---
schema_version: "1"
id: a12352cbe5cfa7647df71e89b6a8778c6ecf77a8b4616e3a41f37a718dcd01a8
title: API, MCP, and A2A Policy Resources
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mulesoft-terraform-provider/a2a-resources.md
canonical_url: https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources
source_site: docs.mulesoft.com
content_type: documentation
content_hash: f2bceed84030d58b9ae0d8f6f13c0d0a6c80da0ccab7d7925e742d7d0ec8bc46
description: MuleSoft Documentation Site
latest: true
---
# API, MCP, and A2A Policy Resources

Use policy resources to apply policies declaratively to APIs, MCP servers, gateways, and AI agent resources.

## [](#anypoint_api_policy_a2a_agent_card)`anypoint_api_policy_a2a_agent_card`

Use the `anypoint_api_policy_a2a_agent_card` resource to publish and manage an A2A Agent Card on an Anypoint API instance. The agent card describes your AI agent’s capabilities and is served at a configurable path.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage)Example Usage

```hcl
resource "anypoint_api_policy_a2a_agent_card" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    content        = "{\"name\": \"My Agent\", \"description\": \"An example A2A agent\"}"
    consumer_url   = "https://example.com/agent"
    card_path      = "/.well-known/agent-card.json"
    file_name      = "agent-card.json"
    file_mime_type = "application/json"
  }

  order = 1
}
```

### [](#required-arguments)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance to attach the agent card to.
- `configuration` - (Block) Agent card content and serving configuration..

### [](#optional-arguments)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies on the same API instance. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `2.0.0-20260327083212`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration)Nested Schema for `configuration`

- `content` - (Required) The agent card content as a JSON string.
- `card_path` - Path where the agent card is served.
- `consumer_url` - Consumer-facing URL for the A2A agent.
- `file_mime_type` - MIME type of the agent card file.
- `file_name` - Filename for the agent card.
- `file_source` - Source of the agent card file.

### [](#pointcut-data)Pointcut Data

Use `pointcut_data` to limit the policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import)Import

An existing `anypoint_api_policy_a2a_agent_card` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_a2a_agent_card.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_a2a_agent_card" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_a2a_agent_card.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_a2a_pii_detector)`anypoint_api_policy_a2a_pii_detector`

Use the `anypoint_api_policy_a2a_pii_detector` resource to detect and act on personally identifiable information (PII) in requests to an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-2)Example Usage

```hcl
resource "anypoint_api_policy_a2a_pii_detector" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    entities = ["Email", "US SSN", "Credit Card", "Phone Number"]
    action   = "Reject"
  }

  order = 1
}
```

### [](#required-arguments-2)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - Numeric ID of the API instance to attach this policy to.
- `configuration` - (Block) PII detection configuration..

### [](#optional-arguments-2)Optional Arguments

- `organization_id` - Organization ID. Defaults to the organization inferred from the connected app if not set.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies on the same API instance. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-2)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-2)Nested Schema for `configuration`

- `entities` - (Required, List of String) PII entity types to detect. Valid values: `Email`, `Credit Card`, `Phone Number`, `US SSN`.
- `action` - Action to take when PII is detected (for example, `Reject`).

### [](#pointcut-data-2)Pointcut Data

Use `pointcut_data` to limit the policy to specific HTTP methods and URI patterns. This corresponds to the "Apply configurations to specific methods & resources" setting in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-2)Import

An existing `anypoint_api_policy_a2a_pii_detector` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-2)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_a2a_pii_detector.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_a2a_pii_detector" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-2)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_a2a_pii_detector.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_a2a_prompt_decorator)`anypoint_api_policy_a2a_prompt_decorator`

Use the `anypoint_api_policy_a2a_prompt_decorator` resource to prepend or append text and file content to prompts on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-3)Example Usage

```hcl
resource "anypoint_api_policy_a2a_prompt_decorator" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    text_decorators = [
      {
        position = "prefix"
        text     = "You are a helpful assistant."
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-3)Required Arguments

- `environment_id` - ID of the environment containing the API instance.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Decorator configuration..

### [](#optional-arguments-3)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-3)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-3)Nested Schema for `configuration`

- `file_decorators` - (Dynamic) File-based prompt decorators to inject.
- `text_decorators` - (Dynamic) Text-based prompt decorators to inject.

### [](#pointcut-data-3)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-3)Import

An existing `anypoint_api_policy_a2a_prompt_decorator` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-3)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_a2a_prompt_decorator.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_a2a_prompt_decorator" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-3)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_a2a_prompt_decorator.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_a2a_schema_validation)`anypoint_api_policy_a2a_schema_validation`

Use the `anypoint_api_policy_a2a_schema_validation` resource to manage an A2A Schema Validation policy on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-4)Example Usage

```hcl
resource "anypoint_api_policy_a2a_schema_validation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {}

  order = 1
}
```

### [](#required-arguments-4)Required Arguments

- `environment_id` - The environment ID.
- `api_instance_id` - The API instance ID.
- `configuration` - (Block) The policy configuration. This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`).

### [](#optional-arguments-4)Optional Arguments

- `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials.
- `label` - A human-readable label for this policy instance.
- `order` - The order of policy execution.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) List of upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string. Restricts the policy to specific resources (methods and/or URIs). When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-4)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - The policy template ID assigned by the server.

### [](#pointcut-data-4)Pointcut Data

The optional `pointcut_data` attribute restricts the policy to specific HTTP methods and/or URI patterns, matching what is configured under "Apply configurations to specific methods & resources" in the Anypoint Platform UI.

Each element in the array maps to one condition row in the UI:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions act as a logical OR — the policy applies if any condition matches.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-4)Import

An existing `anypoint_api_policy_a2a_schema_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-4)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_a2a_schema_validation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_a2a_schema_validation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-4)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_a2a_schema_validation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_a2a_token_rate_limit)`anypoint_api_policy_a2a_token_rate_limit`

Use the `anypoint_api_policy_a2a_token_rate_limit` resource to enforce token-based rate limits on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-5)Example Usage

```hcl
resource "anypoint_api_policy_a2a_token_rate_limit" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    maximum_tokens              = 10000
    time_period_in_milliseconds = 60000
    key_selector                = "#[attributes.headers['Authorization']]"
  }

  order = 1
}
```

### [](#required-arguments-5)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Rate limit configuration..

### [](#optional-arguments-5)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-5)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-4)Nested Schema for `configuration`

- `maximum_tokens` - (Required) Maximum number of tokens allowed in the time period.
- `time_period_in_milliseconds` - (Required) Duration of the rate limit window in milliseconds.
- `key_selector` - DataWeave expression to extract the rate limit key from the request (for example, `#[attributes.headers['Authorization']]`).

### [](#pointcut-data-5)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-5)Import

An existing `anypoint_api_policy_a2a_token_rate_limit` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-5)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_a2a_token_rate_limit.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_a2a_token_rate_limit" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-5)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_a2a_token_rate_limit.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_body_transformation)`anypoint_api_policy_body_transformation`

Use the `anypoint_api_policy_body_transformation` resource to apply a DataWeave script to transform request or response bodies on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-6)Example Usage

```hcl
resource "anypoint_api_policy_body_transformation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    script       = "%%dw 2.0\noutput application/json\n---\npayload"
    request_flow = "request"
  }

  order = 1
}
```

### [](#required-arguments-6)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Transformation configuration..

### [](#optional-arguments-6)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260127.133848`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-6)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-5)Nested Schema for `configuration`

- `script` - (Required) The DataWeave transformation script.
- `request_flow` - Which flow to apply the transformation to (`request` or `response`).

### [](#pointcut-data-6)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-6)Import

An existing `anypoint_api_policy_body_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-6)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_body_transformation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_body_transformation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-6)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_body_transformation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_circuit_breaker)`anypoint_api_policy_circuit_breaker`

Use the `anypoint_api_policy_circuit_breaker` resource to protect upstream services from cascading failures by opening the circuit when error or slow-call thresholds are exceeded.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-7)Example Usage

```hcl
resource "anypoint_api_policy_circuit_breaker" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    thresholds = {
      failure_rate_threshold       = 50
      slow_call_rate_threshold     = 80
      slow_call_duration_threshold = 5000
      sliding_window_size          = 100
      minimum_number_of_calls      = 10
      wait_duration_in_open_state  = 60000
    }
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-7)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Circuit breaker thresholds..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy monitors.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-7)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.

### [](#read-only-attributes-7)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-6)Nested Schema for `configuration`

- `thresholds` - (Required, Dynamic) Circuit breaker threshold configuration object.

### [](#pointcut-data-7)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-7)Import

An existing `anypoint_api_policy_circuit_breaker` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-7)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_circuit_breaker.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_circuit_breaker" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-7)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_circuit_breaker.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_access_block)`anypoint_api_policy_access_block`

Use the `anypoint_api_policy_access_block` resource to block all access to an Anypoint API instance. Combine with `pointcut_data` to restrict specific methods or URI patterns.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-8)Example Usage

```hcl
resource "anypoint_api_policy_access_block" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {}

  order = 1
}
```

### [](#required-arguments-8)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance to block access to.
- `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`).

### [](#optional-arguments-8)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-8)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#pointcut-data-8)Pointcut Data

Use `pointcut_data` to restrict access blocking to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Block GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-8)Import

An existing `anypoint_api_policy_access_block` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-8)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_access_block.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_access_block" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-8)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_access_block.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_client_id_enforcement)`anypoint_api_policy_client_id_enforcement`

Use the `anypoint_api_policy_client_id_enforcement` resource to require a valid client ID and secret on all requests to an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-9)Example Usage

```hcl
resource "anypoint_api_policy_client_id_enforcement" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    credentials_origin_has_http_basic_authentication_header = "customExpression"
    client_id_expression     = "#[attributes.headers['client_id']]"
    client_secret_expression = "#[attributes.headers['client_secret']]"
  }

  order = 1
}
```

### [](#required-arguments-9)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Client credential extraction configuration..

