Add test coverage for the API-key lifecycle and webhook CRUD endpoints

[mikewheeleer]

Test the API-key lifecycle and webhook CRUD endpoints

Description

The API-key endpoints (POST/GET/DELETE /api/v1/api-keys) and webhook endpoints (POST/GET/PATCH/DELETE /api/v1/webhooks, plus /:id/test) in src/index.ts have zero tests in src/health.test.ts. These manage credentials and event subscriptions, so untested behaviour is risky. This issue adds full coverage.

Requirements and context

• Repository scope: Agentpay-Org/Agentpay-backend only.
• Cover api-key create (201 with apk_ prefix), list (prefix-only, never the secret), and revoke-by-prefix (204 and 404).
• Cover webhook register (url + events validation, 201), list, patch (partial url/events updates), delete (204/404), and /:id/test (404 for unknown, simulated delivery for known).
• Assert validation failures return 400 invalid_request with a requestId, including the http(s) URL regex and 2048-char limit.
• Assert the api-key list response never contains the full key.

Suggested execution

• Fork the repo and create a branch
• git checkout -b test/testing-13-apikeys-webhooks
• Implement changes
  • Write comprehensive tests in: new src/apikeys-webhooks.test.ts using supertest.
  • Write code in: no production change expected unless a real bug surfaces.
  • Add documentation: none beyond test descriptions.
  • Add clear test titles.
  • Validate security assumptions: confirm secret is never echoed in list responses or logs.
• Test and commit

Test and commit

• Run npm run build, npm test, and npm run lint.
• Cover edge cases: revoke non-existent prefix, webhook bad URL, empty events array, patch with neither field.
• Include the full npm test output in the PR description.

Example commit message

test: cover api-key lifecycle and webhook crud endpoints

Guidelines

• Minimum 95 percent test coverage for impacted modules.
• Clear, reviewer-focused documentation.
• Timeframe: 96 hours.

Community & contribution rewards

• 💬 Join the AgentPay community on Discord for questions, reviews, and faster merges: https://discord.gg/eXvRKkgcv
• ⭐ This is a GrantFox OSS / Official Campaign task and may be rewarded. When your PR is merged you'll be prompted to rate the project — if this issue and the maintainers helped you ship, we'd be grateful for a 5-star rating. Clear questions in Discord and tidy, well-tested PRs are the fastest path to a merge and a reward.

[BojayL]

/claim

[BojayL]

/attempt #73

[eischideraa-unn]

Hello Maintainer, I’d love to work on this issue. I’m experienced with solving similar problems, writing clean code, and understanding existing systems quickly.

For this issue, I’d approach it by identifying the root cause, implementing fixes that aligns with the current architecture, and testing properly to avoid regressions.

[gloskull]

Hello, I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process. My PR will be submitted in under 10hours.

[pq198363-ops]

/claim