feat: adds missing endpoints to e2e api tests

[impoiler]

Summary

Briefly explain the purpose of this PR and the problem it solves.

Changes

• What was changed and why
• Any notable design decisions or trade-offs

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Describe the steps to validate this change. Include commands and expected outcomes.

# Core/Transports
go version
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

If adding new configs or environment variables, document them here.

Screenshots/Recordings

If UI changes, add before/after screenshots or short clips.

Breaking changes

• Yes
• No

If yes, describe impact and migration instructions.

Related issues

Link related issues and discussions. Example: Closes #123

Security considerations

Note any security implications (auth, secrets, PII, sandboxing, etc.).

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bcf1792a-7af9-4c9c-a6fd-5a8b6b60ab88

📥 Commits

Reviewing files that changed from the base of the PR and between d882596 and ac5f30f.

📒 Files selected for processing (5)

• tests/e2e/api/README.md
• tests/e2e/api/collections/bifrost-api-management.postman_collection.json
• tests/e2e/api/collections/collection-scripts.test.mjs
• tests/e2e/api/runners/run-newman-api-tests.sh
• tests/e2e/api/runners/set-auth-config.mjs

📝 Walkthrough

Summary by CodeRabbit

• Tests

  • Expanded Management API coverage for log dashboards, recalculation status, complexity settings, skills, webhooks, virtual-key restrictions, and MCP clients.
  • Improved validation of lifecycle operations, response handling, and deployment-dependent coverage checks.
  • API tests now support optional authentication setups and handle expected permission responses and empty virtual-key lists reliably.
  • Added validation for request scripts covering configuration, skills, webhooks, and response status checks.

• Documentation

  • Documented API coverage, enterprise-only routes, deterministic response requirements, and resource naming conventions.

Walkthrough

The PR expands Management API E2E coverage for observability, complexity analysis, Skills, and Webhooks. It adds collection-script tests and updates authentication setup for deployments without admin credentials.

Changes

Management API E2E coverage

Layer / File(s)	Summary
Conditional authentication setup tests/e2e/api/runners/set-auth-config.mjs, tests/e2e/api/runners/run-newman-api-tests.sh	Authentication setup detects available admin credentials. Exit code 3 skips the authenticated pass without failing the unauthenticated pass.
Collection contracts and request normalization tests/e2e/api/collections/bifrost-api-management.postman_collection.json	The collection updates plugin, virtual-key, and configuration assertions. It adds variables for Skills, complexity configuration, uploaded files, and Webhooks.
Management route coverage tests/e2e/api/README.md, tests/e2e/api/collections/bifrost-api-management.postman_collection.json	Coverage includes observability, complexity analyzer, Skills, Webhooks, lifecycle operations, dependent-request skips, and SPA-fallback checks.
Collection script validation tests/e2e/api/collections/collection-scripts.test.mjs	A standalone Node.js test validates prerequest parsing, identifier capture, status gates, plugin exceptions, and cache probe exceptions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: akshaydeo, pratham-mishra04

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The changes add management, skills, webhooks, complexity, and MCP coverage, but provide no evidence of implementing the required Files API support in issue #123.	Add coverage or implementation for the Files API, including the required file upload workflow such as POST /v1/files for supported providers.
Out of Scope Changes check	⚠️ Warning	Most changes target management API, skills, webhooks, complexity, logs, and MCP coverage, which are unrelated to the Files API objective in issue #123.	Limit the PR to Files API support and its tests, or update the linked issues to document the additional endpoint coverage objectives.
Description check	⚠️ Warning	The description contains only the unfilled template and does not document the changes, testing steps, affected areas, or risks.	Replace the default template with a completed summary, change list, affected areas, testing steps, breaking-change status, security considerations, and checklist.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the main change: adding missing endpoint coverage to end-to-end API tests.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 08-04-feat_adds_missing_endpoints_to_e2e_api_tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[impoiler]

• refactor: generate OpenAPI JSON and docs.json #5650 : 2 dependent PRs (#5652 , #6017 )
• docs: add governance API namespace migration guide #5841
• docs(openapi): add missing management endpoints and split governance specs #5840
• refactor(governance): allow editions to override governance route families #5839
• chore(docs): add OpenAPI bundler and Mintlify nav sync scripts #5838
• feat: adds missing endpoints to e2e api tests #5831 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 5

🧹 Nitpick comments (1)

tests/e2e/api/runners/run-newman-api-tests.sh (1)

528-533: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Quote the comparisons and name the skip exit code.

Shellcheck reports SC2086 on both tests. AUTH_SETUP_EXIT comes from $?, so word splitting is not reachable, but quoting clears the linter. The value 3 also duplicates EXIT_SKIP in tests/e2e/api/runners/set-auth-config.mjs. A named constant documents the cross-file contract.