### [](#optional-arguments-9)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.3.3`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-9)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-7)Nested Schema for `configuration`

- `client_id_expression` - DataWeave expression to extract the client ID from the request.
- `client_secret_expression` - DataWeave expression to extract the client secret from the request.
- `credentials_origin_has_http_basic_authentication_header` - How client credentials are provided (for example, `customExpression`, `httpBasicAuthenticationHeader`).

### [](#pointcut-data-9)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-9)Import

An existing `anypoint_api_policy_client_id_enforcement` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-9)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_client_id_enforcement.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_client_id_enforcement" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-9)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_client_id_enforcement.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_cors)`anypoint_api_policy_cors`

Use the `anypoint_api_policy_cors` resource to configure Cross-Origin Resource Sharing (CORS) on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-10)Example Usage

#### [](#public-resource-simple-branch)Public resource (simple branch)

```hcl
resource "anypoint_api_policy_cors" "public" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    public_resource     = true
    support_credentials = false
    origin_groups = [
      {
        origins  = ["https://example.com"]
        methods  = ["GET", "POST", "PUT"]
        headers  = ["Content-Type", "Authorization"]
      }
    ]
  }

  order = 1
}
```

#### [](#non-public-resource-credentialed-branch)Non-public resource (credentialed branch)

When `public_resource = false`, the platform enforces a stricter schema. Each origin group must include a `name` field and `access_control_max_age`. Omitting either returns HTTP 400.

```hcl
resource "anypoint_api_policy_cors" "private" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    public_resource     = false
    support_credentials = true

    origin_groups = [
      {
        name                   = "allowed-origins"
        origins                = ["https://example.com"]
        methods                = ["GET", "POST", "PUT"]
        headers                = ["Content-Type", "Authorization"]
        access_control_max_age = 600
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-10)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) CORS configuration..

### [](#optional-arguments-10)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.3.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-10)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-8)Nested Schema for `configuration`

- `origin_groups` - (Required, Dynamic) Array of origin group configurations. Structure differs by branch — see below.
- `public_resource` - Whether the resource is publicly accessible. Defaults to `false`. Controls which platform schema branch is used.
- `support_credentials` - Whether to allow credentials in CORS requests.

#### [](#origin_groups-public-branch-public_resource-true)`origin_groups` — public branch (`public_resource = true`)

<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 25%;">
<col style="width: 25%;">
<col style="width: 50%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Field</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>origins</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">list(string)</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed origin URLs.</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>methods</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">list(string)</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed HTTP methods (for example, <code>["GET","POST"]</code>).</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>headers</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">list(string)</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed request headers.</p></td>
</tr>
</tbody>
</table>

#### [](#origin_groups-non-public-branch-public_resource-false)`origin_groups` — non-public branch (`public_resource = false`)

<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 40%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Field</th>
<th class="tableblock halign-left valign-top">Required</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>name</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">yes</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Unique label for this origin group. If omitted, the provider synthesizes <code>group-&lt;index&gt;</code>.</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>origins</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">no</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">list(string)</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed origin URLs.</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>methods</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">no</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">list(string)</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">HTTP methods. The provider automatically converts these to <code>allowedMethods</code> objects required by the platform.</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>headers</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">no</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">list(string)</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Allowed request headers.</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>access_control_max_age</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">no</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">number</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Preflight cache duration in seconds. Defaults to <code>30</code>.</p></td>
</tr>
</tbody>
</table>

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p>Using flat fields directly inside <code>configuration</code> (instead of the <code>origin_groups</code> array) is rejected by the platform with HTTP 400.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#pointcut-data-10)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-10)Import

An existing `anypoint_api_policy_cors` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-10)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_cors.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_cors" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-10)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_cors.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_credential_injection_basic_auth)`anypoint_api_policy_credential_injection_basic_auth`

Use the `anypoint_api_policy_credential_injection_basic_auth` resource to inject Basic Auth credentials into upstream requests on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-11)Example Usage

```hcl
resource "anypoint_api_policy_credential_injection_basic_auth" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    username  = "service-account"
    password  = "service-password"
    overwrite = true
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-11)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Credential injection configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs to inject credentials into.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-11)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.

### [](#read-only-attributes-11)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-9)Nested Schema for `configuration`

- `username` - (Required) The username for authentication.
- `password` - (Required) The password for authentication.
- `custom_header` - Custom header name to inject credentials into instead of the standard `Authorization` header.
- `overwrite` - Whether to overwrite an existing credential header on the request. Defaults to `false`. The provider always sends this field — omitting it doesn’t cause HTTP 400.

### [](#pointcut-data-11)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-11)Import

An existing `anypoint_api_policy_credential_injection_basic_auth` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-11)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_credential_injection_basic_auth.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_credential_injection_basic_auth" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-11)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_credential_injection_basic_auth.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_credential_injection_oauth2)`anypoint_api_policy_credential_injection_oauth2`

Use the `anypoint_api_policy_credential_injection_oauth2` resource to fetch an OAuth 2.0 token and inject it into upstream requests on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-12)Example Usage

```hcl
resource "anypoint_api_policy_credential_injection_oauth2" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    oauth_service                    = "https://auth.example.com/oauth2/token"
    client_id                        = "my-client-id"
    client_secret                    = "my-client-secret"
    scope                            = ["read", "write"]
    overwrite                        = true
    token_fetch_timeout              = 5000
    allow_request_without_credential = false
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-12)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) OAuth 2.0 token injection configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs to inject the token into.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-12)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.

### [](#read-only-attributes-12)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-10)Nested Schema for `configuration`

- `oauth_service` - (Required) URL of the OAuth 2.0 token service.
- `client_id` - (Required) The OAuth 2.0 client ID.
- `client_secret` - (Required) The OAuth 2.0 client secret.
- `scope` - (Dynamic) Array of OAuth 2.0 scopes to request.
- `token_fetch_timeout` - Timeout in milliseconds for fetching the OAuth token. Defaults to `10000`. The provider always sends this field — omitting it doesn’t cause HTTP 400.
- `overwrite` - Whether to overwrite an existing credential header on the request. Defaults to `false`. The provider always sends this field.
- `allow_request_without_credential` - Whether to allow requests to pass through without injected credentials. Defaults to `false`. The provider always sends this field.

### [](#pointcut-data-12)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-12)Import

An existing `anypoint_api_policy_credential_injection_oauth2` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-12)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_credential_injection_oauth2.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_credential_injection_oauth2" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-12)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_credential_injection_oauth2.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_credential_injection_oauth2_obo)`anypoint_api_policy_credential_injection_oauth2_obo`

Use the `anypoint_api_policy_credential_injection_oauth2_obo` resource to exchange an incoming token for a downstream token using the OAuth 2.0 On-Behalf-Of flow, then inject it into upstream requests.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-13)Example Usage

```hcl
resource "anypoint_api_policy_credential_injection_oauth2_obo" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    flow           = "urn:ietf:params:oauth:grant-type:jwt-bearer"
    client_id      = "my-client-id"
    client_secret  = "my-client-secret"
    token_endpoint = "https://auth.example.com/oauth2/token"
    scope          = "openid profile"
    timeout        = 5000
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-13)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) On-Behalf-Of token exchange configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs to inject the exchanged token into.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-13)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.1.0`.

### [](#read-only-attributes-13)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-11)Nested Schema for `configuration`

- `client_id` - (Required) The OAuth 2.0 client ID.
- `client_secret` - (Required) The OAuth 2.0 client secret.
- `flow` - (Required) The OAuth 2.0 grant flow type.
- `token_endpoint` - (Required) URL of the OAuth 2.0 token endpoint.
- `ciba_enabled` - Whether CIBA (Client-Initiated Backchannel Authentication) is enabled.
- `ciba_endpoint` - The backchannel authentication endpoint URL (used when `ciba_enabled` is `true`).
- `ciba_binding_message` - A human-readable binding message sent to the user’s authentication device (used when `ciba_enabled` is `true`).
- `ciba_login_hint_claim` - The claim used to identify the end user in the CIBA flow (used when `ciba_enabled` is `true`).
- `distributed` - Whether to use distributed token caching across cluster nodes.
- `requested_token_type` - The type of token to be returned by the token endpoint.
- `scope` - Array or string of OAuth 2.0 scopes.
- `subject_token_type` - The type of the subject token (for example, `urn:ietf:params:oauth:token-type:access_token`).
- `target_type` - The target resource type for the On-Behalf-Of flow.
- `target_value` - The target resource value for the On-Behalf-Of flow.
- `timeout` - Timeout in milliseconds.

### [](#pointcut-data-13)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-13)Import

An existing `anypoint_api_policy_credential_injection_oauth2_obo` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-13)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_credential_injection_oauth2_obo.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_credential_injection_oauth2_obo" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-13)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_credential_injection_oauth2_obo.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_dataweave_request_filter)`anypoint_api_policy_dataweave_request_filter`

Use the `anypoint_api_policy_dataweave_request_filter` resource to evaluate a DataWeave script against incoming requests and allow or reject them based on the result.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-14)Example Usage

```hcl
resource "anypoint_api_policy_dataweave_request_filter" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    script           = "%%dw 2.0\noutput application/json\n---\ntrue"
    requires_payload = false
  }

  order = 1
}
```

### [](#required-arguments-14)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Filter script configuration..

### [](#optional-arguments-14)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-14)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-12)Nested Schema for `configuration`

- `script` - (Required) The DataWeave script to evaluate against the request.
- `requires_payload` - Whether the script requires access to the request payload.

### [](#pointcut-data-14)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-14)Import

An existing `anypoint_api_policy_dataweave_request_filter` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-14)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_dataweave_request_filter.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_dataweave_request_filter" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-14)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_dataweave_request_filter.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_dataweave_body_transformation)`anypoint_api_policy_dataweave_body_transformation`

Use the `anypoint_api_policy_dataweave_body_transformation` resource to transform request or response bodies using a DataWeave script on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-15)Example Usage

```hcl
resource "anypoint_api_policy_dataweave_body_transformation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    script       = "%%dw 2.0\noutput application/json\n---\npayload"
    request_flow = "request"
  }

  order = 1
}
```

### [](#required-arguments-15)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Transformation configuration..

### [](#optional-arguments-15)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-15)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-13)Nested Schema for `configuration`

- `script` - (Required) The DataWeave transformation script.
- `request_flow` - Which flow to apply the transformation to (`request` or `response`).

