[BUG] Incorrect type for Microsoft.SecurityInsights/threatIntelligence/main/queryIndicators keywords

[jasonparallel]

API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2025-03-01/ThreatIntelligence.json#L890

API Spec version

2025-03-01

Describe the bug

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/stable/2025-03-01/ThreatIntelligence.json#L890
Specifies the keywords search param as a array of Strings. The API returns that this is invalid.

{ "pageSize": 100, "keywords": ["test"], "sources": [ "analyst1_dev.local.analyst1.com" ], "sortBy": [ { "itemKey": "lastUpdatedTimeUtc", "sortOrder": "descending" } ] }

Yields
{ "error": { "code": "BadRequest", "message": "JsonToken EndArray is not valid for closing JsonType Object. Path '', line 3, position 22.\nUnexpected character encountered while parsing value: [. Path 'keywords', line 3, position 15." } }

Changing keywords to ids (which is also an array of strings) returns 200 response. I'm not sure what the correct type is but is seems to not be the documented one.

Tested with several api spec versions.

Expected behavior

200 with response when a spec compliment message is sent

Actual behavior

400 error
{ "error": { "code": "BadRequest", "message": "JsonToken EndArray is not valid for closing JsonType Object. Path '', line 3, position 22.\nUnexpected character encountered while parsing value: [. Path 'keywords', line 3, position 15." } }

Reproduction Steps

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/threatIntelligence/main/queryIndicators?api-version=2024-09-01
{ "pageSize": 100, "keywords": ["test"], "sources": [ "analyst1_dev.local.analyst1.com" ], "sortBy": [ { "itemKey": "lastUpdatedTimeUtc", "sortOrder": "descending" } ] }

Environment

No response