Configure OpenAPI Security Scheme for API Key
You have a Microsoft Foundry project named Project1 that contains an agent. The agent uses an OpenAPI 3.0 specification to call an external weather service. The weather service requires a key to be passed in an HTTP header. The key value is stored as a connection in Project1. You need to ensure that the key value from the connection is included automatically whenever the OpenAPI tool is invoked. What should you configure in the OpenAPI specification?
Community Insight
Tests knowledge of OpenAPI security definitions; the trap is confusing generic header parameters or token-based schemes with the specific mechanism for passing a static connection-stored key.
Learn how to configure an OpenAPI specification in Microsoft Foundry to automatically inject a static API key into HTTP headers. This guide explains why the API key security scheme is the correct implementation for external service authentication.
Candidates often select 'a header parameter defined for each operation' (A), which requires manual value passing rather than automatic injection from a connection, or choose 'Bearer token' (D) assuming all auth is token-based.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The question requires the key value from a Foundry connection to be included automatically when the agent invokes the tool. In an OpenAPI specification, this is achieved by defining asecuritySchemes section with type: apiKey. When this scheme is referenced in the security requirements, the Foundry runtime can map the stored connection secret to this scheme and inject it into the specified header (e.g., X-Weather-API-Key) without manual intervention per call.Why the Other Options Are Wrong
Option A (header parameter for each operation) defines the schema but does not inherently provide an automated source for the value; it typically expects the caller to pass the value explicitly unless bound to a specific security scheme. Option B (Azure Key Vault connection) is a storage mechanism in Azure, not an OpenAPI specification construct for defining authentication requirements. Option D (Bearer token security scheme) usestype: http with scheme: bearer, which is designed for OAuth2/JWT flows where a token is generated or passed, not for a simple static API key passed in a custom header name.Community Comment Notes
Community consensus strongly supports option C. One user noted that "The OpenAPI tool injects a connection-stored key automatically when the spec declares an API key security scheme," highlighting the automation aspect. Another comment provided the exact YAML snippet showingtype: apiKey in: header, confirming the technical implementation details. Exam Strategy
When configuring tools for agents in Foundry, always distinguish between defining a parameter's structure and defining its authentication source. Use apiKey security schemes for static credentials stored in connections to ensure automatic injection.
Frequently Asked Questions
Why not use a Bearer token for a simple API key?
Bearer tokens are for dynamic tokens (OAuth/JWT). API keys are static strings usually placed in a custom header, best handled by the apiKey type.
Does adding a header parameter automatically use my connection?
No. Defining the parameter only describes the request. You must link it to a security scheme so Foundry knows to fetch the value from your connection.
Related Analysis
Practice All AI-103 Questions
Access 88 questions with complete answers and detailed explanations.
View Full AI-103 Practice Test →