### [](#pointcut-data-15)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-15)Import

An existing `anypoint_api_policy_dataweave_body_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-15)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_dataweave_body_transformation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_dataweave_body_transformation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-15)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_dataweave_body_transformation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_dataweave_headers_transformation)`anypoint_api_policy_dataweave_headers_transformation`

Use the `anypoint_api_policy_dataweave_headers_transformation` resource to transform request or response headers using a DataWeave script on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-16)Example Usage

```hcl
resource "anypoint_api_policy_dataweave_headers_transformation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    script           = "%%dw 2.0\noutput application/json\n---\npayload"
    requires_payload = false
    request_flow     = "request"
  }

  order = 1
}
```

### [](#required-arguments-16)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Header transformation configuration..

### [](#optional-arguments-16)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-16)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-14)Nested Schema for `configuration`

- `script` - (Required) The DataWeave transformation script.
- `request_flow` - Which flow to apply the transformation to (`request` or `response`).
- `requires_payload` - Whether the script requires access to the payload.

### [](#pointcut-data-16)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-16)Import

An existing `anypoint_api_policy_dataweave_headers_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-16)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_dataweave_headers_transformation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_dataweave_headers_transformation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-16)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_dataweave_headers_transformation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_external_oauth2_access_token_enforcement)`anypoint_api_policy_external_oauth2_access_token_enforcement`

Use the `anypoint_api_policy_external_oauth2_access_token_enforcement` resource to validate OAuth 2.0 access tokens against an external authorization server on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p>This policy is only supported on <code>mule4</code> API instances.</p>
</div>
</td>
</tr>
</tbody></table>

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-17)Example Usage

```hcl
resource "anypoint_api_policy_external_oauth2_access_token_enforcement" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    token_url                 = "https://auth.example.com/oauth2/token"
    scope_validation_criteria = "AND"
    scopes                    = "read write"
    expose_headers            = false
    skip_client_id_validation = true
  }

  order = 1
}
```

### [](#required-arguments-17)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Token validation configuration..

### [](#optional-arguments-17)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.6.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-17)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-15)Nested Schema for `configuration`

- `token_url` - (Required) URL of the OAuth 2.0 token endpoint.
- `authentication_timeout` - Authentication request timeout in milliseconds.
- `expose_headers` - Whether to expose rate-limit headers in the response.
- `max_cache_entries` - Maximum number of entries in the token cache.
- `scope_validation_criteria` - How scopes are validated (`AND` or `OR`).
- `scopes` - Space-separated list of required OAuth scopes.
- `secure_trust_store` - Whether to use a secure trust store for token validation.
- `skip_client_id_validation` - Whether to skip client ID validation.

### [](#pointcut-data-17)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-17)Import

An existing `anypoint_api_policy_external_oauth2_access_token_enforcement` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-17)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_external_oauth2_access_token_enforcement.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_external_oauth2_access_token_enforcement" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-17)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_external_oauth2_access_token_enforcement.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_header_injection)`anypoint_api_policy_header_injection`

Use the `anypoint_api_policy_header_injection` resource to add custom headers to inbound requests or outbound responses on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-18)Example Usage

```hcl
resource "anypoint_api_policy_header_injection" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    inbound_headers = [
      {
        name  = "X-Custom-Header"
        value = "custom-value"
      }
    ]
    outbound_headers = []
  }

  order = 1
}
```

### [](#required-arguments-18)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Header injection configuration..

### [](#optional-arguments-18)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.3.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-18)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-16)Nested Schema for `configuration`

- `inbound_headers` - (Dynamic) Array of inbound headers to inject or remove.
- `outbound_headers` - (Dynamic) Array of outbound headers to inject or remove.

### [](#pointcut-data-18)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-18)Import

An existing `anypoint_api_policy_header_injection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-18)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_header_injection.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_header_injection" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-18)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_header_injection.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_header_removal)`anypoint_api_policy_header_removal`

Use the `anypoint_api_policy_header_removal` resource to strip specific headers from inbound requests or outbound responses on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-19)Example Usage

```hcl
resource "anypoint_api_policy_header_removal" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    inbound_headers = [
      {
        name = "X-Remove-Me"
      }
    ]
    outbound_headers = []
  }

  order = 1
}
```

### [](#required-arguments-19)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Header removal configuration..

### [](#optional-arguments-19)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-19)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-17)Nested Schema for `configuration`

- `inbound_headers` - (Dynamic) Array of inbound headers to remove.
- `outbound_headers` - (Dynamic) Array of outbound headers to remove.

### [](#pointcut-data-19)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-19)Import

An existing `anypoint_api_policy_header_removal` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-19)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_header_removal.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_header_removal" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-19)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_header_removal.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_header_transformation)`anypoint_api_policy_header_transformation`

Use the `anypoint_api_policy_header_transformation` resource to transform request or response headers using a DataWeave script on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-20)Example Usage

```hcl
resource "anypoint_api_policy_header_transformation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    script           = "%%dw 2.0\noutput application/json\n---\npayload"
    requires_payload = false
    request_flow     = "request"
  }

  order = 1
}
```

### [](#required-arguments-20)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Transformation configuration..

### [](#optional-arguments-20)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260127.134148`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-20)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-18)Nested Schema for `configuration`

- `script` - (Required) The DataWeave transformation script.
- `request_flow` - Which flow to apply the transformation to (`request` or `response`).
- `requires_payload` - Whether the script requires access to the payload.

### [](#pointcut-data-20)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-20)Import

An existing `anypoint_api_policy_header_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-20)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_header_transformation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_header_transformation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-20)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_header_transformation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_health_check)`anypoint_api_policy_health_check`

Use the `anypoint_api_policy_health_check` resource to expose a health check endpoint on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-21)Example Usage

```hcl
resource "anypoint_api_policy_health_check" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    endpoint    = "/health"
    path        = "/health"
    status_code = "200"
  }

  order = 1
}
```

### [](#required-arguments-21)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Health check configuration..

### [](#optional-arguments-21)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-21)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-19)Nested Schema for `configuration`

- `endpoint` - The health check endpoint URL.
- `path` - The health check path.
- `status_code` - The expected HTTP status code for a healthy response.

### [](#pointcut-data-21)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-21)Import

An existing `anypoint_api_policy_health_check` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-21)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_health_check.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_health_check" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-21)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_health_check.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_http_basic_authentication)`anypoint_api_policy_http_basic_authentication`

Use the `anypoint_api_policy_http_basic_authentication` resource to enforce HTTP Basic Authentication on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-22)Example Usage

```hcl
resource "anypoint_api_policy_http_basic_authentication" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    username = "admin"
    password = "secret"
  }

  order = 1
}
```

### [](#required-arguments-22)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Authentication credentials..

### [](#optional-arguments-22)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.3.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-22)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-20)Nested Schema for `configuration`

- `username` - (Required) The username for authentication.
- `password` - (Required) The password for authentication.

### [](#pointcut-data-22)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-22)Import

An existing `anypoint_api_policy_http_basic_authentication` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-22)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_http_basic_authentication.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_http_basic_authentication" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-22)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_http_basic_authentication.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_http_caching)`anypoint_api_policy_http_caching`

Use the `anypoint_api_policy_http_caching` resource to cache HTTP responses on an Anypoint API instance to reduce upstream load and improve response times.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-23)Example Usage

```hcl
resource "anypoint_api_policy_http_caching" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    http_caching_key       = "#[attributes.requestPath]"
    max_cache_entries      = 1000
    ttl                    = 600
    distributed            = false
    persist_cache          = false
    use_http_cache_headers = true
    invalidation_header    = "X-Cache-Invalidate"
  }

  order = 1
}
```

### [](#required-arguments-23)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Cache configuration..

### [](#optional-arguments-23)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-23)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-21)Nested Schema for `configuration`

- `http_caching_key` - Expression to compute the cache key.
- `max_cache_entries` - Maximum number of entries in the cache.
- `ttl` - Time-to-live in seconds for cached entries.
- `distributed` - Whether the cache is distributed across the cluster.
- `persist_cache` - Whether to persist the cache to disk.
- `use_http_cache_headers` - Whether to honor standard HTTP caching headers.
- `invalidation_header` - Header name that triggers cache invalidation.
- `request_expression` - Expression to evaluate on the request for caching decisions.
- `response_expression` - Expression to evaluate on the response for caching decisions.

### [](#pointcut-data-23)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-23)Import

An existing `anypoint_api_policy_http_caching` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-23)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_http_caching.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_http_caching" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-23)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_http_caching.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_idle_timeout)`anypoint_api_policy_idle_timeout`

Use the `anypoint_api_policy_idle_timeout` resource to close idle upstream connections after a configurable period on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-24)Example Usage

```hcl
resource "anypoint_api_policy_idle_timeout" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    timeout = 30000
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-24)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Timeout configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy monitors.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-24)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.

### [](#read-only-attributes-24)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-22)Nested Schema for `configuration`

- `timeout` - (Required) Idle connection timeout in milliseconds.

### [](#pointcut-data-24)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-24)Import

An existing `anypoint_api_policy_idle_timeout` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-24)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_idle_timeout.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_idle_timeout" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-24)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_idle_timeout.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_intask_authentication_policy)`anypoint_api_policy_intask_authentication_policy`

Use the `anypoint_api_policy_intask_authentication_policy` resource to delegate authentication to a secondary OAuth 2.0 provider on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-25)Example Usage

```hcl
resource "anypoint_api_policy_intask_authentication_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    secondary_auth_provider = "example-provider"
    authorization_endpoint  = "https://auth.example.com/authorize"
    token_endpoint          = "https://auth.example.com/token"
    redirect_uri            = "https://app.example.com/callback"
    scopes                  = "openid profile"
    response_type           = "code"
    token_timeout           = 3600
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-25)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Authentication configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-25)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260113204639`.

