Updating APIs fails

We are using Tyk 4.1 open source edition.

  1. We have added apps successfully through the Gateway API
  2. They show up when we call /tyk/apis endpoint.
  3. They show up when we call the /tyk/apis/:apiID endpoint with a GET.
  4. Whenever we call /tyk/apis/:apiID with a PUT, and the body has a change, we get:
    “status”: “error”,
    “message”: “Request APIID does not match that in Definition! For Update operations these must match.”

The documentation indicates that it might be looking for an internal ID of the app - however I can’t find that id in any of the endpoints. Any ideas?

@Hank_Birkdale ,

Thanks for posting your question in our community. It seems that I can’t replicate your issue on my end. Can you provide the payload you are using?

Hi @Page

Here is the payload we used to create the api using the POST on the tyk/apis endpoint. This worked no problem:

    "name": "Liquid FI",
    "slug": "LiquidFI",
    "api_id": "LFI-05a",
    "org_id": "Liquid Mortgage",
    "use_keyless": false,
    "use_oauth2": false,
    "use_openid": false,
    "openid_options": {
        "providers": [],
        "segregate_by_client": false
    "oauth_meta": {
        "allowed_access_types": [],
        "allowed_authorize_types": [],
        "auth_login_redirect": ""
    "auth": {
        "use_param": false,
        "param_name": "",
        "use_cookie": false,
        "cookie_name": "",
        "auth_header_name": "Authorization",
        "use_certificate": false
    "use_basic_auth": true,
    "use_mutual_tls_auth": false,
    "client_certificates": [],
    "upstream_certificates": {},
    "enable_jwt": false,
    "use_standard_auth": false,
    "enable_coprocess_auth": false,
    "jwt_signing_method": "",
    "jwt_source": "",
    "jwt_identity_base_field": "",
    "jwt_client_base_field": "",
    "jwt_policy_field_name": "",
    "notifications": {
        "shared_secret": "",
        "oauth_on_keychange_url": ""
    "enable_signature_checking": false,
    "hmac_allowed_clock_skew": -1,
    "base_identity_provided_by": "",
    "definition": {
        "location": "header",
        "key": "x-api-version"
    "version_data": {
        "not_versioned": true,
        "versions": {
            "Default": {
                "name": "Default",
                "expires": "",
                "paths": {
                    "ignored": [],
                    "white_list": [],
                    "black_list": []
                "use_extended_paths": false,
                "extended_paths": {},
                "global_headers": {},
                "global_headers_remove": [],
                "ignore_endpoint_case": false,
                "global_size_limit": 0,
                "override_target": ""
    "uptime_tests": {
        "check_list": [],
        "config": {
            "expire_utime_after": 0,
            "service_discovery": {
                "use_discovery_service": false,
                "query_endpoint": "",
                "use_nested_query": false,
                "parent_data_path": "",
                "data_path": "",
                "port_data_path": "",
                "target_path": "",
                "use_target_list": false,
                "cache_timeout": 60,
                "endpoint_returns_list": false
            "recheck_wait": 0
    "proxy": {
        "preserve_host_header": false,
        "listen_path": "/blockberg/",
        "target_url": "http://blockberg.bb-local:3333/",
        "strip_listen_path": true,
        "enable_load_balancing": false,
        "target_list": [],
        "check_host_against_uptime_tests": false,
        "service_discovery": {
            "use_discovery_service": false,
            "query_endpoint": "",
            "use_nested_query": false,
            "parent_data_path": "",
            "data_path": "",
            "port_data_path": "",
            "target_path": "",
            "use_target_list": false,
            "cache_timeout": 0,
            "endpoint_returns_list": false
    "disable_rate_limit": false,
    "disable_quota": false,
    "custom_middleware": {
        "pre": [],
        "post": [],
        "post_key_auth": [],
        "auth_check": {
            "name": "",
            "path": "",
            "require_session": false
        "response": [],
        "driver": "",
        "id_extractor": {
            "extract_from": "",
            "extract_with": "",
            "extractor_config": {}
    "custom_middleware_bundle": "",
    "cache_options": {
        "cache_timeout": 60,
        "enable_cache": true,
        "cache_all_safe_requests": false,
        "cache_response_codes": [],
        "enable_upstream_cache_control": false
    "session_lifetime": 0,
    "active": true,
    "auth_provider": {
        "name": "",
        "storage_engine": "",
        "meta": {}
    "session_provider": {
        "name": "",
        "storage_engine": "",
        "meta": {}
    "event_handlers": {
        "events": {}
    "enable_batch_request_support": false,
    "enable_ip_whitelisting": false,
    "allowed_ips": [],
    "dont_set_quota_on_create": false,
    "expire_analytics_after": 0,
    "response_processors": [],
    "CORS": {
        "enable": false,
        "allowed_origins": [],
        "allowed_methods": [],
        "allowed_headers": [],
        "exposed_headers": [],
        "allow_credentials": false,
        "max_age": 24,
        "options_passthrough": false,
        "debug": false
    "domain": "",
    "do_not_track": false,
    "tags": [],
    "enable_context_vars": true,
    "config_data": {},
    "tag_headers": [],
    "global_rate_limit": {
        "rate": 0,
        "per": 0
    "strip_auth_data": true

Here is the cURL using the PUT at /tyk/apis/LFI-05a:(I’ve removed the X-Tyk-Authorization value)

curl --location --request PUT 'https://tyk.dev.liquidmortgage.com/tyk/apis/LFI-05a' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'X-Tyk-Authorization: xxxxxxxx' \
--data-raw '{
"active": false

When you do that I get:

    "status": "error",
    "message": "Request APIID does not match that in Definition! For Update operations these must match."

NOTE: I can actually update the API using the POST tyk/apis endpoint and changing values there, but it looks like I need to provide all the values - I can’t just update a single config variable like the PUT /tyk/apis/:api_Id implies. Thanks

@Hank_Birkdale Thanks for sharing your payload. It seems the api_id is required in the payload for PUT requests. The bare minimum below should work

  "api_id": "LFI-05a",
  "active": true

That was it @Olu - thanks!

Hi @Olu, et al…

question about the update… if I were to send in just that little snippet of JSON, would that complete wipe away any other settings I have on that specific API… or will it merge just the keys I have specified in the PUT… I was looking at the Gateway source… and it didn’t look like it was doing a “merge”, just a complete update of the .json file

It’s a merge. You just have to be careful when updating fields with an object value, since it would be a complete replacement of the property

1 Like

Perfect! Thank you very much for the reply.