v2.3.10

[v2.3.10] - 2026-05-12

Adds the wallarm_api_discovery_config resource, fixes a default-app instance-condition mismatch in data.wallarm_hits, and ships an internal lint/reference-data refactor.

New Features

• feat(api_discovery_config): new singleton resource managing the API Discovery configuration (Settings → API Discovery) — editable enabled flag, protocols (REST/GraphQL/SOAP/GRPC/MCP), content-type filter, endpoint-stability thresholds, parameter-type and PII detection thresholds, disabled-apps list. Read-only attributes mirror the rest of the API response for drift visibility. Bumps wallarm-go to v0.13.0 to add the APIDiscovery interface.

Bug Fixes

• fix(data.wallarm_hits): emit instance condition for default-app (poolID=-1) hits — resolves 4-vs-5 condition hash mismatch on instance-included API clients.

Other Changes

• refactor(repo): add 13 reference docs, spec/point_map.json, spec/actions_examples.json, and scripts/fetch_point_refs.py to the repo; dedupe spec/actions_examples.json (343 → 82 unique shapes); scrub real domains to example.com; drop dead init-plugin Makefile target and plugindircheck.sh.
• refactor(lint): interface{} → any across wallarm/ and scripts/ (~990 sites); WriteString(fmt.Sprintf) → fmt.Fprintf (25 sites); 2 tagged-switch conversions. No behavior change.

v2.3.9

[v2.3.9] - 2026-05-04

Rules polish batch — naming cleanup, schema-shape audit (symmetric remove-restores-default), safety hardening, test gap fills. Bumps wallarm-go to v0.12.2.

Migration note: the Optional+Computed → Optional+Default(<value>) flips below cover ~13 fields. Resources whose API value differs from the new schema default will produce a one-time plan diff after upgrade — review terraform plan output before applying. Affects active (all resources), additional_parameters/plain_parameters (brute/bola/enum), introspection/debug_enabled/max_depth/max_value_size_kb/max_doc_size_kb/max_doc_per_batch/max_aliases (graphql_detection), mode (overlimit_res_settings, file_upload_size_limit), time_unit (rate_limit).

Upgrade Steps

• [ACTION REQUIRED] wallarm_rule_graphql_detection: rename max_alias_size_kb → max_aliases in HCL.

Breaking Changes

• wallarm_rule_graphql_detection.max_alias_size_kb renamed to max_aliases (count, not size; wire JSON tag unchanged).
• mitigation (all rule resources) now Computed only (was Optional+Computed); HCL setting it now fails validation.
• wallarm_rule_regex.experimental default behaviour: HCL omitting the field now creates a regular regex rule (was experimental_regex).

Bug Fixes

• wallarm_rule_graphql_detection.introspection / .debug_enabled now Optional+Default(true) — symmetric remove-restores-default.
• active (all rule resources) now Optional+Default(true) — same.
• enumerated_parameters.additional_parameters / .plain_parameters now Optional+Default(false) (rule_brute/_bola/_enum) — same.
• wallarm_rule_graphql_detection int fields now Optional+Default(<API default>) — max_depth, max_value_size_kb (range 1..100 validator added), max_doc_size_kb, max_doc_per_batch.
• wallarm_rule_graphql_detection.max_aliases now Optional+Default(5) (was Optional+Computed+ForceNew); mutates in place. Adds wallarm-go.HintUpdateV3Params.MaxAliases + resourcerule.WithMaxAliases.
• wallarm_rule_overlimit_res_settings.mode now Optional+Default("monitoring").
• wallarm_rule_rate_limit.time_unit now Optional+Default("rps").
• wallarm_rule_file_upload_size_limit.mode now Optional+Default("monitoring"); size gains IntAtLeast(1) validator.
• wallarm_rule_regex.experimental now Optional+Computed+ForceNew (was Optional+Default(true)+ForceNew; ForceNew retained); Read derives from rule_type. Prevents destroy-on-import for regular regex rules.
• findActionByConditionsHash 200-page pagination cap — bounds previously unbounded loop.
• setIfExists panic-swallow removed — replaced with explicit cty guards in rawStateHasKey.
• Plan-time enum validators added: attack_type on rule_disable_attack_type/vpatch (17 values each), rule_regex (16); block_by_session/ip+graylist_by_ip accept 0 (unset, dropped on wire) OR 600..315569520 — preserves terraform import + -generate-config-out round-trip on partially-set reactions; threshold.count/.period IntAtLeast(1) — surfaces API constraint at plan time.
• Generic helper resourcerule.GetPointerIfConfigured[T any] replaces type-specific variants — used by rate_limit delay/burst where 0 is meaningful.

v2.3.8

[v2.3.8] - 2026-05-01

Schema actualisation against API ground truth, zero-value pointer fixes, plan-time validator for enumerated_parameters, full rule-test harness migration. Bumps wallarm-go to v0.12.1.

Upgrade Steps

• [ACTION REQUIRED] wallarm_rule_rate_limit: add rsp_status = <400..599> (typical 429) — now Required.
• [ACTION REQUIRED] wallarm_rule_file_upload_size_limit: add size = N — now Required.
• [ACTION REQUIRED] wallarm_rule_brute / _bola / _enum in regexp mode: set both name_regexps and value_regexps (use [""] to skip a filter).
• Direct callers of wallarm-go ActionCreate: Rate/Burst/Delay/OverlimitTime are *int — wrap zero with lo.ToPtr(0).

Breaking Changes

• schema(rule): dropped Computed: true from set, title, enumerated_parameters.{name_regexps,value_regexps}, reaction.{block_by_session,block_by_ip,graylist_by_ip} — masked SDKv2 zero-value updates. Imports may produce a one-time clearing diff.
• schema(rule_rate_limit): rsp_status Optional → Required; burst/time_unit Required → Optional+Computed.
• schema(rule_overlimit_res_settings): mode Required → Optional+Computed.
• schema(rule_file_upload_size_limit): size Optional → Required; mode/size_unit/point Required → Optional+Computed.

Bug Fixes

• resourcerule.Create: active defaulted to false for 7 mitigation controls; now true. May produce a one-time false → true plan diff for legacy rules.
• rule_rate_limit, rule_overlimit_res_settings: user-typed rate=0/burst=0/delay=0/overlimit_time=0 now reach the API (bumps wallarm-go to v0.12.1 for *int+omitempty).
• rule_graphql_detection: max_depth, max_value_size_kb, max_doc_size_kb, max_doc_per_batch, introspection, debug_enabled → Optional+Computed; Update used to zero API-defaulted ints.
• rule_brute, rule_bola, rule_enum: new plan-time validator rejects enumerated_parameters fields that don't apply to the chosen mode; regexp mode also requires both name_regexps and value_regexps.
• enumerated_parameters: additional_parameters/plain_parameters are Optional+Computed; previous Default: false corrupted regexp-mode imports.
• mapper_tftoapi: regexp-mode name_regexps/value_regexps = [""] now reaches the API (was dropped by cty.NullVal normalization).
• arbitrary_conditions: mapper now re-chunks the flat-stored point per paired/simple element rules instead of wrapping it as a single sub-array — fixes a force-replacement diff every plan.
• action_helpers: existingHintForAction paginates ActionList — previously missed page-2+ collisions on tenants with >500 actions of a given hint type.
• test/rule_*: 12 CheckDestroy had inverted if err != nil &&; replaced with shared testAccCheckHintDestroyed helper.

Documentation

• rules_import: new filter_rules_in_state variable (default true) skips rules whose rule_id is already in state, preventing duplicate state entries.
• examples: added minimal HCL for wallarm_rule_graphql_detection, _brute, _bola, _enum, _forced_browsing, _rate_limit_enum, _bola_counter.

Other Changes

• 26 rule acceptance test files migrated to v2.3.5 patterns (ProtoV5ProviderFactories, testAccNewAPIClient); -race re-enabled on make testacc.
• New unit tests: existingHintForAction, CachedClient.HintCreate/HintDelete cache cycles, validateEnumeratedParamsBlock, ArbitraryConditionsToTF, isFieldSetInRawConfig.
• New acc tests: enumerated_parameters.mode = "exact" for bola/brute, ActionScopeCustomizeDiff valid/invalid scopes.
• Shared testAccCheckHintDestroyed extracted; ~700 LoC removed.

v2.3.7

[v2.3.7] - 2026-04-28

Rule lifecycle stability: 45 schema fields go mutable so plan reports update-in-place instead of destroy+recreate, several long-standing false-diff sources are fixed, and counter / empty-body destroy semantics are clarified.