### [](#read-only-attributes-25)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-23)Nested Schema for `configuration`

- `authorization_endpoint` - (Required) URL of the OAuth 2.0 authorization endpoint.
- `redirect_uri` - (Required) The redirect URI for the OAuth 2.0 flow.
- `secondary_auth_provider` - (Required) Name of the secondary authentication provider.
- `token_endpoint` - (Required) URL of the OAuth 2.0 token endpoint.
- `body_encoding` - Encoding for the token request body.
- `challenge_response_status_code` - HTTP status code for the challenge response.
- `code_challenge_method` - The PKCE code challenge method (for example, `S256`).
- `response_type` - The OAuth 2.0 response type (for example, `code`).
- `scopes` - Space-separated list of required OAuth scopes.
- `token_audience` - Expected audience value for the token.
- `token_timeout` - Token validity timeout in seconds.
- `user_email_header` - Header name to extract the user email from.
- `user_id_header` - Header name to extract the user ID from.

### [](#pointcut-data-25)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-25)Import

An existing `anypoint_api_policy_intask_authentication_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-25)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_intask_authentication_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_intask_authentication_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-25)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_intask_authentication_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_intask_authorization_code_policy)`anypoint_api_policy_intask_authorization_code_policy`

Use the `anypoint_api_policy_intask_authorization_code_policy` resource to enforce the OAuth 2.0 Authorization Code flow via a secondary provider on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-26)Example Usage

```hcl
resource "anypoint_api_policy_intask_authorization_code_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    secondary_auth_provider = "example-provider"
    authorization_endpoint  = "https://auth.example.com/authorize"
    token_endpoint          = "https://auth.example.com/token"
    redirect_uri            = "https://app.example.com/callback"
    scopes                  = "openid profile"
    response_type           = "code"
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-26)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Authorization code flow configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-26)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.

### [](#read-only-attributes-26)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-24)Nested Schema for `configuration`

- `authorization_endpoint` - (Required) URL of the OAuth 2.0 authorization endpoint.
- `redirect_uri` - (Required) The redirect URI for the OAuth 2.0 flow.
- `secondary_auth_provider` - (Required) Name of the secondary authentication provider.
- `token_endpoint` - (Required) URL of the OAuth 2.0 token endpoint.
- `body_encoding` - Encoding for the token request body.
- `challenge_response_status_code` - HTTP status code for the challenge response.
- `code_challenge_method` - The PKCE code challenge method (for example, `S256`).
- `response_type` - The OAuth 2.0 response type (for example, `code`).
- `scopes` - Space-separated list of required OAuth scopes.
- `token_timeout` - Token validity timeout in seconds.

### [](#pointcut-data-26)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-26)Import

An existing `anypoint_api_policy_intask_authorization_code_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-26)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_intask_authorization_code_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_intask_authorization_code_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-26)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_intask_authorization_code_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_ip_allowlist)`anypoint_api_policy_ip_allowlist`

Use the `anypoint_api_policy_ip_allowlist` resource to restrict access to an Anypoint API instance to a specific set of IP addresses or CIDR blocks.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-27)Example Usage

```hcl
resource "anypoint_api_policy_ip_allowlist" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    ip_expression  = "#[attributes.remoteAddress]"
    ips            = ["10.0.0.0/8", "172.16.0.0/12"]
    methods_string = "GET|POST"
  }

  order = 1
}
```

### [](#required-arguments-27)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Allowlist configuration..

### [](#optional-arguments-27)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-27)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-25)Nested Schema for `configuration`

- `ip_expression` - (Required) Expression to extract the client IP address from the request.
- `ips` - (Required, List of String) IP addresses or CIDR blocks to allow. Must be a list of strings, not a comma-separated string.
- `methods_string` - Pipe-separated list of HTTP methods this policy applies to (for example, `GET|POST`).

### [](#pointcut-data-27)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-27)Import

An existing `anypoint_api_policy_ip_allowlist` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-27)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_ip_allowlist.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_ip_allowlist" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-27)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_ip_allowlist.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_ip_blocklist)`anypoint_api_policy_ip_blocklist`

Use the `anypoint_api_policy_ip_blocklist` resource to deny access to an Anypoint API instance from specific IP addresses or CIDR blocks.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-28)Example Usage

```hcl
resource "anypoint_api_policy_ip_blocklist" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    ip_expression  = "#[attributes.remoteAddress]"
    ips            = ["192.168.1.0/24", "10.0.0.1"]
    methods_string = "GET|POST"
  }

  order = 1
}
```

### [](#required-arguments-28)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Blocklist configuration..

### [](#optional-arguments-28)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-28)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-26)Nested Schema for `configuration`

- `ip_expression` - (Required) Expression to extract the client IP address from the request.
- `ips` - (Required, List of String) IP addresses or CIDR blocks to block. Must be a list of strings, not a comma-separated string.
- `methods_string` - Pipe-separated list of HTTP methods this policy applies to (for example, `GET|POST`).

### [](#pointcut-data-28)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-28)Import

An existing `anypoint_api_policy_ip_blocklist` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-28)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_ip_blocklist.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_ip_blocklist" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-28)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_ip_blocklist.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_injection_protection)`anypoint_api_policy_injection_protection`

Use the `anypoint_api_policy_injection_protection` resource to detect and block SQL, script, and other injection attacks on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-29)Example Usage

```hcl
resource "anypoint_api_policy_injection_protection" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    protect_path_and_query = true
    protect_headers        = true
    protect_body           = true
    reject_requests        = true
    built_in_protections   = ["sql-injection", "script-injection"]
  }

  order = 1
}
```

### [](#required-arguments-29)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Injection protection configuration..

### [](#optional-arguments-29)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-29)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-27)Nested Schema for `configuration`

- `built_in_protections` - (Dynamic) Built-in injection protection types to enable (for example, `sql-injection`, `script-injection`).
- `custom_protections` - (Dynamic) Custom injection protection regex patterns.
- `protect_path_and_query` - Whether to apply injection protection to path and query parameters.
- `protect_headers` - Whether to apply injection protection to headers.
- `protect_body` - Whether to apply injection protection to the request body.
- `reject_requests` - Whether to reject requests that match injection patterns.

### [](#pointcut-data-29)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-29)Import

An existing `anypoint_api_policy_injection_protection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-29)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_injection_protection.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_injection_protection" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-29)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_injection_protection.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_json_threat_protection)`anypoint_api_policy_json_threat_protection`

Use the `anypoint_api_policy_json_threat_protection` resource to protect an Anypoint API instance against malicious JSON payloads by enforcing structural limits.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-30)Example Usage

```hcl
resource "anypoint_api_policy_json_threat_protection" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    max_container_depth          = 10
    max_string_value_length      = 256
    max_object_entry_name_length = 128
    max_object_entry_count       = 50
    max_array_element_count      = 50
  }

  order = 1
}
```

### [](#required-arguments-30)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) JSON structural limits..

### [](#optional-arguments-30)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.2.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-30)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-28)Nested Schema for `configuration`

- `max_container_depth` - Maximum nesting depth for JSON containers.
- `max_string_value_length` - Maximum length for JSON string values.
- `max_object_entry_name_length` - Maximum length for JSON object entry names.
- `max_object_entry_count` - Maximum number of entries in a JSON object.
- `max_array_element_count` - Maximum number of elements in a JSON array.

### [](#pointcut-data-30)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-30)Import

An existing `anypoint_api_policy_json_threat_protection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-30)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_json_threat_protection.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_json_threat_protection" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-30)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_json_threat_protection.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_jwt_validation)`anypoint_api_policy_jwt_validation`

Use the `anypoint_api_policy_jwt_validation` resource to validate JWT tokens on incoming requests to an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-31)Example Usage

```hcl
resource "anypoint_api_policy_jwt_validation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id
  asset_version   = "1.4.0"

  configuration = {
    jwt_origin                      = "httpBearerAuthenticationHeader"
    signing_method                  = "rsa"
    signing_key_length              = 256
    jwt_key_origin                  = "jwks"
    jwks_url                        = "https://example.com/.well-known/jwks.json"
    jwks_service_time_to_live       = 60
    jwks_service_connection_timeout = 10000
    skip_client_id_validation       = true
    validate_aud_claim              = false
    mandatory_aud_claim             = false
    mandatory_exp_claim             = false
    mandatory_nbf_claim             = false
    validate_custom_claim           = true
    jwt_expression                  = "#[attributes.headers['jwt']]"
    client_id_expression            = "#[vars.claimSet.client_id]"
    supported_audiences             = "aud.example.com"
    mandatory_custom_claims = [
      {
        key   = "key1"
        value = "value1"
      },
      {
        key   = "key2"
        value = "value2"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-31)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `asset_version` - Policy asset version (for example, `1.4.0`). Must match the version deployed in your organization’s Exchange.
- `configuration` - (Block) JWT validation configuration.

### [](#optional-arguments-31)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-31)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-29)Nested Schema for `configuration`

- `jwt_origin` - (Required) Where the JWT token is extracted from (for example, `httpBearerAuthenticationHeader`).
- `claims_to_headers` - (Dynamic) Array mapping JWT claims to response headers.
- `client_id_expression` - Expression to extract the client ID from the request.
- `custom_key_expression` - Custom expression to resolve the signing key.
- `jwks_service_connection_timeout` - Connection timeout in milliseconds for the JWKS endpoint.
- `jwks_service_time_to_live` - TTL in seconds for cached JWKS keys.
- `jwks_url` - URL to the JWKS endpoint for key retrieval.
- `jwt_expression` - Custom expression to extract the JWT token.
- `jwt_key_origin` - Source of the signing key (for example, `jwks`, `text`).
- `mandatory_aud_claim` - Whether the `aud` claim is mandatory.
- `mandatory_custom_claims` - (Dynamic) Custom claims that must be present.
- `mandatory_exp_claim` - Whether the `exp` (expiration) claim is mandatory.
- `mandatory_nbf_claim` - Whether the `nbf` (not before) claim is mandatory.
- `non_mandatory_custom_claims` - (Dynamic) Optional custom claims to validate if present.
- `signing_key_length` - The key length for the signing algorithm.
- `signing_method` - The signing algorithm (for example, `rsa`, `hmac`).
- `skip_client_id_validation` - Whether to skip client ID validation.
- `supported_audiences` - Comma-separated list of supported audience values.
- `text_key` - The inline signing key when `jwt_key_origin` is `text`.
- `validate_aud_claim` - Whether to validate the `aud` (audience) claim.
- `validate_custom_claim` - Whether to validate custom claims.

