no-tenant-level-apis

Id

@azure-tools/typespec-azure-resource-manager/no-tenant-level-apis

ARM PUT operations whose resolved paths begin with ‘/providers’ are not allowed, except paths ending in ‘/operations’.

Tenant-level ARM APIs are strongly discouraged because they operate outside subscription and resource-group boundaries and require additional security review. Define resource operations at subscription or resource-group scope whenever possible.

The rule reports every ARM PUT operation whose resolved route begins with /providers, except operations whose route ends with /operations.

Incorrect

@armProviderNamespace
@service(#{ title: "Contoso service" })
namespace Microsoft.Contoso;

@put
@route("/providers/Microsoft.Contoso/settings/{settingName}")
op createOrUpdateSetting(@path settingName: string, @body setting: Setting): Setting;

Correct

@armProviderNamespace
@service(#{ title: "Contoso service" })
namespace Microsoft.Contoso;

@put
@route("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Contoso/settings/{settingName}")
op createOrUpdateSetting(
  @path subscriptionId: string,
  @path resourceGroupName: string,
  @path settingName: string,
  @body setting: Setting,
): Setting;

LintDiff Equivalent

This rule is the TypeSpec equivalent of the Swagger validator rule TenantLevelAPIsNotAllowed.