port authorization APIs. (These will need the Approved-Suppression label.)

2. secret applied where the real key is exposed

The unmasked authorization key is returned only by the new listKeys POST actions. Its response model is marked secret, so the generated swagger emits format: password + x-ms-secret: true:

Confirming GET/LIST never return an unmasked key: the existing authorizationKey on AuthorizationPropertiesFormat (circuit) and ExpressRoutePortAuthorizationPropertiesFormat (port) always returns a masked value at runtime. I will take care the changes in this APIs as part of separate PRs if needed

[github-actions]

ARM API Review Summary

Reviewed PR #45679 at head SHA 9a3d7ad323fa39b0abecfd67d391ade0ad809cf8 | Triggered by: pull_request_target

Approval labels observed: none.

Category	Count
🔴 Blocking	0
🟠 Warning	0
🔵 Suggestion	0

Prior findings (lowercase listkeys action segment, terse property description, unscoped readme.md suppressions) have all been fixed in the latest push. The only outstanding item is the Approved-Suppression label requirement for the two scoped readme.md suppressions (ResourceNameRestriction, LatestVersionOfCommonTypesMustBeUsed); the pre-existing secret-prop suppression on legacy authorizationKey fields is noted for future follow-up but is out of scope for this PR.

posted-by: arm-api-reviewer-agent | rule: summary | severity: warning | classification: existing | critic: unknown | head-sha: 9a3d7ad

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

Following up on #45679 (comment) and the author's response above: at head commit 9a3d7ad323fa39b0abecfd67d391ade0ad809cf8 both readme.md suppressions (ResourceNameRestriction, LatestVersionOfCommonTypesMustBeUsed) now carry a where: clause scoped to only the two new /listKeys paths, resolving the file-wide-suppression concern. The new ExpressRouteAuthorizationKey.authorizationKey property (common.json) correctly emits format: password and x-ms-secret: true, so the retrievable secret is isolated to the dedicated listKeys POST action.

Approval context: These two suppressions still require the Approved-Suppression label; no matching label was observed on the PR at this session SHA. If suppression approval has been granted, please apply Approved-Suppression and resolve this conversation; otherwise obtain approval before merge.

The pre-existing secret-prop suppression on AuthorizationPropertiesFormat.authorizationKey / ExpressRoutePortAuthorizationPropertiesFormat.authorizationKey (models.tsp) predates this PR and is out of scope for this change per the author's plan to address it separately; noted for awareness only, not a blocking finding here.

posted-by: arm-api-reviewer-agent | rule: SEC-SECRET-DETECT | severity: warning | classification: existing | critic: unknown | head-sha: 9a3d7ad

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review

Posting findings from the ARM API Reviewer agent (Critic unavailable; reviewer self-check only, 1 iteration(s), no new blocking findings) against commit 9a3d7ad323fa39b0abecfd67d391ade0ad809cf8. All findings are reported in the summary comment.

Approval labels observed: none.

🔍 ARM API review by ARM API Review: Automated Workflow

[mshrimankar10]

Added suppression reasons

[github-actions]

Following up on the prior clarification: at head commit 316cf77621c91adafdf12ad3aa57c8aefdba51c7 both secret-prop suppression reasons on AuthorizationPropertiesFormat.authorizationKey (models.tsp L10917) and ExpressRoutePortAuthorizationPropertiesFormat.authorizationKey (models.tsp L12181) have been replaced with a concrete, factual rationale — the placeholder FIXME: Update justification text is gone. No further action needed on this item.

The scoped ResourceNameRestriction suppression on the two new /listKeys paths (readme.md, with a where: clause limiting it to those paths) remains in place and continues to look reasonable for peer approval. It still requires the Approved-Suppression label before merge — no matching label is observed on the PR at this session SHA (Approved-Avocado is present but is a different approval category and does not satisfy Approved-Suppression).

Approval context: No Approved-Suppression label is present at the current head. If suppression approval has been granted, please apply the label and resolve this conversation; otherwise obtain approval before merge.

posted-by: arm-api-reviewer-agent | reconciliation: clarification | critic: unknown | head-sha: 316cf77

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review Summary

Reviewed PR #45679 at head SHA 316cf77621c91adafdf12ad3aa57c8aefdba51c7 | Triggered by: pull_request_target

Approval labels observed: none (Approved-Avocado is present but is not Approved-Suppression, Approved-TypeSpecSuppression, BreakingChange-Approved-*, or Versioning-Approved-*).

