Skip to content

fix(12): drop az apim extension dependency in deploy-o3-backend#12

Merged
corticalstack merged 5 commits into
mainfrom
fix/deep-research-apim-key-lookup
May 27, 2026
Merged

fix(12): drop az apim extension dependency in deploy-o3-backend#12
corticalstack merged 5 commits into
mainfrom
fix/deep-research-apim-key-lookup

Conversation

@corticalstack
Copy link
Copy Markdown
Owner

Summary

12-foundry-iq-deep-research/12-01-deploy-o3-backend.ipynb failed on Step 5 with:

ERROR: 'subscription' is misspelled or not recognized by the system.
RuntimeError: Could not retrieve APIM subscription key. Check az login and hub RG.

Root cause: the cell used az apim subscription list-secrets, which requires the apim Azure CLI extension. The base CLI doesn't include it. Step 3's az apim backend show had the same dependency.

Rewrote both calls to use az rest against the ARM management endpoint - the same pattern already used by 10-01-deploy-search-and-project.ipynb and 11-01-deploy-setup.ipynb. Step 2 now also resolves SUB_ID and an APIM_BASE_URI helper used by Steps 3 and 5. No new dependencies; works with the base Azure CLI.

Verified manually: against the same APIM service that produced the original error, the az rest POST to …/subscriptions/foundry-gateway-alpha/listSecrets returns the expected primary key.

Known related issue (not in this PR)

09-content-understanding-integration/09-01-deploy-setup.ipynb has the same systemic bug (az apim show ... --query identity.principalId). Same fix applies. Flagged as a follow-up to keep this PR focused on the reported failure. 05-02-01-deploy-foundry-core-gateway.ipynb also references az apim deletedservice list/purge but only in commented-out cleanup cells, so not on the hot path.

Patch release 0.8.4.

Test plan

  • Re-run cells 1-5 of 12-01-deploy-o3-backend.ipynb end-to-end
  • Step 3 reports either "backend already exists" or "will deploy main.bicep" without errors
  • Step 5 either picks up foundry-gateway-dr or falls back to foundry-gateway-alpha cleanly, then writes DR_GATEWAY_KEY to .env

12-01-deploy-o3-backend.ipynb failed on Step 5 with
"'subscription' is misspelled or not recognized" because
`az apim subscription list-secrets` requires the `apim` Azure
CLI extension that is not part of the base CLI.

Rewrote Steps 3 and 5 to use `az rest` against the ARM management
endpoint, matching the pattern already used by 10-01 and 11-01.
Step 2 now also resolves SUB_ID and an APIM_BASE_URI helper used by
the two ARM calls. No new dependencies; works with the base Azure CLI.
The original SKU capacity of 10 (= 10K TPM) throttled multi-step
deep-research runs with 429 errors before completion. Raised to
200 (= 200K TPM) in both Bicep files that define the deployment:

- 05-foundry-project-pattern-setup/05-02-deploy-foundry-core-gateway/main.bicep
- 12-foundry-iq-deep-research/main.bicep

The new value stays well under the Norway East o3-DeepResearch
subscription quota (limit 3000). Existing live deployments must be
updated separately, either by a fresh bicep apply or via:

  az cognitiveservices account deployment update \
    -g rg-foundry-core-{suffix} -n aif-research-{suffix} \
    --deployment-name o3-deep-research --sku-capacity 200
…pacity

fix(05,12): raise o3-deep-research TPM capacity from 10 to 200
@corticalstack corticalstack merged commit ba6f772 into main May 27, 2026
1 of 2 checks passed
@corticalstack corticalstack deleted the fix/deep-research-apim-key-lookup branch May 27, 2026 12:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant