Issue calling undocumented API

[clintbxtreme]

Describe the bug
Discovered an undocumented API /api/search_endpoints/<search_endpoint_id> but making a PUT request with the same data from the GET response (just modifying some field values) doesn't update the search_endpoint. Receives a 204 and no changes when looking at the endpoint in the UI. Specifically interested in making updates to the custom_headers field.

To Reproduce
Steps to reproduce the behavior:

1. Make a GET request to /api/search_endpoints to retrieve search endpoints
2. Use the search_endpoint_id from the response to make a GET request to /api/search_endpoints/<search_endpoint_id>
3. Using the response, modify the custom_headers field
4. Make a PUT request to /api/search_endpoints/<search_endpoint_id> with the updated data
5. Receive a response code 204 and no updates visible in the UI

Expected behavior
Should be able to update the search endpoint's custom headers

Additional context
Here are some json payload examples that have been tried:
{ "name": "Name", "search_endpoint_id": 1234, "endpoint_url": "https://example.com/search", "search_engine": "searchapi", "api_method": "GET", "custom_headers": {"Custom-Flag": "foobar", "Authorization": "Bearer foo"}, "basic_auth_credential": "", "mapper_code": "...", "proxy_requests": true }
and
{ "search_endpoint": { "name": "Name", "search_endpoint_id": 1234, "endpoint_url": "https://example.com/search", "search_engine": "searchapi", "api_method": "GET", "custom_headers": {"Custom-Flag": "foobar", "Authorization": "Bearer foo"}, "basic_auth_credential": "", "mapper_code": "...", "proxy_requests": true } }
I've also tried the form data below (similar to what happens in the UI):
search_endpoint[custom_headers]: ""{\"Custom-Flag\": \"foobar\", \"Authorization\": "Bearer foo\"}"" _method: "patch" authenticity_token: "1234asdf" commit: "Update Search endpoint"

[epugh]

Have you used the api docs in general? https://app.quepid.com/apipie And yes, search_endpoint isn't documented...

[epugh]

okay... yeah,

        params.require(:search_endpoint).permit(:archived)
      end

is at fault! the front end app only ever sets the archived flag, but you want to use it for more things. So I need to example the permit list.