filter CredentialType OPTIONS *and* help text for kind requirements

see: #7115
see: #6959

awx/api/serializers.py

@@ -287,6 +287,13 @@ class BaseSerializer(serializers.ModelSerializer):
         else:
             return obj.get_absolute_url(request=self.context.get('request'))
 
+    def filter_field_metadata(self, fields, method):
+        """
+        Filter field metadata based on the request method.
+        This it intended to be extended by subclasses.
+        """
+        return fields
+
     def _get_related(self, obj):
         return {} if obj is None else self.get_related(obj)
 
@@ -1957,6 +1964,16 @@ class CredentialTypeSerializer(BaseSerializer):
                     field['help_text'] = _(field['help_text'])
         return value
 
+    def filter_field_metadata(self, fields, method):
+        # API-created/modified CredentialType kinds are limited to
+        # `cloud` and `net`
+        if method in ('PUT', 'POST'):
+            fields['kind']['choices'] = filter(
+                lambda choice: choice[0] in ('cloud', 'net'),
+                fields['kind']['choices']
+            )
+        return fields
+
 
 # TODO: remove when API v1 is removed
 @six.add_metaclass(BaseSerializerMetaclass)