Refactor HarnessApiClient to require harness_token for authentication in harness mode, removing support for apikey. Update README and tests to reflect changes in authentication requirements and usage.

Author: kleinjoshuaa

CHANGES.txt

@@ -3,7 +3,7 @@ CHANGELOG
 
 This file tracks the version history and changes made to the Split/Harness FME Python API Client library.
 
-3.5.8 (December 5, 2025)
+3.5.8 (December 10, 2025)
 -------------------------
 Features:
 - Added optional org_identifier and project_identifier support for Harness microclients
@@ -12,7 +12,10 @@ Features:
   - When not provided, they are completely omitted from URLs rather than being passed as empty strings
   - Applies to all Harness microclients: harness_project, harness_user, harness_group, 
     harness_apikey, service_account, token, role, resource_group, and role_assignment
-Added filterType support to the group endpoint
+
+- Added filterType support to the group endpoint in order to allow fitlering by resourcegroups
+- Update the client instantiation to warn when using the legacy bearer auth along with the x-api-key auth 
+
 
 3.5.7 (November 26, 2025)
 -------------------------

README.md

@@ -8,18 +8,17 @@ Full documentation on this Python wrapper is available in [this link](https://he
 
 ## Using in Harness Mode
 
-Starting with version 3.5.0, the Split API client supports operating in "harness mode" to interact with both Split and Harness APIs. This is required for usage in environments that have been migrated to Harness and want to use the new features. Existing API keys will continue to work with the non-deprecated endpoints after migration, but new Harness Tokens will be required for Harness mode.
+Starting with version 3.5.0, the Split API client supports operating in "harness mode" to interact with both Split and Harness APIs. This is required for usage in environments that have been migrated to Harness and want to use the new features.
 
 For detailed information about Harness API endpoints, please refer to the [official Harness API documentation](https://apidocs.harness.io/).
 
 ### Authentication in Harness Mode
 
-The client supports multiple authentication scenarios:
+**Important:** Harness mode requires a `harness_token` (Harness API key). Split API keys (`apikey`) are **not supported** in harness mode.
 
-1. Harness-specific endpoints always use the 'x-api-key' header format
-2. Split endpoints will use the 'x-api-key' header when using the harness_token
-3. Split endpoints will use the normal 'Authorization' header when using the apikey
-4. If both harness_token and apikey are provided, the client will use the harness_token for Harness endpoints and the apikey for Split endpoints
+If your account has been migrated to Harness, you should create a new Harness API key to use with this client. The `harness_token` is used for both Split API endpoints and Harness-specific endpoints via the `x-api-key` header.
+
+For non-migrated accounts that need to use Split API keys with Bearer authentication, use the standard (non-harness) mode instead.
 
