How to handle it 204 No Content response? internal validation failed; object ID is not set, but *may* have been created; this should never happen

[stanb]

I am getting errors when I try to create/update resource with PUT method for this API.
The HTTP response for specific MS Graph API is 204 No content for both PUT and PATCH requests. Both requests do not have "id". It's a separate endpoint to manage custom claims policy for specific service principal (application).
I get

provided object does not have an id set and the client is not configured to read the object from a POST or PUT response; please set write_returns_object to true, or include an id in the object's data

or

internal validation failed; object ID is not set, but *may* have been created; this should never happen

The error depends on different attempts to configure attribute_id and write_returns_object
How to handle 204 response?

provider "restapi" {
  alias = "put"
  uri = "https://graph.microsoft.com"
  write_returns_object = false
  headers = {
    Authorization = "Bearer ${data.external.graph_token.result.accessToken}"
    Content-Type  = "application/json"
  }

  create_method = "PUT"
  update_method = "PATCH"

  debug = true
}

# https://learn.microsoft.com/en-us/graph/api/serviceprincipal-put-claimspolicy?view=graph-rest-beta&tabs=http
resource "restapi_object" "app_api_claims_policy" {
  provider = "restapi.put"

  depends_on = [
    restapi_object.app_api_auth_extension_listener
  ]

  ignore_all_server_changes = true

  create_method = "PUT"
  update_method = "PATCH"

  path = "/beta/servicePrincipals/${azuread_service_principal.lightning_api_sp.object_id}/claimsPolicy"
  update_path = "/beta/servicePrincipals/${azuread_service_principal.lightning_api_sp.object_id}/claimsPolicy"

  data = jsonencode({
    "@odata.type" = "#microsoft.graph.customClaimsPolicy"
    "includeBasicClaimSet" = true,
    "claims" = [
      {
        "@odata.type" = "#microsoft.graph.customClaim"
        "name" = "customerId"
        "namespace" = null
        "tokenFormat" = ["jwt"]
        "samlAttributeNameFormat" = null
        "configurations" = [
          {
            "condition" = null
            "attribute" = {
              "@odata.type" = "#microsoft.graph.sourcedAttribute"
              "id" = "customerId"
              "source" = "customClaimsProvider"
              "isExtensionAttribute" = false
            },
            "transformations" = []
          }
        ]
      },
      {
        "@odata.type" = "#microsoft.graph.customClaim"
        "name" = "customerLicense"
        "namespace" = null
        "tokenFormat" = ["jwt"]
        "samlAttributeNameFormat" = null
        "configurations" = [
          {
            "condition" = null
            "attribute" = {
              "@odata.type" = "#microsoft.graph.sourcedAttribute"
              "id" = "customerLicense"
              "source" = "customClaimsProvider"
              "isExtensionAttribute" = false
            }
            "transformations" = []
          }
        ]
      }
    ]
  })

  debug = true
}

[stanb]

After investigating logs I found configuration that works.

The key solution was to set object_id to {parent entity}/claimsPolicy and explicitly configure each operation path:

  path         = "/beta/servicePrincipals"
  read_path    = "/beta/servicePrincipals/{id}"
  create_path  = "/beta/servicePrincipals/{id}"
  update_path  = "/beta/servicePrincipals/{id}"
  destroy_path = "/beta/servicePrincipals/{id}"

The path override logic is unclear for me and without path configurations request was going to /beta/servicePrincipals/{parent entity}/claimsPolicy/{parent entity}/claimsPolicy

provider "restapi" {
  uri                  = "https://graph.microsoft.com"
  write_returns_object = true
  headers = {
    Authorization = "Bearer ${data.external.graph_token.result.accessToken}"
    Content-Type  = "application/json"
  }

  create_method  = "POST"
  update_method  = "PATCH"
  destroy_method = "DELETE"

  debug = true
}

resource "restapi_object" "app_api_claims_policy" {
  depends_on = [
    restapi_object.app_api_auth_extension_listener
  ]

  ignore_all_server_changes = true

  object_id = "${azuread_service_principal.lightning_api_sp.object_id}/claimsPolicy"

  create_method  = "PUT"
  update_method  = "PATCH"
  destroy_method = "PUT"

  path         = "/beta/servicePrincipals"
  read_path    = "/beta/servicePrincipals/{id}"
  create_path  = "/beta/servicePrincipals/{id}"
  update_path  = "/beta/servicePrincipals/{id}"
  destroy_path = "/beta/servicePrincipals/{id}"

  data = jsonencode({
    "@odata.type"          = "#microsoft.graph.customClaimsPolicy"
    "includeBasicClaimSet" = true,
    "claims" = [
      {
        "@odata.type"             = "#microsoft.graph.customClaim"
        "name"                    = "customerId"
        "namespace"               = null
        "tokenFormat"             = ["jwt"]
        "samlAttributeNameFormat" = null
        "configurations" = [
          {
            "condition" = null
            "attribute" = {
              "@odata.type"          = "#microsoft.graph.sourcedAttribute"
              "id"                   = "customerId"
              "source"               = "customClaimsProvider"
              "isExtensionAttribute" = false
            },
            "transformations" = []
          }
        ]
      },
      {
        "@odata.type"             = "#microsoft.graph.customClaim"
        "name"                    = "customerLicense"
        "namespace"               = null
        "tokenFormat"             = ["jwt"]
        "samlAttributeNameFormat" = null
        "configurations" = [
          {
            "condition" = null
            "attribute" = {
              "@odata.type"          = "#microsoft.graph.sourcedAttribute"
              "id"                   = "customerLicense"
              "source"               = "customClaimsProvider"
              "isExtensionAttribute" = false
            }
            "transformations" = []
          }
        ]
      }
    ]
  })

  destroy_data = jsonencode({
    "@odata.type" = "#microsoft.graph.customClaimsPolicy"
    "claims"      = []
  })

  debug = true
}

[kaovd]

Hi !

I've been dealing with an API like this, actually also working on graph lol im just on private access right now

I mainly dealt with this by specifying what the resource id should be, but the API might not return it depending so similar to your challenge. I had an API using $ref at the end and had to read it from / without the additional $ref path, just noting here for anyone who has a similar issue