Upgrade Steps

• Bump the provider to v2.3.7. No HCL migration required.
• [ACTION REQUIRED] Provider developers consuming wallarm-go directly: wallarm.API.HintDelete(...) now returns *HintDeleteResp{Status, Body} (was error only). Update call sites. End users writing only HCL are unaffected.

Bug Fixes

• fix(rule): terraform plan reports update-in-place (instead of destroy+recreate) for 45 rule fields whose API supports PUT updates. Existing state remains compatible.
• fix(action_scope): iequal action conditions no longer perpetually drift on mixed-case values; covers both value field and value-bearing point keys (action_name, action_ext, method, instance, proto, scheme, uri).
• fix(action_scope): action conditions no longer perpetually drift on header-name case (API uppercases header names regardless of type).
• fix(rule_overlimit_res_settings): Create now returns ImportAsExistsError when a same-scope rule already exists, matching wallarm_rule_mode / _api_abuse_mode behaviour.
• fix(rule_credential_stuffing): data.wallarm_rules no longer double-counts credential_stuffing rules within the same terraform apply — completes the v2.3.2 dedup at the missed HintCache.Insert site.
• fix(rule_counters): terraform destroy of bruteforce_counter / dirbust_counter / bola_counter is state-only; counters auto-clean ~30s after their last trigger reference is removed.
• fix(rule_counters): title, active, set are now Computed so counters don't surface phantom diffs after Create.
• fix(rule): Delete emits a [WARN] when the API returns an empty body (rule already absent server-side).

Other Changes

• build(deps): bump wallarm-go to v0.12.0 (typed HintDelete response, extended HintUpdateV3Params with ~30 mutable-field pointers).
• refactor(rule): shared resourcerule.Delete factory (21 rule resources).
• refactor(rule): resourcerule.Update accepts variadic UpdateCustomizers; new With* helper library wires per-resource Update in one line.
• test(rule): in-place Update acceptance tests for every mutable rule resource; ported pinterest-scope (api_abuse_mode) and multi-vpatch-per-action smokes to acc; unit tests for Update customizers and HintCache.LoadAll / All.
• docs(api_spec): moved wallarm_api_spec and wallarm_api_spec_policy to the Common subcategory.
• build(makefile): dropped -race from make testacc until remaining rule tests migrate to the v2.3.5 pattern; unit tests still run under -race.

v2.3.6

[v2.3.6] - 2026-04-24

Full Terraform support for Wallarm's API Specification Enforcement: expanded wallarm_api_spec schema, new wallarm_api_spec_policy resource for per-violation block/monitor/ignore controls, and wallarm-go v0.11.0 with the backing endpoints.

Upgrade Steps

• Bump the provider to v2.3.6. No HCL migration is required — existing wallarm_api_spec configurations continue to apply unchanged.
• wallarm_api_spec.domains and wallarm_api_spec.instances changed from Required to Optional. If you relied on Terraform failing fast when these were missing, add validation blocks on your input variables instead.
• [ACTION REQUIRED] Provider developers consuming wallarm-go directly must update imports: the Api* prefix is gone. Rename ApiSpec → APISpec, ApiSpecBody → APISpecBody, ApiDetection → APIDetection, etc. JSON tags are unchanged, so API payloads are wire-compatible. End users writing only HCL are unaffected.

