gateway source update cannot change any config field: API rejects with "config is not allowed"

[leggetter]

Summary

Every config and auth flag on gateway source update is dead — the API rejects the request with config is not allowed. Source auth flags on create are rejected the same way for type WEBHOOK.

Reproduce

hookdeck gateway source update <id> --allowed-http-methods "GET,POST"
→ failed to update source: error: config is not allowed

hookdeck gateway source update <id> --config '{"allowed_http_methods":["GET","POST"]}'
→ failed to update source: error: config is not allowed

On create, for type WEBHOOK:

--api-key ... / --basic-auth-user ... / --hmac-secret ...
→ config.auth is not allowed

--webhook-secret does work on provider types (verified: STRIPE stores auth.webhook_secret_key).

The asymmetry

gateway destination update --config works fine — round-tripped path_forwarding_disabled and http_method successfully. So this is specific to sources.

Scope

Pre-existing, not a regression. Identical on fbb924a and the merged branch (the baseline dumps a raw 422; the merged build reports it more readably, which is an improvement but not a fix).

Open question

It is not clear from the CLI side whether this is:

• the CLI sending a shape the API no longer accepts,
• flags that should never have been offered for these source types, or
• an API-side restriction that should be lifted.

Worth confirming against the API before deciding whether the fix is to remove the flags, change what is sent, or change the API. If the flags cannot work, offering them is the bug.

Related

• Standardize config input: --config means two different things across gateway and outpost #347 — --config means two different things across gateway and outpost

---

Filed by Claude on Phil's behalf, from release-candidate regression testing.