Category	Count
🔴 Blocking	0
🟠 Warning	0
🔵 Suggestion	0

Reconciliation against all existing discussion surfaces (inline review threads, top-level comments, review bodies) found no new, uncovered findings at this head SHA. The most recent author push (Added suppression reasons) replaced the placeholder FIXME: Update justification text on both secret-prop suppressions in models.tsp (L10917, L12181) with a concrete, factual rationale, resolving that outstanding clarification (clarified above, SKIP-COVERED/resolved-by-fix). The scoped ResourceNameRestriction suppression on the two new listKeys paths (readme.md) remains and still needs the Approved-Suppression label. The pre-existing Section 11.1 Swagger Avocado MULTIPLE_API_VERSION finding on stable/2018-10-01/vmssNetwork.json remains open and unaddressed at this head SHA; it is pre-existing (also present at the PR's base SHA) and is not reposted here to avoid duplication.

Note: The Mandatory Critic Review (Step 5.6) subagent's required binding protocol files were unavailable in this environment across prior runs; consistent with that history, no Blocking findings are candidates for posting in this run, so no downgrade was necessary. critic: unknown is disclosed here per the fallback rule.

posted-by: arm-api-reviewer-agent | rule: summary | severity: suggestion | classification: existing | critic: unknown | head-sha: 316cf77

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review Summary

Reviewed PR #45679 at head SHA 4ecc638d9a15fc1c434088e741832a324ccaadc5 | Triggered by: labeled/comment

Approval labels observed: none.

Category	Count
🔴 Blocking	0
🟠 Warning	0
🔵 Suggestion	1

This PR adds listKeys POST actions for ExpressRoute circuit and port authorizations, following ARM secret-handling conventions correctly: the new ExpressRouteAuthorizationKey response model is annotated with @secret (TypeSpec) / x-ms-secret: true + format: password (swagger) 7.2, both actions are named with the list prefix per 12.1, return synchronous 200 with a response schema per 12.1, and are correctly versioned via @added(Versions.v2026_01_01) per 11.2. The pre-existing unannotated authorizationKey property retains its existing suppression with an updated, clearer justification — this is an [EXISTING] item, not a new violation. The new ResourceNameRestriction suppression in readme.md is scoped to the two new paths and justified by pre-existing unpatterned path parameters.

🔵 Suggestion: Consider whether the pre-existing authorizationKey field returned unmasked/masked by caller privilege (rather than API contract) could eventually be deprecated/nulled in favor of the new listKeys action exclusively, per 7.1 long-term guidance — not required for this PR since it would be a breaking change to the existing GA contract.

No blocking or warning issues found. The BreakingChange-Go-Sdk/BreakingChange-JavaScript-Sdk labels present on the PR appear unrelated to the additive changes reviewed here (new operations/models only); no approval label was required or observed for this review's findings.

posted-by: arm-api-reviewer-agent | rule: summary | severity: suggestion | classification: new | critic: unknown | head-sha: 4ecc638

🔍 ARM API review by ARM API Review: Automated Workflow

[github-actions]

ARM API Review

Posting findings from the ARM API Reviewer agent (Critic unavailable; reviewer self-check only, 1 iteration(s), no blocking findings) against commit 4ecc638d9a15fc1c434088e741832a324ccaadc5. All findings are reported in the summary comment.

Approval labels observed: none.

🔍 ARM API review by ARM API Review: Automated Workflow

[Sandip Shahane (sandipsh)]

ARM API Review

Posting findings from the ARM API Reviewer agent (critic-verified, 2 iteration(s), converged) against commit 4ecc638. See inline comments for findings 2-3.

Approval labels observed: none.

[Sandip Shahane (sandipsh)]

[NEW] 🟠 Warning [EX-SECRET-PLACEHOLDER] specification/network/resource-manager/Microsoft.Network/Network/Network/examples/2026-01-01/ExpressRouteCircuitAuthorizationListKeys.json - line 12 - authkey is ambiguous for a credential example and can be mistaken for a usable value in generated docs or samples.

Classification reasoning: Introduced in this PR; this example does not exist at base SHA 7148691c2f2ae4ca4252dda9f6c2d1ec57e7c917.

Suggested fix: Use an unmistakably fake placeholder such as "{api-key}" or "********", then regenerate the emitted example.

[Sandip Shahane (sandipsh)]

[NEW] 🟠 Warning [EX-SECRET-PLACEHOLDER] specification/network/resource-manager/Microsoft.Network/Network/Network/examples/2026-01-01/ExpressRoutePortAuthorizationListKeys.json - line 12 - authkey is ambiguous for a credential example and can be mistaken for a usable value in generated docs or samples.

Classification reasoning: Introduced in this PR; this example does not exist at base SHA 7148691c2f2ae4ca4252dda9f6c2d1ec57e7c917.

Suggested fix: Use an unmistakably fake placeholder such as "{api-key}" or "********", then regenerate the emitted example.