New Features

• New resource wallarm_api_spec_policy — manages the API Specification Enforcement policy attached to an uploaded spec. Six violation modes (undefined_endpoint_mode, undefined_parameter_mode, missing_parameter_mode, invalid_parameter_value_mode, missing_auth_mode, invalid_request_mode), two threshold modes (timeout_mode, max_request_size_mode, Computed-only — require elevated permissions to change), and a repeatable condition block that reuses the rule action-scope schema. Destroy is a soft-delete (PUT enabled: false) — the policy record is removed only when the parent spec is deleted. Import ID format: {client_id}/{api_spec_id}/policy.
• wallarm_api_spec: extended schema with auth_headers (list of {key, value} blocks, sensitive values) used when Wallarm fetches the spec URL, plus API-computed attributes — status, spec_version, openapi_version, endpoints_count, shadow_endpoints_count, orphan_endpoints_count, zombie_endpoints_count, format, version, node_sync_version, last_synced_at, last_compared_at, updated_at, created_at, file_changed_at, and a nested file block (name, signed_url, checksum, mime_type, version). file.signed_url is Sensitive and regenerates on every Read (short-lived, ~10 min).
• wallarm_api_spec: title, description, file_remote_url, regular_file_update, api_detection, domains, instances are now mutable (no more ForceNew). Edits apply as an in-place PUT via the new APISpecUpdate path instead of destroy/recreate. client_id remains ForceNew.

Other Changes

• build(deps): bump wallarm-go to v0.11.0 — adds APISpecReadByID, APISpecUpdate, APISpecPolicyPut endpoints; extends APISpecBody with AuthHeaders and the new computed fields; renames Api* Go identifiers to API* for idiomatic Go initialisms (JSON tags unchanged).
• refactor(api_spec): domains and instances relaxed from Required to Optional. The Wallarm console hides these legacy fields and Wallarm computes the applicable scope from other signals, so forcing a value in HCL was misleading.
• test(api_spec): acceptance-test suite migrated to v2.3.5 patterns (ProtoV5ProviderFactories, testAccNewAPIClient, unique per-test title). Added Update-in-place, Import-round-trip, and auth_headers lifecycle coverage.
• test(api_spec_policy): new resource_api_spec_policy_test.go covers Create, Update-mode-flip, scoped condition blocks, soft-delete, import, and a regression-gate _ConditionsLifecycle test (0→1→2→1→0 condition blocks).
• docs(api_spec): resource doc rewritten against the v2.3.6 schema — full attribute list including the nested file block with signed_url caveat; example updated.
• docs(api_spec_policy): new resource doc with Example Usage, Argument Reference split into Scope / Violation Modes / Threshold Limits, Import (3-part ID), and a Limitations section documenting soft-delete behaviour and the one-policy-per-spec constraint.
• docs(examples): new examples/wallarm_api_spec_policy.tf with three scenarios (observation-mode rollout, block on undefined endpoints with host scope, paused policy preserving settings).
• docs(readme): added wallarm_api_spec_policy to the Infrastructure & Tooling table; resource count bumped 11 → 12.
• chore(schema): added Description strings to 15+ previously-undocumented wallarm_api_spec fields so terraform providers schema and registry docs surface helpful text.

v2.3.5

[v2.3.5] - 2026-04-22

Adds wallarm_rule_api_abuse_mode for toggling API Abuse Prevention per request scope, and fixes a hint-cache stale-read issue that surfaced as "dangling resource" errors in fast create/delete cycles.

New Features

• feat(rule_api_abuse_mode): New rule resource enables or disables API Abuse Prevention for requests matching an action scope. Primary use case: allowlist trusted crawlers (Pinterest, Google, monitoring agents) with mode = "disabled". mode is enabled or disabled; changing it destroys and recreates the rule.

Bug Fixes

• fix(hint_cache): Invalidate cache on HintDelete. Previously, a quick create → delete cycle (common in CI or destroyed test runs) could return a stale cached rule on the next read, surfacing as "resource still exists" errors.

Performance Improvements

• refactor(action_helpers): Duplicate-rule detection on Create now uses the server-canonical ConditionsHash instead of a hand-rolled per-field comparison — faster and immune to ordering or whitespace differences.

Other Changes

• refactor(resourcerule): Shared existingHintForAction helper replaces per-resource collision checks in wallarm_rule_mode and wallarm_rule_api_abuse_mode.
• docs(rule_api_abuse_mode): New resource doc and HCL example. README Rules table updated (20 → 21 entries).

v2.3.4

Released: April 20, 2026

Fixes terraform import for wallarm_api_spec and wallarm_user, bumps
wallarm-go to v0.10.0, removes an unused provider argument.

