Error 409 from API Gateway API when creating API-Access for application

[renankaic]

APIM-CLI version

1.14.8

API-Management version

7.7.0.20240830

Bug description

Hello!
Please could you help us with an issue that we're facing when trying to update a frontend API?
We're receiving the following error when deploying/updating a frontend api with apim cli import command:

[APIImportApp] ERROR: Can't grant access to API. | Can't grant access to API using URI: https://my-host:8075/api/portal/v1.4/applications/4e182504-db00-49a6-882b-c2a93a2f9ffd/apis Received Status-Code: 409 Response: {"errors":[{"code":102,"message":"resource already exists"}]}

This frontend api has a lot of applications (more than 200) that have permission to use it. Some of these applications have the exact same name but are linked with different organizations.

Please, is there a way to set up APIM CLI to ignore this 409 errors instead of interrupting the import process?

Thanks in advance! Let me know if you need more details.

Steps to reproduce

In our scenario, we have some applications with exact same name but linked with different organizations.
Therefore, to reproduce this behavior it'll be something like this:

1. Create and publish a frontend api on API Manager
2. Create 3 organizations and grant access to the frontend api created on step 1 for each of them
3. Create 3 applications with the same name (they must have the same name), one for each organization created on step 2, granting access for the frontend api created on step 1
4. Use apim cli to get the frontend api spec created on step 1 from API Manager to your workstation
5. Change something in the api and try to deploy back to API Manager using apim cli import
6. The same error should appear to you

Relevant log output

[APIImportApp] ERROR: Can't grant access to API. | Can't grant access to API using URI: https://my-host:8075/api/portal/v1.4/applications/4e182504-db00-49a6-882b-c2a93a2f9ffd/apis Received Status-Code: 409 Response: {"errors":[{"code":102,"message":"resource already exists"}]}

[renankaic]

Hello again!
Maybe, IMHO, just adding the possibility of ignoring the following error:

Received Status-Code: 409 Response: {"errors":[{"code":102,"message":"resource already exists"}]}

It'll be great.
Also, as it seems tha application already has permission to the API, I think we shouldn't worry with the "resource already exists" error.

[rathnapandi]

Hi @renankaic,

I can't simulate the issue in the latest version based on the mentioned above steps. Could you please try with latest version?

{
  "name" : "githubissue",
  "path" : "/api/custom2",
  "state" : "published",
  "version" : "2.0",
  "organization" : "API Development",
  "apiSpecification" : {
    "resource" : "githubissue.json"
  },
  "backendBasepath" : "http://api.open-notify.org",
  "inboundProfiles" : {
    "_default" : {
      "monitorAPI" : true,
      "queryStringPassThrough" : false,
      "monitorSubject" : "authentication.subject.id",
      "securityProfile" : "_default",
      "corsProfile" : "_default"
    }
  },
    "clientOrganizations" : [ "org2", "org3", "org1" ],
    "applications" : [ {
      "organization" : "org1",
      "name" : "test"
    }, {
      "organization" : "org2",
      "name" : "test"
    }, {
      "organization" : "org3",
      "name" : "test"
    } ]
}

[renankaic]

Hi @rathnapandi
Thank you for your reply.
As you requested, we installed the new 1.14.10 version and tried again.
However, it still doesn't work. This is our last log:

