Release/v2.3.5 (#79)

* test: add acceptance tests for wallarm_rule_api_abuse_mode (TDD)

* chore: promote terraform-plugin-go to direct dependency

* feat: add wallarm_rule_api_abuse_mode rule resource

* test: tighten InvalidMode error regex to match codebase convention

* test: unique per-test action scopes + 4-part regex for existsError

* refactor: replace existsAction/existsHint with existingHintForAction

* test: fix Sprintf arg ordering in config helper (host was being shadowed by mode)

* fix: invalidate hint cache after HintDelete to avoid stale reads

* debug: trace hint delete/read paths + compare cached vs raw in CheckDestroy

* debug: add OrderBy to raw HintRead in CheckDestroy ground-truth check

* fix acceptance test race via isolated provider factory and test client helper

* replace hand-rolled action comparison with canonical ConditionsHash

* add wallarm_rule_api_abuse_mode docs and example

* apply simplify fixes: length prefilter, nil check, helper type

* register api_abuse_mode in APITypeToTerraformResource for bulk import discovery

* convert InvalidMode acceptance test to pure ValidateFunc unit test

Author: concentrator

CHANGELOG.md

@@ -1,3 +1,25 @@
+# v2.3.5 (Apr 22, 2026)
+
+## FEATURES:
+
+* New resource `wallarm_rule_api_abuse_mode` — toggles [API Abuse Prevention](https://docs.wallarm.com/api-abuse-prevention/overview/) for requests matching an action scope. Primary use case: allowlist trusted crawlers (Pinterest, Google, monitoring agents) with `mode = "disabled"`. `mode` is `ForceNew` — changing it destroys and recreates the rule.
+
+## IMPROVEMENTS:
+
+* Extracted shared `existingHintForAction` helper for duplicate-rule detection on Create. Used by `wallarm_rule_mode` and `wallarm_rule_api_abuse_mode`; replaces the per-resource `existsAction` + `existsHint` pair.
+* Replaced hand-rolled action-conditions comparison (`equalWithoutOrder`, `compareActionDetails`, `actionPointsEqual`, `convertToStringSlice`) with a single `resourcerule.ConditionsHash` compare. Matches the Wallarm API's own canonical action identity and removes ~85 lines of per-field equality logic.
+* Added `testAccNewAPIClient()` test helper for CheckDestroy in tests that use `ProtoV5ProviderFactories`. Constructs an API client from `WALLARM_API_TOKEN` / `WALLARM_API_HOST` without going through the shared `testAccProvider`, avoiding a `Configure` race under `-race`.
+
+## BUG FIXES:
+
+* `CachedClient.HintDelete` now invalidates the hint cache on success. Previously the cache could return stale entries for just-deleted rules, surfacing in acceptance tests as "dangling resource" errors in CheckDestroy after a Create path that populated the cache.
+
+## DOCUMENTATION:
+
+* New `docs/resources/rule_api_abuse_mode.md` with Pinterest allowlist example, Argument/Attributes reference, and 3-part (`{client_id}/{action_id}/{rule_id}`) Import section.
+* New `examples/wallarm_rule_api_abuse_mode.tf` with three scope patterns (enable per instance, enable per host, Pinterest allowlist).
+* README Rules table: added `wallarm_rule_api_abuse_mode` entry; Rules count bumped 20 → 21.
+
 # v2.3.4 (Apr 20, 2026)
 
 ## IMPROVEMENTS:

README.md

@@ -102,7 +102,7 @@ Session-based rules for real-time threat mitigation. In the Wallarm Console UI t
 | `wallarm_rule_rate_limit_enum` | DoS protection (rate limiting) |
 | `wallarm_rule_file_upload_size_limit` | File upload restriction policy |
 
-### Rules (20 resources)
+### Rules (21 resources)
 
 Request-level rules for detection tuning, virtual patching, and data handling. These appear under the Rules section in the Wallarm Console UI.
 
@@ -130,6 +130,7 @@ Request-level rules for detection tuning, virtual patching, and data handling. T
 | `wallarm_rule_bola_counter` | BOLA counter |
 | `wallarm_rule_credential_stuffing_regex` | Credential stuffing regex |
 | `wallarm_rule_credential_stuffing_point` | Credential stuffing detection points |
+| `wallarm_rule_api_abuse_mode` | Toggle API Abuse Prevention per request scope |
 
 ### IP Lists (3 resources)
 

docs/guides/action.md

@@ -161,8 +161,7 @@ resource "wallarm_rule_mode" "example" {
 
 The Wallarm API reuses Actions (scope definitions). If two rules have identical conditions, they share the same Action. This means:
 - Creating a rule with the same conditions as an existing one will not create a duplicate Action.
-- The provider checks for existing Actions before creating (the `existsAction` check).
-- If the Action already exists, the provider returns an error suggesting to import the existing resource.
+- The provider checks for existing rules on the same Action before creating. If a rule of the same type already exists on the matching scope, the provider returns an error suggesting to import it instead.
 