 ### Base URLs and Endpoints
 
@@ -44,22 +43,14 @@ To use the client in harness mode:
 ```python
 from splitapiclient.main import get_client
 
-# Option 1: Use harness_token for Harness endpoints and apikey for Split endpoints
+# Basic harness mode setup with required harness_token
 client = get_client({
     'harness_mode': True,
-    'harness_token': 'YOUR_HARNESS_TOKEN',  # Used for Harness-specific endpoints
-    'apikey': 'YOUR_SPLIT_API_KEY',         # Used for existing Split endpoints
+    'harness_token': 'YOUR_HARNESS_TOKEN',  # Required: Harness API key
     'account_identifier': 'YOUR_HARNESS_ACCOUNT_ID'  # Required for Harness operations
 })
 
-# Option 2: Use harness_token for all operations (if apikey is not provided)
-client = get_client({
-    'harness_mode': True,
-    'harness_token': 'YOUR_HARNESS_TOKEN',  # Used for both Harness and Split endpoints
-    'account_identifier': 'YOUR_HARNESS_ACCOUNT_ID'
-})
-
-# Option 3: Include optional org_identifier and project_identifier
+# Include optional org_identifier and project_identifier
 client = get_client({
     'harness_mode': True,
     'harness_token': 'YOUR_HARNESS_TOKEN',

splitapiclient/main/harness_apiclient.py

@@ -1,5 +1,6 @@
 from __future__ import absolute_import, division, print_function, \
     unicode_literals
+import warnings
 from splitapiclient.main.apiclient import BaseApiClient
 from splitapiclient.http_clients.harness_client import HarnessHttpClient
 from splitapiclient.util.exceptions import InsufficientConfigArgumentsException
@@ -45,10 +46,12 @@ def __init__(self, config):
         Class constructor.
 
         :param config: Dictionary containing options required to instantiate
-            the API client. Should have AT LEAST one of the following keys:
-                - 'apikey': Split API key for authentication with Split endpoints
-                - 'harness_token': Harness authentication token used for x-api-key header with Harness endpoints
-                  If harness_token is not provided, apikey will be used for all operations
+            the API client. Required keys:
+                - 'harness_token': Harness authentication token used for x-api-key header
+                  This token is used for both Split API and Harness API endpoints.
+                  Note: Split API keys (apikey) are not supported in harness mode.
+                  Migrated accounts should create new Harness API keys.
+            Optional keys:
                 - 'base_url': Base url where the Split API is hosted (optional, defaults to Split URL)
                 - 'base_url_v3': Base url where the Split API v3 is hosted (optional, defaults to Split URL)
                 - 'harness_base_url': Base url where the Harness API is hosted (optional, defaults to Harness URL)
@@ -74,32 +77,28 @@ def __init__(self, config):
         else:
             self._harness_base_url = self.BASE_HARNESS_URL
 
-        # Check if at least one authentication method is provided
-        if 'apikey' not in config and 'harness_token' not in config:
+        # Require harness_token in harness mode
+        if 'harness_token' not in config:
             raise InsufficientConfigArgumentsException(
-                'At least one of the following keys must be present in the config dict for harness mode: apikey, harness_token'
+                'harness_token is required in harness mode. Split API keys (apikey) are not supported by this client. '
+                'Please create a Harness API key for your migrated account and use the harness_token for authentication.'
             )
 
-        # Set up authentication tokens
-        self._apikey = config.get('apikey')
-        self._harness_token = config.get('harness_token')
-        
-        # If harness_token is not provided, use apikey for all operations
-        # If apikey is not provided, use harness_token for all operations
-        split_auth_token = self._apikey if self._apikey else self._harness_token
-        harness_auth_token = self._harness_token if self._harness_token else self._apikey
+        # Use harness_token for all operations
+        self._harness_token = config['harness_token']
+        auth_token = self._harness_token
 
         # Store the account identifier, org identifier, and project identifier
         self._account_identifier = config.get('account_identifier')
         self._org_identifier = config.get('org_identifier')
         self._project_identifier = config.get('project_identifier')
 
-        # Create HTTP clients for Split endpoints
-        split_http_client = HarnessHttpClient(self._base_url, split_auth_token)
-        split_http_clientv3 = HarnessHttpClient(self._base_url_v3, split_auth_token)
+        # Create HTTP clients - use same token for both Split and Harness endpoints
+        split_http_client = HarnessHttpClient(self._base_url, auth_token)
+        split_http_clientv3 = HarnessHttpClient(self._base_url_v3, auth_token)
 
         # Create HTTP client for Harness endpoints
-        harness_http_client = HarnessHttpClient(self._harness_base_url, harness_auth_token)
+        harness_http_client = HarnessHttpClient(self._harness_base_url, auth_token)
 
         # Standard microclients using Split endpoints
