[Mitshah2406]

Which issue does this PR address?

Closes #4672

Rationale

The Java and C# SDKs delete a personal access token (a named API key) with DELETE /personal-access-tokens/{name}, but built the URL by pasting the name in as is. Characters that mean something in a URL then changed the request: ../users/42 sent DELETE /users/42, and a?b=c deleted the token a. The Rust SDK already escapes the name (#4628).

What changed?

Both SDKs now percent-encode the name so it is always one path segment (a/b becomes a%2Fb). The names . and .. are rejected with an exception, because URL parsers treat them as path navigation even when encoded. A null name now fails before any request is sent.

In Java, a space is encoded as %20 and not the + that URLEncoder produces, because + in a path is a literal plus. Each SDK gets one test that records the exact path it sends.

Local Execution

New tests (failing before, passing now), the C# unit suite, Java and C# lint, prek run, and a delete of a/b, my token and ../users/42 with both clients against a local iggy-server.

AI Usage

1. Tool: Claude Code.
2. Scope: it wrote the fix and the tests. I picked the issue, chose the approach and reviewed every change.
3. Verification: the test runs and the live-server check above.
4. Yes, I can explain every line.

[github-actions]

Thanks for the PR. It is labeled S-waiting-on-review and queued for review.

If AI assistance was used to create this PR, you are required to run the team-review skill before opening it.

Slash commands (own line, regular comment) move it around the queue:

• /ready - back to S-waiting-on-review after addressing feedback
• /author - flip to S-waiting-on-author while you finish changes
• /request-review @user-or-team - request a reviewer
• /pin - exempt the PR from the stale bot, /unpin to undo

See CONTRIBUTING.md for details.

[hubcio]

/skill team-review

[github-actions]

Summary: The Java and C# clients now send the personal access token name as one percent-encoded path segment and reject null and dot-segment names, and the new tests assert the exact request paths. One documentation nit remains on the C# exception contract, and the C# malformed-Unicode parity was left out because the diff does not change that behavior and only a .NET runtime check could settle it.

Counts: critical 0, warning 0, nit 1, simplification 0

---

This review was generated by Claude Code 2.1.310 on deepseek-flash[1m]. Review the output before you act on it.

[github-actions]

nit: The doc scopes the null case to HTTP, but TcpMessageStream.DeletePersonalAccessTokenAsync(null) also throws ArgumentException through WireName.ByteCount. Say that null throws on both transports and that "." and ".." throw only over HTTP.