Bug Fixes

• Import now works for wallarm_api_spec and wallarm_user — replaced
  passthrough import with real ID parsers so the required fields get
  populated.
• data.wallarm_security_issues no longer panics when an issue has no
  vpatch mitigation (now nil-checked).
• wallarm_api_spec import ID aligned to {client_id}/{api_spec_id} for
  consistency with other 2-entity resources. Existing state unaffected.

Improvements

• wallarm-go v0.10.0: new Attack, Activity Log, and Security Issues
  APIs; cursor pagination on AttackRead; nil-input guards; IP-list search
  encoding fix.
• Shared rule Import + Update helpers in resourcerule — 42 rule
  resources migrated, ~850 net LOC removed.
• Test coverage: resourcerule 55.7% → 69.3%.

Breaking Changes

• ignore_existing provider argument removed (the field was never read
  by any code). Drop it from your provider "wallarm" {} block and the
  WALLARM_IGNORE_EXISTING_RESOURCES env var if set.

Documentation

• ## Import sections added to api_spec, node, tenant, user.
• integration_ms_teams.md renamed to integration_teams.md.

v2.3.3

Wallarm Terraform Provider v2.3.3

Released: April 19, 2026

Fixes counter-resource imports and ships an internal code reorganization.
No HCL changes required.

Bug Fixes

• Counter resources now import cleanly. wallarm_rule_bola_counter,
  wallarm_rule_bruteforce_counter, and wallarm_rule_dirbust_counter no
  longer fail with HTTP 403 during terraform import. Counters are now
  immutable: comment and variativity_disabled are computed-only.
• vuln_prefix removed from tenant creation — the field was dropped from
  the Wallarm API and now returns an error if sent.

Improvements

• wallarm-go upgraded to v0.9.1 (79.5% test coverage, dead code removed).
• ~50 new unit tests; resourcerule coverage now 55.7%.
• Acceptance-test CI provisions a dedicated tenant per run.

Documentation

• docs/index.md: documented hint_prefetch and require_explicit_client_id
  provider arguments; corrected max_backoff default from 30 to 5.
• README.md: Terraform minimum version raised to >= 1.5.

Internal

Refactored source tree for clarity (collapsed wallarm/common/, split
resource_rule.go, dissolved utils.go, several file renames). Added
make dev / make dev-clean targets. No user-visible behavior change.

v2.3.2

IMPROVEMENTS

• Instance action conditions now preserve type="equal" in state instead of clearing to empty string, enabling future type="regex" support
• Added admin_ext role to wallarm_user resource for Administrator (extended) support

BUG FIXES

• Fixed credential stuffing rules appearing twice in data.wallarm_rules when API token has elevated permissions
• Fixed instance condition type field lost after resource Read, causing perpetual drift when explicitly set
• Fixed wrong field name resource_type → terraform_resource in 5 resource docs and rules_import guide
• Fixed incorrect rule_type examples in rule_bola, rule_brute, rule_forced_browsing, rule_graphql_detection, rule_rate_limit_enum docs

DOCUMENTATION

• Rewrote rules_import guide with complete configuration, all workflows (native import, generator fallback), sync status, and filtering
• Added terraform {} block with required_version >= 1.5 to provider example
• Added Administrator (extended) role documentation to provider and user resource docs
• Fixed action guide: type field documented as optional (was incorrectly marked required), added missing common fields (title, active, set)
• Fixed mitigation_controls guide: corrected file upload parameters (size not max_size, removed non-existent file_types), clarified safe_blocking is rule_mode only

v2.3.1

v2.3.1

Patch for the hits-to-rules workflow: stamps grouped per attack type, rule_types filter fix, CI test fix.

Improvements

• Stamps grouped per attack type for traceability — each group has attack_type always set
• New disable_attack_type bool field in aggregated groups — controls rule creation, decoupled from key
• rule_types filter correctly controls both stamp and attack_type rule creation

Bug Fixes

• Fixed rule_types = ["disable_stamp"] still creating disable_attack_type rules
• Fixed nil stamps for stampless types (xxe, invalid_xml) causing HCL null errors
• Fixed stamp group key truncation dropping attack_type suffix
• Fixed TestReverseMapRealExamples failing in CI (moved fixtures to testdata/)