         self._environment_client = EnvironmentMicroClient(split_http_client)

splitapiclient/tests/main/test_harness_apiclient_resources.py

@@ -24,7 +24,6 @@ def test_harness_resource_properties(self, mocker):
 
         # Create a HarnessApiClient with minimal config
         client = HarnessApiClient({
-            'apikey': 'test-apikey',
             'harness_token': 'test-harness-token'
         })
 
@@ -49,7 +48,6 @@ def test_harness_resource_operations(self, mocker):
 
         # Create a HarnessApiClient with minimal config
         client = HarnessApiClient({
-            'apikey': 'test-apikey',
             'harness_token': 'test-harness-token',
             'account_identifier': 'test-account-identifier'
         })
@@ -446,7 +444,6 @@ def test_harness_pagination(self, mocker):
         # Create a HarnessApiClient with mocked HTTP client
         client = HarnessApiClient({
             'harness_token': 'test-harness-token',
-            'apikey': 'test-apikey',
             'base_url': 'test-host',
             'harness_base_url': 'test-harness-host',
             'account_identifier': 'test-account-identifier'
@@ -534,50 +531,51 @@ def test_harness_pagination(self, mocker):
 
     def test_harness_authentication_modes(self, mocker):
         '''
-        Test that the HarnessApiClient properly handles different authentication modes
+        Test that the HarnessApiClient properly handles authentication requirements
         '''
         # Mock the HTTP client initialization to avoid actual HTTP requests
         mocker.patch('splitapiclient.http_clients.harness_client.HarnessHttpClient.__init__', return_value=None)
 
-        # Test with both apikey and harness_token
-        client1 = HarnessApiClient({
-            'apikey': 'test-apikey',
+        # Test with harness_token - should work
+        client = HarnessApiClient({
             'harness_token': 'test-harness-token'
         })
 
-        # Verify that the HTTP client was initialized correctly for client1
+        # Verify that the HTTP client was initialized correctly
         from splitapiclient.http_clients.harness_client import HarnessHttpClient
 
-        # For client1, harness_token should be used for Harness endpoints
-        harness_client1_calls = [
+        # harness_token should be used for all endpoints (both Harness and Split)
+        harness_client_calls = [
             call for call in HarnessHttpClient.__init__.call_args_list 
-            if call[0][0] == 'https://app.harness.io/' and call[0][1] == 'test-harness-token'
+            if call[0][1] == 'test-harness-token'
         ]
-        assert len(harness_client1_calls) > 0
-        
-        # Reset the mock before creating client2
-        HarnessHttpClient.__init__.reset_mock()
+        # Should be called 3 times: Split v2, Split v3, and Harness endpoints
+        assert len(harness_client_calls) == 3
+        
+        # Verify that the client has all the Harness resource properties
+        assert hasattr(client, 'token')
+        assert hasattr(client, 'harness_apikey')
+        assert hasattr(client, 'service_account')
+        assert hasattr(client, 'harness_user')
+        assert hasattr(client, 'harness_group')
+        assert hasattr(client, 'role')
+        assert hasattr(client, 'resource_group')
+        assert hasattr(client, 'role_assignment')
+        assert hasattr(client, 'harness_project')
 
-        # Test with only apikey
-        client2 = HarnessApiClient({
-            'apikey': 'test-apikey'
-        })
+    def test_harness_mode_requires_harness_token(self, mocker):
+        '''
+        Test that harness_token is required and apikey alone raises an error
+        '''
+        from splitapiclient.util.exceptions import InsufficientConfigArgumentsException
 
-        # Verify that both clients have all the Harness resource properties
-        for client in [client1, client2]:
-            assert hasattr(client, 'token')
-            assert hasattr(client, 'harness_apikey')
-            assert hasattr(client, 'service_account')
-            assert hasattr(client, 'harness_user')
-            assert hasattr(client, 'harness_group')
-            assert hasattr(client, 'role')
-            assert hasattr(client, 'resource_group')
-            assert hasattr(client, 'role_assignment')
-            assert hasattr(client, 'harness_project')
-        
-        # For client2, apikey should be used for Harness endpoints
-        harness_client2_calls = [
-            call for call in HarnessHttpClient.__init__.call_args_list 
-            if call[0][0] == 'https://app.harness.io/' and call[0][1] == 'test-apikey'
-        ]
-        assert len(harness_client2_calls) > 0
+        # Mock the HTTP client initialization to avoid actual HTTP requests
+        mocker.patch('splitapiclient.http_clients.harness_client.HarnessHttpClient.__init__', return_value=None)
+        
+        # Test with only apikey - should raise an error
+        with pytest.raises(InsufficientConfigArgumentsException) as excinfo:
+            HarnessApiClient({
+                'apikey': 'test-apikey'
+            })
+        
+        assert 'harness_token is required' in str(excinfo.value)

splitapiclient/tests/microclients/harness/deprecated_endpoints_test.py

