From fb603fdb6b2894f4bd21f33293c025c1f73e4dc6 Mon Sep 17 00:00:00 2001
From: "devin-ai-integration[bot]"
 <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 19:48:35 -0700
Subject: [PATCH] fix(terraform): keep prior state when a virtual key update is
 rejected (#40512)

resourceKeyUpdate now calls d.Partial(true) on a failed /key/update so the SDK does not persist the rejected planned values into state, which made the next plan report no changes and silently dropped the update.

Co-authored-by: yassin <yassin@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 terraform/provider/litellm/resource_key.go    |  1 +
 .../provider/litellm/resource_key_test.go     | 41 +++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/terraform/provider/litellm/resource_key.go b/terraform/provider/litellm/resource_key.go
index 5d8bc5667a9..3b14f7ca655 100644
--- a/terraform/provider/litellm/resource_key.go
+++ b/terraform/provider/litellm/resource_key.go
@@ -315,6 +315,7 @@ func resourceKeyUpdate(ctx context.Context, d *schema.ResourceData, m interface{
 
 	metadata, err := plannedKeyMetadata(c, d)
 	if err != nil {
+		d.Partial(true)
 		return diag.FromErr(fmt.Errorf("error updating key: %s", err))
 	}
 	key.Metadata = metadata
diff --git a/terraform/provider/litellm/resource_key_test.go b/terraform/provider/litellm/resource_key_test.go
index 30108856a3a..5e6385735c6 100644
--- a/terraform/provider/litellm/resource_key_test.go
+++ b/terraform/provider/litellm/resource_key_test.go
@@ -319,6 +319,47 @@ func TestUpdateKeyOmitsEmptyBudgetDuration(t *testing.T) {
 	}
 }
 
+func TestResourceKeyUpdateFailureKeepsPriorState(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/key/update" {
+			w.WriteHeader(http.StatusBadRequest)
+			w.Write([]byte(`{"error":{"message":"Invalid budget_duration 'bad'"}}`))
+			return
+		}
+		w.Write([]byte(`{"key":"hash-1","info":{"key_alias":"demo","models":["fake-model"]}}`))
+	}))
+	defer srv.Close()
+
+	res := resourceKey()
+	priorData := newKeyResourceData(t, map[string]interface{}{
+		"key_alias": "demo",
+		"models":    []interface{}{"fake-model"},
+	})
+	priorData.SetId("hash-1")
+	prior := priorData.State()
+	config := terraform.NewResourceConfigRaw(map[string]interface{}{
+		"key_alias":       "demo",
+		"models":          []interface{}{"fake-model"},
+		"budget_duration": "bad",
+	})
+	diff, err := res.Diff(context.Background(), prior, config, nil)
+	if err != nil {
+		t.Fatalf("diff failed: %v", err)
+	}
+
+	newState, diags := res.Apply(context.Background(), prior, diff, NewClient(srv.URL, "test-key", true))
+	if !diags.HasError() {
+		t.Fatal("apply succeeded, want the proxy's 400 surfaced as an error")
+	}
+	if got, ok := newState.Attributes["budget_duration"]; ok {
+		t.Errorf("failed update persisted budget_duration=%q into state, want it absent", got)
+	}
+	if newState.Attributes["key_alias"] != "demo" {
+		t.Errorf("prior key_alias lost from state: %v", newState.Attributes)
+	}
+}
+
 // /key/info nests the key's fields under "info"; GetKey must unwrap that
 // envelope or reads map nothing back into state.
 func TestGetKeyUnwrapsInfoEnvelope(t *testing.T) {