### [](#pointcut-data-31)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-31)Import

An existing `anypoint_api_policy_jwt_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-31)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_jwt_validation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_jwt_validation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-31)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_jwt_validation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_ldap_authentication)`anypoint_api_policy_ldap_authentication`

Use the `anypoint_api_policy_ldap_authentication` resource to authenticate incoming requests against an LDAP directory on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-32)Example Usage

```hcl
resource "anypoint_api_policy_ldap_authentication" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    ldap_server_url           = "ldap://ldap.example.com:389"
    ldap_server_user_dn       = "cn=admin,dc=example,dc=com"
    ldap_server_user_password = "admin-password"
    ldap_search_base          = "ou=users,dc=example,dc=com"
    ldap_search_filter        = "(uid={0})"
    ldap_search_in_subtree    = true
  }

  order = 1
}
```

### [](#required-arguments-32)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) LDAP connection and search configuration..

### [](#optional-arguments-32)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.4.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-32)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-30)Nested Schema for `configuration`

- `ldap_server_url` - (Required) URL of the LDAP server.
- `ldap_server_user_dn` - (Required) Distinguished name of the LDAP bind user.
- `ldap_server_user_password` - (Required) Password for the LDAP bind user.
- `ldap_search_base` - (Required) Base DN for LDAP searches.
- `ldap_search_filter` - (Required) LDAP search filter expression.
- `ldap_search_in_subtree` - Whether to search in subtrees.

### [](#pointcut-data-32)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-32)Import

An existing `anypoint_api_policy_ldap_authentication` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-32)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_ldap_authentication.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_ldap_authentication" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-32)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_ldap_authentication.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_bedrock_llm_provider_policy)`anypoint_api_policy_bedrock_llm_provider_policy`

Use the `anypoint_api_policy_bedrock_llm_provider_policy` resource to configure AWS Bedrock as the LLM provider for an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-33)Example Usage

```hcl
resource "anypoint_api_policy_bedrock_llm_provider_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    aws_access_key_id     = "AKIAIOSFODNN7EXAMPLE"
    aws_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    aws_region            = "us-east-1"
    service_name          = "bedrock"
    timeout               = 30000
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-33)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) AWS Bedrock connection configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-33)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.

### [](#read-only-attributes-33)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-31)Nested Schema for `configuration`

- `aws_access_key_id` - (Required) AWS access key ID.
- `aws_region` - (Required) AWS region for the Bedrock service.
- `aws_secret_access_key` - (Required) AWS secret access key.
- `aws_session_token` - AWS session token for temporary credentials.
- `service_name` - The AWS service name.
- `timeout` - Request timeout in milliseconds.

### [](#pointcut-data-33)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-33)Import

An existing `anypoint_api_policy_bedrock_llm_provider_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-33)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_bedrock_llm_provider_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_bedrock_llm_provider_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-33)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_bedrock_llm_provider_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_gemini_llm_provider_policy)`anypoint_api_policy_gemini_llm_provider_policy`

Use the `anypoint_api_policy_gemini_llm_provider_policy` resource to configure Google Gemini as the LLM provider for an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-34)Example Usage

```hcl
resource "anypoint_api_policy_gemini_llm_provider_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    api_key = "AIzaSy-xxxxxxxxxxxx"
    timeout = 30000
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-34)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Gemini connection configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-34)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.

### [](#read-only-attributes-34)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-32)Nested Schema for `configuration`

- `api_key` - (Required) API key for the Gemini LLM provider.
- `model_mapper` - (Dynamic) Array of model name mappings.
- `timeout` - Request timeout in milliseconds.

### [](#pointcut-data-34)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-34)Import

An existing `anypoint_api_policy_gemini_llm_provider_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-34)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_gemini_llm_provider_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_gemini_llm_provider_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-34)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_gemini_llm_provider_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_gemini_transcoding_policy)`anypoint_api_policy_gemini_transcoding_policy`

Use the `anypoint_api_policy_gemini_transcoding_policy` resource to transcode requests and responses between the OpenAI API format and the Google Gemini API format on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-35)Example Usage

```hcl
resource "anypoint_api_policy_gemini_transcoding_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {}

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-35)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`).
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-35)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.

### [](#read-only-attributes-35)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#pointcut-data-35)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-35)Import

An existing `anypoint_api_policy_gemini_transcoding_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-35)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_gemini_transcoding_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_gemini_transcoding_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-35)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_gemini_transcoding_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_llm_gw_core_policy)`anypoint_api_policy_llm_gw_core_policy`

Use the `anypoint_api_policy_llm_gw_core_policy` resource to route LLM requests to the correct provider backend based on a vendor header on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-36)Example Usage

```hcl
resource "anypoint_api_policy_llm_gw_core_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    header_name           = "X-LLM-Vendor"
    vendor_header_mapping = [
      {
        vendor       = "openai"
        header_value = "openai"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-36)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Vendor routing configuration..

### [](#optional-arguments-36)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20251230075635`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-36)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-33)Nested Schema for `configuration`

- `header_name` - (Required) Name of the header used for vendor routing.
- `vendor_header_mapping` - (Required, Dynamic) Array mapping vendor names to header values.

### [](#pointcut-data-36)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-36)Import

An existing `anypoint_api_policy_llm_gw_core_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-36)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_llm_gw_core_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_llm_gw_core_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-36)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_llm_gw_core_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_llm_proxy_core)`anypoint_api_policy_llm_proxy_core`

Use the `anypoint_api_policy_llm_proxy_core` resource to enable core LLM proxy functionality on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-37)Example Usage

```hcl
resource "anypoint_api_policy_llm_proxy_core" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {}

  order = 1
}
```

### [](#required-arguments-37)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`).

### [](#optional-arguments-37)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260127095720`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-37)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#pointcut-data-37)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-37)Import

An existing `anypoint_api_policy_llm_proxy_core` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-37)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_llm_proxy_core.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_llm_proxy_core" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-37)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_llm_proxy_core.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_llm_proxy_core_policy)`anypoint_api_policy_llm_proxy_core_policy`

Use the `anypoint_api_policy_llm_proxy_core_policy` resource to route LLM proxy requests to the correct provider backend based on a vendor header on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-38)Example Usage

```hcl
resource "anypoint_api_policy_llm_proxy_core_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    header_name           = "X-LLM-Vendor"
    vendor_header_mapping = [
      {
        vendor       = "openai"
        header_value = "openai"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-38)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Vendor routing configuration..

### [](#optional-arguments-38)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260108100848`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-38)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-34)Nested Schema for `configuration`

- `header_name` - (Required) Name of the header used for vendor routing.
- `vendor_header_mapping` - (Required, Dynamic) Array mapping vendor names to header values.

### [](#pointcut-data-38)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-38)Import

An existing `anypoint_api_policy_llm_proxy_core_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-38)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_llm_proxy_core_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_llm_proxy_core_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-38)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_llm_proxy_core_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_access_control)`anypoint_api_policy_mcp_access_control`

Use the `anypoint_api_policy_mcp_access_control` resource to define access control rules for MCP tools on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-39)Example Usage

```hcl
resource "anypoint_api_policy_mcp_access_control" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    rules = [
      {
        tool   = "list_files"
        action = "allow"
      }
    ]
    auth_type = "bearer"
  }

  order = 1
}
```

### [](#required-arguments-39)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Access control configuration..

### [](#optional-arguments-39)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-39)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-35)Nested Schema for `configuration`

- `rules` - (Required, Dynamic) Array of access control rules.
- `auth_type` - Authentication type (for example, `bearer`, `api_key`).

### [](#pointcut-data-39)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-39)Import

An existing `anypoint_api_policy_mcp_access_control` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-39)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_access_control.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_access_control" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-39)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_access_control.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_global_access_policy)`anypoint_api_policy_mcp_global_access_policy`

Use the `anypoint_api_policy_mcp_global_access_policy` resource to define global access rules for all MCP tools on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-40)Example Usage

```hcl
resource "anypoint_api_policy_mcp_global_access_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    rules = [
      {
        action = "allow"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-40)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Access control configuration..

### [](#optional-arguments-40)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-40)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-36)Nested Schema for `configuration`

- `rules` - (Required, Dynamic) Array of access control rules.

### [](#pointcut-data-40)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-40)Import

An existing `anypoint_api_policy_mcp_global_access_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-40)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_global_access_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_global_access_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-40)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_global_access_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_pii_detector)`anypoint_api_policy_mcp_pii_detector`

Use the `anypoint_api_policy_mcp_pii_detector` resource to detect personally identifiable information (PII) in MCP requests and responses on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-41)Example Usage

```hcl
resource "anypoint_api_policy_mcp_pii_detector" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    entities = ["EMAIL", "PHONE_NUMBER", "CREDIT_CARD"]
  }

  order = 1
}
```

### [](#required-arguments-41)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) PII detection configuration..

### [](#optional-arguments-41)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-41)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-37)Nested Schema for `configuration`

- `entities` - (Required, Dynamic) PII entity types to detect (for example, `EMAIL`, `PHONE_NUMBER`, `CREDIT_CARD`).

### [](#pointcut-data-41)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-41)Import

An existing `anypoint_api_policy_mcp_pii_detector` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-41)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_pii_detector.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_pii_detector" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-41)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_pii_detector.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_schema_validation)`anypoint_api_policy_mcp_schema_validation`

Use the `anypoint_api_policy_mcp_schema_validation` resource to validate MCP tool input and output against their declared schemas on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-42)Example Usage

```hcl
resource "anypoint_api_policy_mcp_schema_validation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    validate_tool_schema = true
  }

  order = 1
}
```

### [](#required-arguments-42)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Schema validation configuration..

### [](#optional-arguments-42)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-42)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-38)Nested Schema for `configuration`

- `validate_tool_schema` - Whether to validate MCP tool input/output against schema.

