Repository navigation
Az CLI 2.87 az static webapp secrets command giving "Bad Request" error #33659
Description
Describe the bug
When trying to rotate the api key of azure static webapp the command throws the error.
Operation returned an invalid status 'Bad Request'
Related command
az staticwebapp secrets reset-api-key --name ${STATIC_WEB_APP_NAME}
Errors
Operation returned an invalid status 'Bad Request'
Issue script & Debug output
Confidential values
Expected behavior
The staticwebapp secret should rotate successfully
Environment Summary
azure-cli 2.87.0
core 2.87.0
telemetry 1.1.0
Extensions:
bastion 1.4.2
ssh 2.0.6
Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0
Python location 'C:\Users\Downloads\azure-cli-2.87.0-x64\python.exe'
Config directory 'C:\Users.azure
Extensions directory 'C:\Users.azure\cliextensions
Python (Windows) 3.13.13 (tags/v3.13.13:01104ce, Apr 7 2026, 19:25:48) [MSC v.1944 64 bit (AMD64)]
Legal docs and information:aka.ms/AzureCliLegal
Your CLI is up-to-date.
Additional context
No response
Activity
yonzhan commentedon Jun 26, 2026
Thank you for opening this issue, we will look into it.
AkashRahane commentedon Jul 6, 2026
Is anyone working on this?
AkashRahane commentedon Jul 16, 2026
Any update?
x-engineering-agent commentedon Oct 25, 2026
The command, CLI version, and expected result are clear. The reset command sends the site's repository token to the Static Web Apps API, but the reported
Bad Requestdoes not show which part of the request the service rejected.Could you share only the service error code and message from the HTTP 400 response, if available? Please redact tokens, credentials, request URLs, and resource identifiers; do not post the full
--debuglog. That detail will let us distinguish a service-side validation failure from a CLI request issue and scope the next investigation.Posted by x-engineering-agent (Fixer)
x-engineering-agent commentedon Oct 25, 2026
Below is my analysis of this issue:
Summary
The reported Azure CLI 2.87.0
az staticwebapp secrets reset-api-key --namerequest returns HTTP 400 instead of rotating the deployment key. The sandbox failed before running any command, so neither the service response nor whether this affects newer releases has been verified.🔬 Likely root cause
The core appservice handler looks up the site, constructs a reset request with
repository_token=existing_staticsite.repository_token, and sends it to the Microsoft.Web SDK. If the site read does not expose a usable repository token, the outgoing reset payload may be rejected with 400. This is a hypothesis, not a reproduced explanation for this particular site; verify the actual SDK serialization and service error before changing the payload.Affected code
src/azure-cli/azure/cli/command_modules/appservice/commands.py›load_command_table(line 779)src/azure-cli/azure/cli/command_modules/appservice/static_sites.py›reset_staticsite_api_key(line 619)🚫 Ruled out
🛠️ Proposed change
In
static_sites.py:reset_staticsite_api_key, first establish the failing service request and API contract, then make the narrowest correction to the reset payload or token handling if the CLI sends an invalid request. If the service rejects a valid request for this site, report the service-side blocker rather than masking the error or guessing a CLI fix.🧬 Origin
az staticwebapp secrets: Add commands to manage deployment secrets #19347 (2021-09-01) introduced both the handler and command registration.⏱️ Why this surfaced now
Unknown: the reset handler and registration have not changed since 2021. CLI 2.87.0 shipped in May 2026; an App Service Microsoft.Web API upgrade landed at that time, but this handler calls the SDK directly, so a causal link has not been established.
trace_originattributesreset_staticsite_api_keyto [App Service]: Fix #16470:az staticwebapp secrets: Add commands to manage deployment secrets #19347 (2021-09-01) with no later handler change.🔬 Technical details
Evidence
commands.py:777-779binds the command tostatic_sites.reset_staticsite_api_keyin core appservice, not the similarly named extension.static_sites.py:619-629copies the repository token returned by GET intoStaticSiteResetPropertiesARMResource, then callsreset_static_site_api_keywithout checking its presence or request shape.static_sites.py:420-479permits static sites without a connected repository or token;test_staticapp_commands_thru_mock.py:646-660exercises only a mock site with a token and mocks the reset response, without checking a real HTTP request.Reproduction
Azure/issue-sentinel run 40194304664 failed before running setup or reset on 2.87.0, 2.91.0 and dev. This is not a negative reproduction; the sandbox section below carries the exact result.
Test plan
Add an appservice
ScenarioTestthat creates a disposable Free static web app, invokesstaticwebapp secrets reset-api-keywith and without--resource-group, and compares secrets before and after without logging the key; record it only after a live run succeeds. Include a repository-connected case if a safe test token is available. Add a unit assertion for actual request serialization with and without a repository token; the existing mock-only success does not exercise the HTTP 400 path.Generated code: Handwritten code.
static_sites.pyandcommands.pyare handwritten appservice code; the SDK model must be checked but generated files must not be edited directly.🔁 Live reproduction (BAMI sandbox) — Inconclusive
Verdict: Inconclusive: the sandbox could not run the reproduction to the end.
Reason: the run produced no usable result.
The analysis above is based on reading the code only, so its confidence is capped at low.
Sandbox run
Commands ran in an isolated Azure sandbox subscription from a validated ReproSpec; output is redacted.
x-engineering-agent commentedon Oct 25, 2026
Implementation Result
No pull request was opened because there is not enough information to make a safe change.
Reason (from the job report): The reported HTTP 400 remains unconfirmed. src/azure-cli/azure/cli/command_modules/appservice/static_sites.py:reset_staticsite_api_key copies repository_token from show_staticsite without specifying should_update_repository. A missing token serializes as {"properties": {}}, but no evidence establishes that this causes the reported Bad Request. The current REST reference does not state defaults or conditional credential requirements; its only successful example supplies a token and shouldUpdateRepository=true. A historical PowerShell recording demonstrates a successful unlinked-site reset with neither field on API 2020-12-01. Before changing behavior, maintainers need a sanitized …
Reproduced: no · Confidence: 0.95
Next step: Please add exact reproduction steps, the versions in use and the complete error output (with secrets removed) so another implementation can be requested.
Posted by x-engineering-agent (Fixer)