fix(terraform): keep prior state when the proxy rejects a virtual key update

[cursor]

TLDR

Problem this solves:

• A rejected /key/update still overwrote state with the planned values
• The next terraform plan then reported no changes and dropped the update silently
• TestResourceKeyUpdateFailureKeepsPriorState was failing on litellm_internal_staging

How it solves it:

• Call d.Partial(true) on the c.UpdateKey error branch, matching what fix(terraform): keep prior state when a virtual key update is rejected #40512 intended

User Flow

Before: an operator managing a litellm_key in Terraform edits budget_duration to a value the proxy rejects, and the next plan looks clean even though the change never landed

1. They set budget_duration = "bad" in their .tf and run terraform apply
2. POST /key/update returns 400 with Invalid budget_duration 'bad', apply prints an error
3. Terraform still writes budget_duration = "bad" into the state file
4. terraform plan on the next run reports "No changes" and the intended edit is silently dropped

After: the same rejection surfaces as an error and leaves the state alone, so the operator can fix the value and try again

1. They set budget_duration = "bad" in their .tf and run terraform apply
2. POST /key/update returns 400 with Invalid budget_duration 'bad', apply prints an error
3. State keeps the prior values, so budget_duration = "bad" is not persisted
4. terraform plan on the next run still shows the diff, giving the operator a chance to correct it

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

Before (87e2026)

1. cd terraform/provider && go test ./litellm/ -run TestResourceKeyUpdateFailureKeepsPriorState -v
2. Output:

--- FAIL: TestResourceKeyUpdateFailureKeepsPriorState (0.00s)
    resource_key_test.go:356: failed update persisted budget_duration="bad" into state, want it absent
FAIL
FAIL	github.com/BerriAI/terraform-provider-litellm/litellm	5.124s

After (9256018)

1. cd terraform/provider && go test ./litellm/ -run TestResourceKeyUpdateFailureKeepsPriorState -v
2. Output:

=== RUN   TestResourceKeyUpdateFailureKeepsPriorState
2026/09/10 04:04:04 Making POST request to http://127.0.0.1:32981/key/update with body:
{"aliases":{},"blocked":false,"budget_duration":"bad","key":"[REDACTED]","key_alias":"demo","model_max_budget":{},"models":["fake-model"],"permissions":{},"team_id":""}
2026/09/10 04:04:04 Response status: 400
2026/09/10 04:04:04 Response body: {"error":{"message":"Invalid budget_duration 'bad'"}}
--- PASS: TestResourceKeyUpdateFailureKeepsPriorState (0.00s)
PASS
ok  	github.com/BerriAI/terraform-provider-litellm/litellm	0.006s

3. Full package: go test ./... → ok github.com/BerriAI/terraform-provider-litellm/litellm 5.081s

Type

🐛 Bug Fix

Caveats (if any)

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!