2025-02-25 14:40:32,676 [ManageClientApps] INFO : Creating API-Access for the following apps: [ClientApplication{name=application A1 - APPID23004, id=3045f218-bf4e-416c-a42b-859f0f488d7f, enabled=true, state=approved, organization='Organization1'}]
2025-02-25 14:40:32,676 [ManageClientApps] INFO : Creating API-Access for application application A1 - APPID23004
2025-02-25 14:40:32,677 [RestAPICall] DEBUG: Http verb:POST and URI: https://gateway-server.com:8075/api/portal/v1.4/applications/3045f218-bf4e-416c-a42b-859f0f488d7f/apis
2025-02-25 14:40:32,771 [APIManagerAPIAccessAdapter] ERROR: Error granting access to application id : 3045f218-bf4e-416c-a42b-859f0f488d7f for  API-Proxy  : 3a609d03-7c3b-47b2-b89d-b396c9113cc3 using URI: https://gateway-server.com:8075/api/portal/v1.4/applications/3045f218-bf4e-416c-a42b-859f0f488d7f/apis Received Status-Code: 409 Response: {"errors":[{"code":102,"message":"resource already exists"}]}
2025-02-25 14:40:32,772 [RollbackAPIProxy] INFO : Rollback FE-API: DMS System API - V1.10 (ID: 3a609d03-7c3b-47b2-b89d-b396c9113cc3 / State: unpublished)
2025-02-25 14:40:32,774 [RestAPICall] DEBUG: Http verb:GET and URI: https://gateway-server.com:8075/api/portal/v1.4/proxies/3a609d03-7c3b-47b2-b89d-b396c9113cc3
2025-02-25 14:40:32,831 [APIManagerAPIAdapter] DEBUG: Found: 1 exposed API(s):
2025-02-25 14:40:32,831 [RestAPICall] DEBUG: Http verb:GET and URI: https://gateway-server.com:8075/api/portal/v1.4/proxies/3a609d03-7c3b-47b2-b89d-b396c9113cc3/apiaccess
2025-02-25 14:40:33,626 [APIStatusManager] DEBUG: Updating API-Status from: published to unpublished
2025-02-25 14:40:33,626 [APIManagerAPIAdapter] DEBUG: Update API-Proxy status to: unpublished
2025-02-25 14:40:33,631 [RestAPICall] DEBUG: Http verb:POST and URI: https://gateway-server.com:8075/api/portal/v1.4/proxies/3a609d03-7c3b-47b2-b89d-b396c9113cc3/unpublish
2025-02-25 14:40:38,910 [APIManagerAPIAdapter] DEBUG: Deleting API-Proxy with Name : DMS System API - V1.10 and Id: 3a609d03-7c3b-47b2-b89d-b396c9113cc3
2025-02-25 14:40:38,911 [RestAPICall] DEBUG: Http verb:DELETE and URI: https://gateway-server.com:8075/api/portal/v1.4/proxies/3a609d03-7c3b-47b2-b89d-b396c9113cc3
2025-02-25 14:40:39,035 [APIManagerAPIAdapter] INFO : API: DMS System API - V1.10 1.10 ( 3a609d03-7c3b-47b2-b89d-b396c9113cc3 ) successfully deleted
2025-02-25 14:40:39,035 [APIManagerAPIAdapter] DEBUG: Deleting Backend API : bb07dd3f-82ad-4657-a7d8-e0b686055081
2025-02-25 14:40:39,039 [RestAPICall] DEBUG: Http verb:DELETE and URI: https://gateway-server.com:8075/api/portal/v1.4/apirepo/bb07dd3f-82ad-4657-a7d8-e0b686055081
2025-02-25 14:40:39,561 [RestAPICall] DEBUG: Http verb:GET and URI: https://gateway-server.com:8075/api/portal/v1.4/apirepo?field=name&op=eq&value=DMS+-+System+API+-+v1.10&field=createdOn&op=gt&value=1740505222636
2025-02-25 14:40:40,050 [APIManagerAPIAdapter] DEBUG: No existing API found based on filter: []
2025-02-25 14:40:40,053 [RollbackHandler] INFO : Rolled back: [Frontend-API: false, Backend-API: true]
2025-02-25 14:40:40,054 [APIImportApp] ERROR: Can't grant access to API.
                                 | Can't grant access to API.
com.axway.apim.lib.error.AppException: Can't grant access to API.
        at com.axway.apim.adapter.apis.APIManagerAPIAccessAdapter.createAPIAccessForApplication(APIManagerAPIAccessAdapter.java:226)
        at com.axway.apim.apiimport.actions.ManageClientApps.createAppSubscription(ManageClientApps.java:118)
        at com.axway.apim.apiimport.actions.ManageClientApps.execute(ManageClientApps.java:73)
        at com.axway.apim.apiimport.actions.CreateNewAPI.execute(CreateNewAPI.java:106)
        at com.axway.apim.apiimport.actions.RecreateToUpdateAPI.execute(RecreateToUpdateAPI.java:37)
        at com.axway.apim.apiimport.APIImportManager.applyChanges(APIImportManager.java:76)
        at com.axway.apim.APIImportApp.importAPI(APIImportApp.java:130)
        at com.axway.apim.APIImportApp.importAPI(APIImportApp.java:57)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at com.axway.apim.cli.APIManagerCLI.run(APIManagerCLI.java:133)
        at com.axway.apim.cli.APIManagerCLI.main(APIManagerCLI.java:72)
Caused by: com.axway.apim.lib.error.AppException: Can't grant access to API.
        at com.axway.apim.adapter.apis.APIManagerAPIAccessAdapter.createAPIAccessForApplication(APIManagerAPIAccessAdapter.java:220)
        ... 13 more
2025-02-25 14:40:40,057 [APIManagerAdapter] DEBUG: Closing cache ...
2025-02-25 14:40:40,057 [RestAPICall] DEBUG: Http verb:DELETE and URI: https://gateway-server.com:8075/api/portal/v1.4/login

Unfortunately, we have more than 400 applications with access to this API. I'm not sure if we'll be able to reproduce it.

Let me know If you need me to send any more data via email.

[rathnapandi]

Hi @renankaic,

Thanks for testing it on latest release and sharing the log.

please test it with

axway-apimcli-1.14.11-SNAPSHOT.tar.gz

[renankaic]

Hello @rathnapandi
Thank you for providing a new version.
It seems that it worked now!
I can see the following line in the logs:

2025-02-25 17:04:04,951 [APIManagerAPIAccessAdapter] INFO : Unexpected response while creating/updating API Access: APIAccess [apiName=null, apiVersion=null, id=null, apiId=c16bd09d-e511-416f-aa6e-d7d2148c02c7] Response-Code: 409 Response Body: {"errors":[{"code":102,"message":"resource already exists"}]} Ignoring this error.

And the API was upgraded successfully!

[rathnapandi]

Fixed in 1.14.11