### [](#pointcut-data-42)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-42)Import

An existing `anypoint_api_policy_mcp_schema_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-42)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_schema_validation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_schema_validation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-42)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_schema_validation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_support)`anypoint_api_policy_mcp_support`

Use the `anypoint_api_policy_mcp_support` resource to enable Model Context Protocol (MCP) support on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-43)Example Usage

```hcl
resource "anypoint_api_policy_mcp_support" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {}

  order = 1
}
```

### [](#required-arguments-43)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`).

### [](#optional-arguments-43)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-43)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#pointcut-data-43)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-43)Import

An existing `anypoint_api_policy_mcp_support` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-43)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_support.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_support" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-43)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_support.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_tool_mapping)`anypoint_api_policy_mcp_tool_mapping`

Use the `anypoint_api_policy_mcp_tool_mapping` resource to remap MCP tool names from a source name to a target name on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-44)Example Usage

```hcl
resource "anypoint_api_policy_mcp_tool_mapping" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    tool_mappings = [
      {
        source_tool = "original_tool"
        target_tool = "mapped_tool"
      }
    ]
    log_mappings = true
  }

  order = 1
}
```

### [](#required-arguments-44)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Tool mapping configuration..

### [](#optional-arguments-44)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-44)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-39)Nested Schema for `configuration`

- `tool_mappings` - (Required, Dynamic) Array of tool name mappings from source to target.
- `log_mappings` - Whether to log tool mapping operations.

### [](#pointcut-data-44)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-44)Import

An existing `anypoint_api_policy_mcp_tool_mapping` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-44)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_tool_mapping.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_tool_mapping" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-44)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_tool_mapping.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_mcp_transcoding_router)`anypoint_api_policy_mcp_transcoding_router`

Use the `anypoint_api_policy_mcp_transcoding_router` resource to route and transcode MCP requests to backend services on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-45)Example Usage

```hcl
resource "anypoint_api_policy_mcp_transcoding_router" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    transcoding_path = "/mcp"
    routes = [
      {
        tool    = "example_tool"
        backend = "https://backend.example.com"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-45)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Transcoding router configuration..

### [](#optional-arguments-45)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1-20260414150102`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-45)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-40)Nested Schema for `configuration`

- `routes` - (Required, Dynamic) Array of routing rules mapping tools to backends.
- `transcoding_path` - Base path for MCP transcoding requests.

### [](#pointcut-data-45)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-45)Import

An existing `anypoint_api_policy_mcp_transcoding_router` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-45)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_mcp_transcoding_router.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_mcp_transcoding_router" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-45)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_mcp_transcoding_router.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_message_logging)`anypoint_api_policy_message_logging`

Use the `anypoint_api_policy_message_logging` resource to log request and response messages on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-46)Example Usage

```hcl
resource "anypoint_api_policy_message_logging" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    logging_configuration = [
      {
        item_name = "request"
        item_data = {
          message        = "#[payload]"
          conditional    = "#[true]"
          level          = "INFO"
          first_section  = true
          second_section = false
        }
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-46)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Logging configuration..

### [](#optional-arguments-46)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `2.0.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-46)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-41)Nested Schema for `configuration`

- `logging_configuration` - (Required, Dynamic) Array of logging rule objects. Each element must use the `item_name` + `item_data` wrapper — the platform rejects flat field structures with HTTP 400.

Each element requires the following structure:

```hcl
logging_configuration = [
  {
    item_name = "<string>"   # unique label for this logging rule
    item_data = {
      message        = "<string>"  # DataWeave expression or literal, e.g. "#[payload]"
      level          = "<string>"  # Log level: DEBUG, INFO, WARN, ERROR (default: INFO)
      conditional    = "<string>"  # Optional DataWeave boolean expression, e.g. "#[true]"
      category       = "<string>"  # Optional logger category name
      first_section  = <bool>      # Log on request phase (default: true)
      second_section = <bool>      # Log on response phase (default: false)
    }
  }
]
```

### [](#pointcut-data-46)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-46)Import

An existing `anypoint_api_policy_message_logging` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-46)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_message_logging.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_message_logging" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-46)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_message_logging.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_message_logging_outbound)`anypoint_api_policy_message_logging_outbound`

Use the `anypoint_api_policy_message_logging_outbound` resource to log outbound responses from upstream services on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-47)Example Usage

```hcl
resource "anypoint_api_policy_message_logging_outbound" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    logging_configuration = [
      {
        item_name = "response"
        item_data = {
          message        = "#[payload]"
          conditional    = "#[true]"
          level          = "INFO"
          first_section  = false
          second_section = true
        }
      }
    ]
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-47)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Logging configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-47)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `2.0.2`.

### [](#read-only-attributes-47)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-42)Nested Schema for `configuration`

- `logging_configuration` - (Required, Dynamic) Array of logging rule objects. Each element must use the `item_name` + `item_data` wrapper — the platform rejects flat field structures with HTTP 400.

Each element requires the following structure:

```hcl
logging_configuration = [
  {
    item_name = "<string>"   # unique label for this logging rule
    item_data = {
      message        = "<string>"  # DataWeave expression or literal, e.g. "#[payload]"
      level          = "<string>"  # Log level: DEBUG, INFO, WARN, ERROR (default: INFO)
      conditional    = "<string>"  # Optional DataWeave boolean expression, e.g. "#[true]"
      category       = "<string>"  # Optional logger category name
      first_section  = <bool>      # Log on request phase (default: true)
      second_section = <bool>      # Log on response phase (default: false)
    }
  }
]
```

### [](#pointcut-data-47)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-47)Import

An existing `anypoint_api_policy_message_logging_outbound` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-47)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_message_logging_outbound.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_message_logging_outbound" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-47)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_message_logging_outbound.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_model_based_routing)`anypoint_api_policy_model_based_routing`

Use the `anypoint_api_policy_model_based_routing` resource to route LLM requests to the appropriate upstream based on the requested model on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-48)Example Usage

```hcl
resource "anypoint_api_policy_model_based_routing" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    supported_vendors = [
      {
        vendor = "openai"
        models = ["gpt-4", "gpt-3.5-turbo"]
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-48)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Routing configuration..

### [](#optional-arguments-48)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260127100214`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-48)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-43)Nested Schema for `configuration`

- `supported_vendors` - (Required, Dynamic) Array of supported LLM vendor configurations.
- `fallback` - (Dynamic) Fallback vendor configuration object.

### [](#pointcut-data-48)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-48)Import

An existing `anypoint_api_policy_model_based_routing` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-48)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_model_based_routing.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_model_based_routing" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-48)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_model_based_routing.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_agent_connection_telemetry)`anypoint_api_policy_agent_connection_telemetry`

Use the `anypoint_api_policy_agent_connection_telemetry` resource to collect telemetry data from agent connections on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-49)Example Usage

```hcl
resource "anypoint_api_policy_agent_connection_telemetry" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    source_agent_id = "agent-001"
  }

  order = 1
}
```

### [](#required-arguments-49)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Telemetry configuration..

### [](#optional-arguments-49)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-49)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-44)Nested Schema for `configuration`

- `source_agent_id` - Identifier for the source agent connection.

### [](#pointcut-data-49)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-49)Import

An existing `anypoint_api_policy_agent_connection_telemetry` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-49)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_agent_connection_telemetry.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_agent_connection_telemetry" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-49)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_agent_connection_telemetry.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_native_aws_lambda)`anypoint_api_policy_native_aws_lambda`

Use the `anypoint_api_policy_native_aws_lambda` resource to invoke an AWS Lambda function natively from an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-50)Example Usage

```hcl
resource "anypoint_api_policy_native_aws_lambda" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    arn                 = "arn:aws:lambda:us-east-1:123456789012:function:my-function"
    payload_passthrough = false
    invocation_mode     = "synchronous"
    authentication_mode = "static_credentials"
    credentials = {
      access_key_id     = "AKIAIOSFODNN7EXAMPLE"
      secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    }
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-50)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Lambda invocation configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-50)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.

### [](#read-only-attributes-50)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-45)Nested Schema for `configuration`

- `arn` - (Required) The ARN of the AWS Lambda function.
- `payload_passthrough` - (Required) Whether to pass the request payload directly to Lambda.
- `invocation_mode` - (Required) Lambda invocation mode (`synchronous` or `asynchronous`).
- `authentication_mode` - (Required) AWS authentication mode (for example, `static_credentials`, `iam_role`).
- `credentials` - (Dynamic) AWS credentials object with `access_key_id`, `secret_access_key`, and optional `session_token`.

### [](#pointcut-data-50)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-50)Import

An existing `anypoint_api_policy_native_aws_lambda` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-50)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_native_aws_lambda.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_native_aws_lambda" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-50)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_native_aws_lambda.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_native_ext_authz)`anypoint_api_policy_native_ext_authz`

Use the `anypoint_api_policy_native_ext_authz` resource to delegate authorization decisions to an external service via gRPC or HTTP on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-51)Example Usage

```hcl
resource "anypoint_api_policy_native_ext_authz" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    uri             = "grpc://auth-service:9090"
    server_type     = "grpc"
    request_timeout = 5000
  }

  order = 1
}
```

### [](#required-arguments-51)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) External authorization configuration..

### [](#optional-arguments-51)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.2.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-51)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-46)Nested Schema for `configuration`

- `uri` - (Required) The URI of the external authorization service.
- `server_type` - (Required) The server type (for example, `grpc`, `http`).
- `allowed_headers` - (Dynamic) Headers to forward to the external service.
- `include_peer_certificate` - Whether to include the peer certificate in the authorization request.
- `path_prefix` - Path prefix for the external authorization request.
- `request_timeout` - Request timeout in milliseconds.
- `server_api_version` - The API version of the external authorization server.
- `service_request_headers_to_add` - (Dynamic) Headers to add to the authorization request.
- `service_response_client_headers` - (Dynamic) Headers from the authorization response to send to the client.
- `service_response_client_headers_on_success` - (Dynamic) Headers to send on successful authorization.
- `service_response_upstream_headers` - (Dynamic) Headers from the authorization response to send upstream.
- `service_response_upstream_headers_to_append` - (Dynamic) Headers from the authorization response to append upstream.

### [](#pointcut-data-51)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-51)Import

An existing `anypoint_api_policy_native_ext_authz` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-51)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_native_ext_authz.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_native_ext_authz" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-51)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_native_ext_authz.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_native_ext_proc)`anypoint_api_policy_native_ext_proc`

Use the `anypoint_api_policy_native_ext_proc` resource to stream request and response messages to an external gRPC processing service on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-52)Example Usage

