Skip to main content

Testing APIM Workbench

Purpose​

Use the Testing APIM Workbench when an agent or developer needs current testing environment behavior without copying the backend .env or weakening service network rules.

The public testing entrypoint is:

https://test-aitools-llfc-apim.azure-api.net

Source-of-truth internal guide: docs/internal/documentation-revival/testing-apim-workbench-guide.md.

Minimum Environment​

Get the APIM subscription key from testing Key Vault only when you are allowed to run live smokes:

az keyvault secret show \
  --vault-name test-aitools-llfckv \
  --name apim-subscription-key \
  --query value -o tsv

Then pass it to child processes without printing it:

APIM_SUBSCRIPTION_KEY=<testing APIM subscription key>
MASTRA_APIM_SUBSCRIPTION_KEY=<same testing APIM subscription key>
DOCS_CHAT_API_KEY=<same testing APIM subscription key>
APIM_GATEWAY_URL=https://test-aitools-llfc-apim.azure-api.net

Smoke Commands​

npm run testing:smoke:apim -- --dry-run
APIM_SUBSCRIPTION_KEY=<testing APIM subscription key> \
MASTRA_APIM_SUBSCRIPTION_KEY=<same testing APIM subscription key> \
DOCS_CHAT_API_KEY=<same testing APIM subscription key> \
npm run testing:smoke:apim -- --require-mcp-transport

Widget token/session flow:

APIM_SUBSCRIPTION_KEY=<testing APIM subscription key> \
npm run testing:smoke:apim -- --allow-widget-session

Stateful upload smoke requires an approved fixture and reset policy:

npm run testing:fixture:sdac-workbook
APIM_SUBSCRIPTION_KEY=<testing APIM subscription key> \
npm run testing:smoke:apim -- --allow-widget-upload --widget-upload-file <fixture.xlsx>

Bruno​

Bruno uses subscriptionKey and injects it as Ocp-Apim-Subscription-Key. Generated Bruno environment files are ignored and must not be committed with secrets.

npm run bruno:check-secrets

MCP​

Use local docs MCP stdio for discovery:

npm run docs:mcp:smoke -- --all

Testing APIM MCP transport is reachable at /ai/api/mcp/{serverId}/mcp and /ai/api/mcp/{serverId}/sse. The APIM registry endpoint /ai/mcp-servers.json currently returns 401, so use the committed MCP inventory for server discovery until registry auth is reconciled.