OpenAPI security metadata for GET /v2/iam/me omits APIKey authentication #212

Summary

GET /v2/iam/me is generated with bearerAuth only, although the API accepts the API-key credential used by the other authenticated API-key endpoints.

Reproduction

With revengai v4.20.0:

import os
import revengai

configuration = revengai.Configuration(
    host="https://api.reveng.ai",
    api_key={"APIKey": os.environ["REVENG_API_KEY"]},
)

with revengai.ApiClient(configuration) as api_client:
    revengai.ConfigApi(api_client).get_config()       # succeeds
    revengai.IAMUsersApi(api_client).get_me()         # 401

The failing response is:

{"error":"missing or invalid Authorization header"}

The generated client makes the mismatch visible:

• ConfigApi.get_config declares ['APIKey', 'bearerAuth'].
• IAMUsersApi.get_me declares ['bearerAuth'] only.
• Configuration.auth_settings() can construct an APIKey Authorization header.

Passing that existing auth setting explicitly works against the live endpoint:

auth = configuration.auth_settings()["APIKey"]
revengai.IAMUsersApi(api_client).get_me(_request_auth=auth)

Impact

Clients configured with an API key cannot use IAMUsersApi.get_me() through the normal generated method. In the IDA plugin this call is part of the startup authentication check, so a valid login is followed by a misleading 401 and the user profile/tier remains unavailable.

Expected behaviour

If API-key authentication is supported by GET /v2/iam/me, the OpenAPI security definition should include APIKey alongside bearerAuth, and the Python client should be regenerated. If the endpoint is intended to accept bearer tokens only, the API documentation and the behaviour of the deployed endpoint should be made consistent.

This report is about the generated security metadata rather than a hand edit to generated client files; the next SDK regeneration should preserve the correction.

The IDA plugin has a narrow client-side workaround in RevEngAI/plugin-ida#173 while the API definition is reviewed.