using x-ms-apimTemplateParameter.urlTemplate, connector does not send webhook Delete request

[cagee]

We have built a connector that will be used by multiple host urls. When users create a connection for our connector, they will choose the host from the available option. 
For this we use x-ms-apimTemplateParameter.urlTemplate in apiProperties of our custom connector, which enables users to choose from API hosts addresses when they make a connection.

{
  "properties": {
    "connectionParameters": {
      "apiUrl": {
        "type": "string",
        "uiDefinition": {
          "constraints": {
            "required": "true",
            "tabIndex": 2,
            "allowedValues": [
              {"text": "Preprod", "value": "https://preprod.ourdomain.com"},
              {"text": "Test", "value": "https://test.ourdomain.com"}
            ]
          },
          "description": "Specifies the API Server URL that this connection will be used with.",
          "displayName": "Account hosted on",
          "tooltip": "Specifies the API Server URL that this connection will be used with."
        }
      },
    "iconBrandColor": "#7eac00",
    "capabilities": [],
    "policyTemplateInstances": [
      {
        "templateId": "dynamichosturl",
        "title": "API Server URL",
        "parameters": {
          "x-ms-apimTemplateParameter.urlTemplate": "@connectionParameters('apiUrl')/api"
        }
      }
    ]
  }
}

Every trigger, action and test works well when we create different connections for different hosts except that when user deletes a Flow or turns them off, the connector does not send delete webhook call to API if the host url of connection does not match the one in the apiDefinition.swagger.json file. 

  "host": "preprod.ourdomain.com"

The delete works only with the hosts that have their url in the swagger file as the main host url.

To test the theory we updated the host url in the connector's swagger file to the other host (test.ourdomain.com) and the delete calls are sent as soon as we update the connector, but then the other host does not send the delete calls. 


The delete Location headers are of course correctly sent as they work as soon as we change the host in the swagger file. This is 2 samples:

https://preprod.ourdomain.com/api/hook/v1/{hookId}
https://test.ourdomain.com/api/hook/v1/{hookId}

Can/should we choose a list of host names in the swagger file?
Do we need to set something else to be able to use the dynamic host policy feature and have the delete work properly?

[itdsk]

This post is pretty old but I am still running in the same problem. In my case the delete requests are called for both location headers but for the location that does not match the host in the apiDefinition.swagger.json the authorization is not send so it fails with a 401. I would expect that the authorization header form the connection is send to the webhook delete endpoint if the host of the location header matches the host specified with the "x-ms-apimTemplateParameter.urlTemplate" parameter. Is there any workaround?

[mszy-tribal]

This is still and issue for us too. I have managed to see the traffic coming and going and noticed that when the request is sent to the POST of the webhook we get a valid bearer token. However, when the DELETE request is made instead of it being a bearer token it is a Key token which bears no resemblance to a valid bearer token that we are expecting on our end. As a result the request is returned as a 401 and we are left with bad data in our system because it couldn't clean itself up.

Our workaround for this was to have an azure function that checks our event grid domain (which is what we are using to send requests to power automate) and monitors any requests that couldn't get through. Our function then removes the bad data. This is not ideal, it would be better if this problem could be resolved and power automate was responsible for cleaning up when the flow has been abandoned.

[itdsk]

Our workaround is:

- to return a location header containing a secret when the Webhooks is created (as url query Parameter)

- when the delete endpoint is called by the Power Automate connector using the location header, the call is unauthenticated  but contains the secret for this webhook, so the webhook can be deleted.

[mszy-tribal]

That's interesting, thanks for sharing 🙂