```hcl
resource "anypoint_api_policy_native_ext_proc" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    uri                  = "grpc://ext-proc-service:9091"
    message_timeout      = 5000
    failure_mode_allow   = false
    request_header_mode  = "SEND"
    response_header_mode = "SKIP"
  }

  order = 1
}
```

### [](#required-arguments-52)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) External processor configuration..

### [](#optional-arguments-52)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-52)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-47)Nested Schema for `configuration`

- `uri` - (Required) The URI of the external processing service.
- `allow_mode_override` - Whether to allow the external processor to override the processing mode.
- `failure_mode_allow` - Whether to allow requests when the external processor fails.
- `max_message_timeout` - Maximum message processing timeout in milliseconds.
- `message_timeout` - Message processing timeout in milliseconds.
- `request_body_mode` - Processing mode for the request body.
- `request_header_mode` - Processing mode for request headers (for example, `SEND`, `SKIP`).
- `request_trailer_mode` - Processing mode for request trailers.
- `response_body_mode` - Processing mode for the response body.
- `response_header_mode` - Processing mode for response headers (for example, `SEND`, `SKIP`).
- `response_trailer_mode` - Processing mode for response trailers.

### [](#pointcut-data-52)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-52)Import

An existing `anypoint_api_policy_native_ext_proc` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-52)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_native_ext_proc.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_native_ext_proc" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-52)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_native_ext_proc.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_oauth2_token_introspection)`anypoint_api_policy_oauth2_token_introspection`

Use the `anypoint_api_policy_oauth2_token_introspection` resource to validate OAuth 2.0 tokens by introspecting them against an authorization server on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-53)Example Usage

```hcl
resource "anypoint_api_policy_oauth2_token_introspection" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    introspection_url         = "https://auth.example.com/oauth2/introspect"
    authorization_value       = "Bearer your-token-here"
    validated_token_ttl       = 600
    skip_client_id_validation = true
    expose_headers            = false
  }

  order = 1
}
```

### [](#required-arguments-53)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Token introspection configuration..

### [](#optional-arguments-53)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-53)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-48)Nested Schema for `configuration`

- `introspection_url` - (Required) URL of the OAuth 2.0 token introspection endpoint.
- `authorization_value` - (Required) Authorization header value for the introspection request.
- `authentication_timeout` - Authentication request timeout in milliseconds.
- `consumer_by` - How to identify the API consumer (for example, `client_id`).
- `expose_headers` - Whether to expose rate-limit headers in the response.
- `max_cache_entries` - Maximum number of entries in the token cache.
- `scope_validation_criteria` - How scopes are validated (`AND` or `OR`).
- `skip_client_id_validation` - Whether to skip client ID validation.
- `validated_token_ttl` - TTL in seconds for validated token cache entries.

### [](#pointcut-data-53)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-53)Import

An existing `anypoint_api_policy_oauth2_token_introspection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-53)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_oauth2_token_introspection.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_oauth2_token_introspection" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-53)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_oauth2_token_introspection.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_openai_transcoding_policy)`anypoint_api_policy_openai_transcoding_policy`

Use the `anypoint_api_policy_openai_transcoding_policy` resource to configure OpenAI as the LLM provider for an Anypoint API instance, handling request and response transcoding.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-54)Example Usage

```hcl
resource "anypoint_api_policy_openai_transcoding_policy" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    api_key = "sk-xxxxxxxxxxxx"
    timeout = 30000
  }

  upstream_ids = [anypoint_api_upstream.example.id]
}
```

### [](#required-arguments-54)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) OpenAI connection configuration..
- `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to.
- `pointcut_data` - Pointcut definition as a JSON string..

### [](#optional-arguments-54)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `asset_version` - The policy asset version. Defaults to `1.0.0`.

### [](#read-only-attributes-54)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-49)Nested Schema for `configuration`

- `api_key` - (Required) API key for the OpenAI LLM provider.
- `model_mapper` - (Dynamic) Array of model name mappings.
- `timeout` - Request timeout in milliseconds.

### [](#pointcut-data-54)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-54)Import

An existing `anypoint_api_policy_openai_transcoding_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-54)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_openai_transcoding_policy.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_openai_transcoding_policy" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-54)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_openai_transcoding_policy.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_semantic_prompt_guard_policy_openai)`anypoint_api_policy_semantic_prompt_guard_policy_openai`

Use the `anypoint_api_policy_semantic_prompt_guard_policy_openai` resource to block prompts that semantically match denied topics using OpenAI embeddings on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-55)Example Usage

```hcl
resource "anypoint_api_policy_semantic_prompt_guard_policy_openai" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    openai_url             = "https://api.openai.com/v1"
    openai_api_key         = "sk-xxxxxxxxxxxx"
    openai_embedding_model = "text-embedding-ada-002"
    timeout                = 5000
    deny_topics = [
      {
        topic       = "harmful content"
        description = "Block harmful content generation"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-55)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Prompt guard configuration..

### [](#optional-arguments-55)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260130084752`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-55)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-50)Nested Schema for `configuration`

- `deny_topics` - (Required, Dynamic) Array of topics to deny in prompt guard evaluation.
- `openai_api_key` - (Required) API key for the OpenAI service.
- `openai_url` - (Required) URL of the OpenAI API.
- `openai_embedding_model` - The OpenAI embedding model to use.
- `threshold` - (Dynamic) Threshold configuration object for similarity scoring.
- `timeout` - Timeout value in milliseconds.

### [](#pointcut-data-55)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-55)Import

An existing `anypoint_api_policy_semantic_prompt_guard_policy_openai` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-55)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_semantic_prompt_guard_policy_openai.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_semantic_prompt_guard_policy_openai" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-55)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_semantic_prompt_guard_policy_openai.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_semantic_routing_policy_huggingface)`anypoint_api_policy_semantic_routing_policy_huggingface`

Use the `anypoint_api_policy_semantic_routing_policy_huggingface` resource to route requests to different upstreams based on semantic similarity using HuggingFace embeddings on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-56)Example Usage

```hcl
resource "anypoint_api_policy_semantic_routing_policy_huggingface" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    huggingface_url     = "https://api-inference.huggingface.co/models/sentence-transformers/all-MiniLM-L6-v2"
    huggingface_api_key = "hf_xxxxxxxxxxxx"
    timeout             = 5000
    routes = [
      {
        description = "Route for customer queries"
        upstream_id = "upstream-1"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-56)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Semantic routing configuration..

### [](#optional-arguments-56)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260130095514`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-56)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-51)Nested Schema for `configuration`

- `huggingface_api_key` - (Required) API key for the HuggingFace service.
- `huggingface_url` - (Required) URL of the HuggingFace inference API.
- `routes` - (Required, Dynamic) Array of routing rules.
- `fallback_route` - (Dynamic) Fallback route configuration when no semantic match is found.
- `threshold` - (Dynamic) Threshold configuration object for similarity scoring.
- `timeout` - Timeout value in milliseconds.

### [](#pointcut-data-56)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-56)Import

An existing `anypoint_api_policy_semantic_routing_policy_huggingface` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-56)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_semantic_routing_policy_huggingface.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_semantic_routing_policy_huggingface" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-56)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_semantic_routing_policy_huggingface.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_rate_limiting)`anypoint_api_policy_rate_limiting`

Use the `anypoint_api_policy_rate_limiting` resource to limit the number of requests an API instance accepts within a configurable time window.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-57)Example Usage

```hcl
resource "anypoint_api_policy_rate_limiting" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    rate_limits = [
      {
        maximum_requests            = 100
        time_period_in_milliseconds = 60000
      }
    ]
    expose_headers = false
    clusterizable  = true
  }

  order = 1
}
```

### [](#required-arguments-57)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Rate limit configuration..

### [](#optional-arguments-57)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.4.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-57)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-52)Nested Schema for `configuration`

- `rate_limits` - (Required, Dynamic) Array of rate limit rules with `maximum_requests` and `time_period_in_milliseconds`.
- `key_selector` - Expression to extract the rate limit key from the request.
- `expose_headers` - Whether to expose rate-limit headers in the response.
- `clusterizable` - Whether rate limit counters are shared across a cluster.

### [](#pointcut-data-57)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-57)Import

An existing `anypoint_api_policy_rate_limiting` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-57)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_rate_limiting.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_rate_limiting" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-57)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_rate_limiting.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_rate_limiting_sla_based)`anypoint_api_policy_rate_limiting_sla_based`

Use the `anypoint_api_policy_rate_limiting_sla_based` resource to enforce rate limits based on client SLA tiers on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-58)Example Usage

```hcl
resource "anypoint_api_policy_rate_limiting_sla_based" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    client_id_expression     = "#[attributes.headers['client_id']]"
    client_secret_expression = "#[attributes.headers['client_secret']]"
    expose_headers           = false
    clusterizable            = true
  }

  order = 1
}
```

### [](#required-arguments-58)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) SLA-based rate limit configuration..

### [](#optional-arguments-58)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.3.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-58)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-53)Nested Schema for `configuration`

- `client_id_expression` - DataWeave expression to extract the client ID from the request.
- `client_secret_expression` - DataWeave expression to extract the client secret from the request.
- `expose_headers` - Whether to expose rate-limit headers in the response.
- `clusterizable` - Whether rate limit counters are shared across a cluster.

### [](#pointcut-data-58)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-58)Import

An existing `anypoint_api_policy_rate_limiting_sla_based` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-58)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_rate_limiting_sla_based.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_rate_limiting_sla_based" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-58)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_rate_limiting_sla_based.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_response_timeout)`anypoint_api_policy_response_timeout`

Use the `anypoint_api_policy_response_timeout` resource to enforce a maximum response time on upstream requests from an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-59)Example Usage