♻️ Proposed change

+# Must match EXIT_SKIP in runners/set-auth-config.mjs.
+AUTH_SETUP_EXIT_SKIP=3
     # Exit 3 means the auth pass cannot run here (fresh database, no bootstrap
     # token). That is a coverage gap, not a test failure -- do not fail a run
     # whose unauthenticated pass was green.
-    if [ $AUTH_SETUP_EXIT -eq 3 ]; then
+    if [ "$AUTH_SETUP_EXIT" -eq "$AUTH_SETUP_EXIT_SKIP" ]; then
         echo -e "${YELLOW}Skipping authenticated API management pass (see message above).${NC}" | tee -a "$LOG_FILE"
-    elif [ $AUTH_SETUP_EXIT -ne 0 ]; then
+    elif [ "$AUTH_SETUP_EXIT" -ne 0 ]; then

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/e2e/api/runners/run-newman-api-tests.sh` around lines 528 - 533, Update
the AUTH_SETUP_EXIT comparisons in the authenticated API management pass to
quote the variable, clearing SC2086, and replace the literal skip value 3 with a
named EXIT_SKIP constant matching set-auth-config.mjs. Preserve the existing
skip behavior for the named exit code and failure handling for other nonzero
results.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/e2e/api/collections/bifrost-api-management.postman_collection.json`:
- Around line 5135-5158: Update the “Cleanup Orphan Skill Files” request to
avoid deleting orphaned files belonging to other runs: either scope cleanup to
the unique skill name created by this test run, or verify and enforce that the
runner uses a dedicated server before retaining the global force=true cleanup.
Preserve isolation for parallel suites in line with the existing
Date.now()-based skill naming.
- Around line 4696-4711: Guard response parsing and nested identifier access in
all three Postman test scripts:
tests/e2e/api/collections/bifrost-api-management.postman_collection.json#L4696-L4711
should set skill_id only when body.skill.id exists; `#L4621-L4638` should catch
parse or missing-field failures and default skill_upload_storage_key and
skill_upload_blob_id to empty strings; and `#L5263-L5277` should set webhook_id
only when body.endpoint.id exists. Keep failures from throwing unhandled script
errors and preserve the existing successful-response assertions.
- Around line 4110-4121: Update the prerequest script for the complexity
configuration request to validate that complexity_config_json is present and
parses successfully before accessing it; if absent or invalid, call
pm.execution.skipRequest() and stop processing. Also verify current.keywords
exists before reading simple_keywords, while preserving the existing e2eprobe
injection for valid configurations.

In `@tests/e2e/api/README.md`:
- Around line 119-120: Update the resource-naming logic described in the README
to append a per-worker, per-run, or otherwise collision-resistant unique suffix
in addition to Date.now(). Ensure every parallel Newman process generates
distinct collection resource names and preserves the existing replay behavior.
- Around line 109-117: Update the status guidance in the README section
describing lifecycle requests and “(Coverage Probe)” requests to match the
collection script: coverage probes may accept 2xx or 4xx/5xx responses rather
than any status, and explicitly document the permitted 404/403 exceptions for
before-create, MCP, and plugin requests without the suffix.

---

Nitpick comments:
In `@tests/e2e/api/runners/run-newman-api-tests.sh`:
- Around line 528-533: Update the AUTH_SETUP_EXIT comparisons in the
authenticated API management pass to quote the variable, clearing SC2086, and
replace the literal skip value 3 with a named EXIT_SKIP constant matching
set-auth-config.mjs. Preserve the existing skip behavior for the named exit code
and failure handling for other nonzero results.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a63ddd9-8040-46a5-a448-48da3322d735

📥 Commits

Reviewing files that changed from the base of the PR and between 041817a and 03edfd6.

📒 Files selected for processing (4)

• tests/e2e/api/README.md
• tests/e2e/api/collections/bifrost-api-management.postman_collection.json
• tests/e2e/api/runners/run-newman-api-tests.sh
• tests/e2e/api/runners/set-auth-config.mjs

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/e2e/api/collections/collection-scripts.test.mjs`:
- Around line 1-3: Move collection-scripts.test.mjs out of tests/e2e into the
appropriate non-E2E test location, preserving its standalone Node.js execution
and test behavior; do not add the E2E fixture unless converting it to run
through the required E2E framework.
- Around line 1-3: Move collection-scripts.test.mjs out of tests/e2e/ into a
standalone validation location, unless you also wire it into the managed E2E
pipeline with the required base.fixture import and E2E conventions. Ensure the
chosen location and invocation clearly match how CI executes the validation.
- Around line 136-148: Update the complexityPrerequest test fixture to use an
ordered JSON string directly instead of JSON.stringify, and compare
ctx.pm.request.body.raw against the expected ordered JSON string. Remove the
JSON.parse-based field assertions while preserving the existing skipped-state
assertion and expected e2eprobe injection.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 362ce412-af06-48e3-844a-3459a833d608

📥 Commits

Reviewing files that changed from the base of the PR and between e66d4e0 and 7eeea55.

📒 Files selected for processing (3)

• tests/e2e/api/README.md
• tests/e2e/api/collections/bifrost-api-management.postman_collection.json
• tests/e2e/api/collections/collection-scripts.test.mjs

🚧 Files skipped from review as they are similar to previous changes (2)

• tests/e2e/api/README.md
• tests/e2e/api/collections/bifrost-api-management.postman_collection.json

The merge-base changed after approval.

[akshaydeo]

Merge activity

• Aug 11, 7:01 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Aug 11, 7:01 AM UTC: @akshaydeo merged this pull request with Graphite.