@@ -24,7 +24,6 @@ def test_workspace_endpoints_deprecated_in_harness_mode(self, mocker):
 
         # Create a HarnessApiClient
         client = HarnessApiClient({
-            'apikey': 'abc',
             'harness_token': 'abc'
         })
 
@@ -138,7 +137,7 @@ class TestAuthenticationInHarnessMode:
 
     def test_harness_token_used_for_harness_endpoints(self, mocker):
         """
-        Test that harness_token is used for Harness endpoints and apikey for Split endpoints
+        Test that harness_token is used for all endpoints (both Harness and Split)
         """
         # Create a custom HTTP client class for testing
         class TestHttpClient(HarnessHttpClient):
@@ -147,13 +146,7 @@ def __init__(self, baseurl, auth_token):
                 self.auth_token = auth_token
                 # Initialize with empty config
                 self.config = {'base_args': {}}
-                
-                # For Harness HTTP client, set x-api-key in base_args
-                if 'harness' in baseurl:
-                    self.config['base_args'] = {'x-api-key': auth_token}
-                else:
-                    # For Split HTTP client, we'll check Authorization header in make_request
-                    pass
+                self.config['base_args'] = {'x-api-key': auth_token}
 
             def make_request(self, endpoint, body=None, **kwargs):
                 # Just return a successful response without making actual requests
@@ -168,57 +161,28 @@ def make_request(self, endpoint, body=None, **kwargs):
         mocker.patch('splitapiclient.http_clients.harness_client.HarnessHttpClient.make_request', 
                     TestHttpClient.make_request)
 
-        # Create client with both harness_token and apikey
+        # Create client with harness_token only
         client = HarnessApiClient({
-            'harness_token': 'harness_token_value',
-            'apikey': 'api_key_value'
+            'harness_token': 'harness_token_value'
         })
 
-        # Check that the Harness HTTP client was initialized with harness_token
+        # Check that all HTTP clients were initialized with harness_token
         assert client._token_client._http_client.auth_token == 'harness_token_value'
-        
-        # Check that the Split HTTP client was initialized with apikey
-        assert client._split_client._http_client.auth_token == 'api_key_value'
+        assert client._split_client._http_client.auth_token == 'harness_token_value'
 
     def test_apikey_fallback_when_no_harness_token(self, mocker):
         """
-        Test that apikey is used for all operations when harness_token is not provided
+        Test that harness_token is required and apikey alone raises an error
         """
-        # Create a custom HTTP client class for testing
-        class TestHttpClient(HarnessHttpClient):
-            def __init__(self, baseurl, auth_token):
-                self.baseurl = baseurl
-                self.auth_token = auth_token
-                # Initialize with empty config
-                self.config = {'base_args': {}}
-                
-                # For Harness HTTP client, set x-api-key in base_args
-                if 'harness' in baseurl:
-                    self.config['base_args'] = {'x-api-key': auth_token}
-                else:
-                    # For Split HTTP client, we'll check Authorization header in make_request
-                    pass
-                    
-            def make_request(self, endpoint, body=None, **kwargs):
-                # Just return a successful response without making actual requests
-                mock_response = mocker.Mock()
-                mock_response.status_code = 200
-                mock_response.text = '{}'
-                return {}
+        from splitapiclient.util.exceptions import InsufficientConfigArgumentsException
 
-        # Patch the HarnessHttpClient constructor to use our test class
-        mocker.patch('splitapiclient.http_clients.harness_client.HarnessHttpClient.__init__', 
-                    TestHttpClient.__init__)
-        mocker.patch('splitapiclient.http_clients.harness_client.HarnessHttpClient.make_request', 
-                    TestHttpClient.make_request)
-        
-        # Create client with only apikey
-        client = HarnessApiClient({
-            'apikey': 'api_key_value'
-        })
+        # Patch the HarnessHttpClient constructor to avoid actual HTTP requests
+        mocker.patch('splitapiclient.http_clients.harness_client.HarnessHttpClient.__init__', return_value=None)
 
-        # Check that the Harness HTTP client was initialized with apikey as fallback
-        assert client._token_client._http_client.auth_token == 'api_key_value'
+        # Create client with only apikey should raise an error
+        with pytest.raises(InsufficientConfigArgumentsException) as excinfo:
+            client = HarnessApiClient({
+                'apikey': 'api_key_value'
+            })
 
-        # Check that the Split HTTP client was initialized with apikey
-        assert client._split_client._http_client.auth_token == 'api_key_value'
+        assert 'harness_token is required' in str(excinfo.value)

splitapiclient/version.py

@@ -1 +1 @@
-__version__ = '3.5.8rc2'
+__version__ = '3.5.8'