```hcl
resource "anypoint_api_policy_response_timeout" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    timeout = 30000
  }

  order = 1
}
```

### [](#required-arguments-59)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Timeout configuration..

### [](#optional-arguments-59)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-59)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-54)Nested Schema for `configuration`

- `timeout` - (Required) Response timeout in milliseconds.

### [](#pointcut-data-59)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-59)Import

An existing `anypoint_api_policy_response_timeout` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-59)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_response_timeout.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_response_timeout" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-59)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_response_timeout.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_script_evaluation_transformation)`anypoint_api_policy_script_evaluation_transformation`

Use the `anypoint_api_policy_script_evaluation_transformation` resource to evaluate and transform request or response payloads using a DataWeave script on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-60)Example Usage

```hcl
resource "anypoint_api_policy_script_evaluation_transformation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    script           = "%%dw 2.0\noutput application/json\n---\npayload"
    requires_payload = false
    request_flow     = "request"
  }

  order = 1
}
```

### [](#required-arguments-60)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Script configuration..

### [](#optional-arguments-60)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.0-20260127.133315`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-60)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-55)Nested Schema for `configuration`

- `script` - (Required) The DataWeave transformation script.
- `request_flow` - Which flow to apply the transformation to (`request` or `response`).
- `requires_payload` - Whether the script requires access to the payload.

### [](#pointcut-data-60)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-60)Import

An existing `anypoint_api_policy_script_evaluation_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-60)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_script_evaluation_transformation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_script_evaluation_transformation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-60)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_script_evaluation_transformation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_sse_logging)`anypoint_api_policy_sse_logging`

Use the `anypoint_api_policy_sse_logging` resource to log Server-Sent Events (SSE) traffic on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-61)Example Usage

```hcl
resource "anypoint_api_policy_sse_logging" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    logs = [
      {
        message = "#[payload]"
        level   = "INFO"
      }
    ]
  }

  order = 1
}
```

### [](#required-arguments-61)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) SSE logging configuration..

### [](#optional-arguments-61)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-61)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-56)Nested Schema for `configuration`

- `logs` - (Required, Dynamic) Array of log entry configurations.

### [](#pointcut-data-61)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-61)Import

An existing `anypoint_api_policy_sse_logging` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-61)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_sse_logging.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_sse_logging" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-61)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_sse_logging.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_spec_validation)`anypoint_api_policy_spec_validation`

Use the `anypoint_api_policy_spec_validation` resource to validate incoming requests against the API specification on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-62)Example Usage

```hcl
resource "anypoint_api_policy_spec_validation" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    block_operation          = true
    strict_params_validation = true
  }

  order = 1
}
```

### [](#required-arguments-62)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Spec validation configuration..

### [](#optional-arguments-62)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-62)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-57)Nested Schema for `configuration`

- `block_operation` - Whether to block operations not defined in the API spec.
- `strict_params_validation` - Whether to strictly validate query and header parameters.

### [](#pointcut-data-62)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-62)Import

An existing `anypoint_api_policy_spec_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-62)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_spec_validation.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_spec_validation" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-62)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_spec_validation.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_spike_control)`anypoint_api_policy_spike_control`

Use the `anypoint_api_policy_spike_control` resource to queue and throttle traffic spikes on an Anypoint API instance, delaying excess requests instead of rejecting them immediately.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-63)Example Usage

```hcl
resource "anypoint_api_policy_spike_control" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    maximum_requests            = 100
    time_period_in_milliseconds = 1000
    delay_time_in_millis        = 500
    delay_attempts              = 3
    queuing_limit               = 5
    expose_headers              = false
  }

  order = 1
}
```

### [](#required-arguments-63)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Spike control configuration..

### [](#optional-arguments-63)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.2.2`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-63)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-58)Nested Schema for `configuration`

- `maximum_requests` - (Required) Maximum number of requests allowed in the time period.
- `time_period_in_milliseconds` - (Required) The time period in milliseconds for the spike control window.
- `delay_time_in_millis` - (Required) The delay in milliseconds before retrying queued requests.
- `delay_attempts` - (Required) The number of retry attempts before rejecting a queued request.
- `queuing_limit` - Maximum number of requests that can be queued.
- `expose_headers` - Whether to expose rate-limit headers in the response.

### [](#pointcut-data-63)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-63)Import

An existing `anypoint_api_policy_spike_control` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-63)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_spike_control.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_spike_control" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-63)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_spike_control.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_stream_idle_timeout)`anypoint_api_policy_stream_idle_timeout`

Use the `anypoint_api_policy_stream_idle_timeout` resource to close idle SSE or streaming connections after a configurable period on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-64)Example Usage

```hcl
resource "anypoint_api_policy_stream_idle_timeout" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    timeout = 30000
  }

  order = 1
}
```

### [](#required-arguments-64)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Timeout configuration..

### [](#optional-arguments-64)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.0.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-64)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-59)Nested Schema for `configuration`

- `timeout` - (Required) Stream idle timeout in milliseconds.

### [](#pointcut-data-64)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-64)Import

An existing `anypoint_api_policy_stream_idle_timeout` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-64)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_stream_idle_timeout.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_stream_idle_timeout" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-64)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_stream_idle_timeout.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_tracing)`anypoint_api_policy_tracing`

Use the `anypoint_api_policy_tracing` resource to instrument distributed tracing on an Anypoint API instance.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-65)Example Usage

```hcl
resource "anypoint_api_policy_tracing" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    span_name = "api-request"
    sampling  = {
      probability = 0.1
    }
    labels = []
  }

  order = 1
}
```

### [](#required-arguments-65)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) Tracing configuration..

### [](#optional-arguments-65)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.1.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-65)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-60)Nested Schema for `configuration`

- `span_name` - Custom name for the tracing span.
- `sampling` - (Dynamic) Tracing sampling configuration object.
- `labels` - (Dynamic) Array of custom labels to attach to traces.

### [](#pointcut-data-65)Pointcut Data

Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-65)Import

An existing `anypoint_api_policy_tracing` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-65)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_tracing.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_tracing" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-65)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_tracing.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```

## [](#anypoint_api_policy_xml_threat_protection)`anypoint_api_policy_xml_threat_protection`

Use the `anypoint_api_policy_xml_threat_protection` resource to protect an Anypoint API instance against malicious XML payloads by enforcing structural limits.

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p>This policy is only supported on <code>mule4</code> API instances.</p>
</div>
</td>
</tr>
</tbody></table>

<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p><strong>Connected App:</strong> This resource requires a <strong>standard connected app</strong> (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.</p>
</div>
</td>
</tr>
</tbody></table>

### [](#example-usage-66)Example Usage

```hcl
resource "anypoint_api_policy_xml_threat_protection" "example" {
  organization_id = var.organization_id
  environment_id  = var.environment_id
  api_instance_id = anypoint_api_instance.example.id

  configuration = {
    max_node_depth                  = 10
    max_attribute_count_per_element = 10
    max_child_count                 = 50
    max_text_length                 = 256
    max_attribute_length            = 128
    max_comment_length              = 128
  }

  order = 1
}
```

### [](#required-arguments-66)Required Arguments

- `environment_id` - ID of the environment where the API instance lives.
- `api_instance_id` - ID of the API instance this policy is applied to.
- `configuration` - (Block) XML structural limits..

### [](#optional-arguments-66)Optional Arguments

- `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app.
- `label` - A human-readable label for this policy instance.
- `order` - Execution order relative to other policies. Lower numbers run first.
- `asset_version` - The policy asset version. Defaults to `1.2.1`.
- `disabled` - Whether the policy is disabled. Defaults to `false`.
- `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams.
- `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this..

### [](#read-only-attributes-66)Read-Only Attributes

- `id` - The policy ID.
- `policy_template_id` - Policy template ID assigned by the platform.

### [](#nested-schema-for-configuration-61)Nested Schema for `configuration`

- `max_node_depth` - Maximum XML node nesting depth.
- `max_attribute_count_per_element` - Maximum number of attributes per XML element.
- `max_child_count` - Maximum number of child elements per XML node.
- `max_text_length` - Maximum length for XML text nodes.
- `max_attribute_length` - Maximum length for XML attribute values.
- `max_comment_length` - Maximum length for XML comments.

### [](#pointcut-data-66)Pointcut Data

Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI.

Each array element defines one condition:

- `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods.
- `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths.

Multiple conditions are evaluated as a logical OR.

```hcl
# Apply policy to GET and POST requests on /api/v1/* only
pointcut_data = jsonencode([
  {
    methodRegex      = "GET|POST"
    uriTemplateRegex = "/api/v1/.*"
  }
])

# Multiple conditions
pointcut_data = jsonencode([
  {
    methodRegex      = "GET"
    uriTemplateRegex = "/api/v1/read/.*"
  },
  {
    methodRegex      = "POST|PUT"
    uriTemplateRegex = "/api/v1/write/.*"
  }
])
```

### [](#import-66)Import

An existing `anypoint_api_policy_xml_threat_protection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`.

The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response.

#### [](#using-an-import-block-terraform-1-5-recommended-66)Using an import block (Terraform ≥ 1.5 — recommended)

```hcl
import {
  to = anypoint_api_policy_xml_threat_protection.imported
  id = "<organization_id>/<environment_id>/<api_instance_id>/<policy_id>"
}

resource "anypoint_api_policy_xml_threat_protection" "imported" {
  organization_id = "<organization_id>"
  environment_id  = "<environment_id>"
  api_instance_id = "<api_instance_id>"
}
```

After adding the import block, run:

```shell
# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply
```

#### [](#using-the-cli-deprecated-terraform-1-5-66)Using the CLI (deprecated, Terraform < 1.5)

```shell
terraform import anypoint_api_policy_xml_threat_protection.imported <organization_id>/<environment_id>/<api_instance_id>/<policy_id>
```