Exam AI-103 Topic 1 Question 58 Discussion

To ensure Microsoft Foundry automatically injects the API key from your project connection whenever the OpenAPI tool is invoked, your OpenAPI 3.0 specification must explicitly include a securitySchemes component mapping to the exact header name, and a global or operation-level security requirement referencing that scheme.The orchestrator matches the name field in the specification against the key stored inside your project's custom connection.
1. Required OpenAPI 3.0 Configuration
You must add both the components.securitySchemes block and the security block to your specification file:
openapi: 3.0.0
info:
title: External Weather Service
version: 1.0.0
paths:
/weather:
get:
operationId: getWeather
responses:
'200':
description: Successful weather retrieval
# 1. Define the security scheme in the components section
components:
*-> securitySchemes:
weatherApiKey: # Arbitrary logical identifier for this scheme
*-> type: apiKey
in: header
name: X-Weather-API-Key # MUST match the "key" name configured in your Foundry Connection
# 2. Apply the security requirement globally (or inside individual operations) security:
- weatherApiKey: [] # Instructs Foundry to enforce this scheme on the API requests in: header: Explicitly instructs the Foundry proxy layer to attach the credential value to the HTTP request headers (rather than as a query parameter).name: This string value is the exact HTTP header key (e.g., X-Weather-API-Key or Authorization). Crucially, this value must identically match the "Key" property given to the secret in your Microsoft Foundry Custom Connection.
security: Actively triggers the authentication workflow for the tool's endpoints. Without this block, Microsoft Foundry treats the API call as anonymous and strips out connection values.
Reference:
https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/tools/openapi