fix(terraform): keep prior state when the proxy rejects a virtual key update

[devin-ai-integration]

TLDR

Problem this solves:

• Rejected /key/update still wrote planned values into Terraform state
• Next terraform plan showed "No changes" and silently dropped the edit
• TestResourceKeyUpdateFailureKeepsPriorState fails on litellm_internal_staging (broken by fix(terraform): keep prior state when a virtual key update is rejected #40512)

How it solves it:

• Call d.Partial(true) on the c.UpdateKey error branch of resourceKeyUpdate, as fix(terraform): keep prior state when a virtual key update is rejected #40512 intended

User Flow

Before: an operator editing a litellm_key gets a rejected update that still looks applied on the next plan

1. They set budget_duration = "bad" on their litellm_key and run terraform apply
2. The provider sends POST http://localhost:4000/key/update and gets 400 Invalid budget_duration 'bad', apply prints the error
3. The state file now holds budget_duration = "bad" anyway
4. terraform plan reports "No changes", so the broken value is never revisited

After: the same rejection leaves state untouched so the diff keeps showing up

1. They set budget_duration = "bad" on their litellm_key and run terraform apply
2. The provider sends POST http://localhost:4000/key/update and gets 400 Invalid budget_duration 'bad', apply prints the error
3. The state file still holds the previous budget_duration
4. terraform plan still shows the pending change, so the operator can correct it

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

The regression test drives the real provider update path against an HTTP server that answers /key/update with the proxy's 400, then inspects the resulting state

Before (69245fe)

1. cd terraform/provider && go test ./litellm/ -run TestResourceKeyUpdateFailureKeepsPriorState -v
2. Output:

2026/09/10 04:13:29 Making POST request to http://127.0.0.1:35755/key/update with body:
{"aliases":{},"blocked":false,"budget_duration":"bad","key":"[REDACTED]","key_alias":"demo","model_max_budget":{},"models":["fake-model"],"permissions":{},"team_id":""}
2026/09/10 04:13:29 Response status: 400
2026/09/10 04:13:29 Response body: {"error":{"message":"Invalid budget_duration 'bad'"}}
--- FAIL: TestResourceKeyUpdateFailureKeepsPriorState (0.00s)
    resource_key_test.go:356: failed update persisted budget_duration="bad" into state, want it absent
FAIL

After (2cf6f47)

1. cd terraform/provider && gofmt -l . && go vet ./... && go test ./...
2. Output:

ok  	github.com/BerriAI/terraform-provider-litellm/litellm	5.093s
ok  	github.com/BerriAI/terraform-provider-litellm/tools/endpointaudit	0.003s

Type

🐛 Bug Fix

Caveats (if any)

Low

• Same one-line fix as the Cursor autofix draft fix(terraform): keep prior state when the proxy rejects a virtual key update #40538; close whichever one does not land

Link to Devin session: https://app.devin.ai/sessions/ec91c5ef3b2c4b7793fc1b346b989b12
Open in Devin Desktop: https://app.devin.ai/desktop/session/ec91c5ef3b2c4b7793fc1b346b989b12?variant=devin
Requested by: @yassin-berriai

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

The PR enables Terraform partial-state handling when a virtual-key update fails, preventing rejected planned values from replacing the prior state

• The change is limited to the UpdateKey error path
• Successful updates retain the existing read-after-update behavior
• No security issues or repository-rule violations were identified

Confidence Score: 5/5

The PR appears safe to merge and correctly preserves prior state after failed virtual-key updates

The partial-state call is made before returning the update diagnostic, while the successful update path remains unchanged

Important Files Changed

Filename	Overview
terraform/provider/litellm/resource_key.go	Preserves prior Terraform state when the proxy rejects or fails a virtual-key update

_{Reviews (1): Last reviewed commit: "fix(terraform): keep prior state when th..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!