 ## Common fields on all rule resources
 

docs/resources/rule_api_abuse_mode.md

@@ -0,0 +1,84 @@
+---
+layout: "wallarm"
+page_title: "Wallarm: wallarm_rule_api_abuse_mode"
+subcategory: "Rules"
+description: |-
+  Enables or disables API Abuse Prevention for requests matching an action scope.
+---
+
+# wallarm_rule_api_abuse_mode
+
+Provides the resource to toggle [API Abuse Prevention][1] for traffic matching a given action scope. Typical use: allowlist trusted crawlers (Pinterest, Google, monitoring agents) by applying `mode = "disabled"` to requests that carry their signature (User-Agent, path, method, etc.).
+
+## Example Usage
+
+```hcl
+# Disable API Abuse Prevention for legitimate Pinterest crawler traffic.
+
+resource "wallarm_rule_api_abuse_mode" "pinterest" {
+  mode    = "disabled"
+  title   = "Allow Pinterest"
+  comment = "Allow Pinterest through API Abuse Prevention"
+
+  action {
+    type  = "regex"
+    value = ".*(Pinterest|Pinterestbot)/(0.2|1.0);?\\s[(]?[+]https?://www[.]pinterest[.]com/bot[.]html[)].*"
+    point = {
+      header = "USER-AGENT"
+    }
+  }
+
+  action {
+    type  = "equal"
+    value = "api"
+    point = {
+      path = 0
+    }
+  }
+
+  action {
+    type  = "regex"
+    value = "v\\d"
+    point = {
+      path = 1
+    }
+  }
+
+  action {
+    type = "absent"
+    point = {
+      action_ext = ""
+    }
+  }
+}
+```
+
+## Argument Reference
+
+* `mode` - (optional) API abuse mode. One of: `enabled`, `disabled`. Default: `enabled`. Changing this value destroys and recreates the rule.
+* `title` - (optional) human-readable rule title.
+* `comment` - (optional) free-text rule comment. Defaults to `Managed by Terraform`.
+* `active` - (optional) whether the rule is active. Defaults to `true`.
+* `client_id` - (optional) ID of the client to apply the rule to. The value is required for [multi-tenant scenarios][2].
+* `action` - (optional) rule conditions. See the [Action Guide](../guides/action) for full documentation on action conditions, point types, and usage examples.
+
+## Attributes Reference
+
+* `rule_id` - ID of the created rule.
+* `action_id` - the action ID (the conditions to apply on request).
+* `rule_type` - type of the created rule. For `wallarm_rule_api_abuse_mode` this is always `api_abuse_mode`.
+
+## Import
+
+```
+$ terraform import wallarm_rule_api_abuse_mode.pinterest 6039/563855/11086881
+```
+
+* `6039` - Client ID.
+* `563855` - Action ID.
+* `11086881` - Rule ID.
+
+For automated bulk import using the `wallarm_rules` data source, see the [Rules Import Guide](../guides/rules_import).
+
+[1]: https://docs.wallarm.com/api-abuse-prevention/overview/
+[2]: https://docs.wallarm.com/installation/multi-tenant/overview/

examples/wallarm_rule_api_abuse_mode.tf

@@ -0,0 +1,63 @@
+# Enable API Abuse Prevention for a specific application (instance).
+resource "wallarm_rule_api_abuse_mode" "tiredful_api_abuse_mode" {
+  mode = "enabled"
+
+  action {
+    point = {
+      instance = 9
+    }
+  }
+}
+
+# Enable API Abuse Prevention for all traffic to a specific host.
+resource "wallarm_rule_api_abuse_mode" "dvwa_abuse_mode" {
+  mode = "enabled"
+
+  action {
+    type  = "iequal"
+    value = "dvwa.wallarm-demo.com"
+    point = {
+      header = "HOST"
+    }
+  }
+}
+
+# Allowlist trusted Pinterest crawler traffic under /api/v{N} routes by
+# disabling API Abuse Prevention for requests that match the crawler's
+# User-Agent and path shape.
+resource "wallarm_rule_api_abuse_mode" "pinterest" {
+  mode    = "disabled"
+  title   = "Allow Pinterest"
+  comment = "Allow Pinterest through API Abuse Prevention"
+
+  action {
+    type  = "regex"
+    value = ".*(Pinterest|Pinterestbot)/(0.2|1.0);?\\s[(]?[+]https?://www[.]pinterest[.]com/bot[.]html[)].*"
+    point = {
+      header = "USER-AGENT"
+    }
+  }
+
+  action {
+    type  = "equal"
+    value = "api"
+    point = {
+      path = 0
+    }
+  }
+
+  action {
+    type  = "regex"
+    value = "v\\d"
+    point = {
+      path = 1
+    }
+  }
+
+  action {
+    type = "absent"
+    point = {
+      action_ext = ""
+    }
+  }
+}

go.mod

@@ -5,6 +5,7 @@ go 1.24.0
 require (
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/hcl/v2 v2.24.0
+	github.com/hashicorp/terraform-plugin-go v0.30.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.39.0
 	github.com/pkg/errors v0.9.1
 	github.com/samber/lo v1.51.0
@@ -33,7 +34,6 @@ require (
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.25.0 // indirect
 	github.com/hashicorp/terraform-json v0.27.2 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.30.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.10.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect

wallarm/common/resourcerule/action_reverse_map.go

@@ -508,6 +508,7 @@ func ActionValueString(a wallarm.ActionDetails) string {
 
 // APITypeToTerraformResource maps Wallarm API rule types to Terraform resource names.
 var APITypeToTerraformResource = map[string]string{
+	"api_abuse_mode":         "wallarm_rule_api_abuse_mode",
 	"binary_data":            "wallarm_rule_binary_data",
 	"bola":                   "wallarm_rule_bola",
 	"bola_counter":           "wallarm_rule_bola_counter",