# mulesoft MuleSoft Terraform Provider - Full Documentation --- product: MuleSoft Terraform Provider --- # Access Management Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Access Management resources to manage organizations, environments, connected applications, scopes, and teams in Anypoint Platform. Access Management resources require administrative privileges and use the `anypoint.admin` provider configuration for authentication. ## `anypoint_connected_app_scopes` Use the `anypoint_connected_app_scopes` resource to manage scopes for a connected application in Anypoint Platform. > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_connected_app_scopes" "example" { provider = anypoint.admin connected_app_id = "my-connected-app-id" scopes = [ { scope = "admin:cloudhub" context_params = { org = "your-org-id" } }, { scope = "read:applications" context_params = { org = "your-org-id" envId = "your-env-id" } } ] } ``` ### Required Arguments - `connected_app_id` - The ID of the connected application to manage scopes for. - `scopes` - (Block Set) The set of scopes to assign to the connected application. See [Nested Schema for `scopes`](#nested-schema-for-scopes). ### Read-Only Attributes - `id` - The unique identifier for the connected app scopes (same as `connected_app_id`). ### Nested Schema for `scopes` - `scope` - (Required) The scope name (for example, `admin:cloudhub`, `read:applications`). - `context_params` - (Map of String) Context parameters for the scope (for example, organization ID). ### Import An existing connected app’s scopes can be imported using the connected app ID (UUID). #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_connected_app_scopes.imported id = "" } resource "anypoint_connected_app_scopes" "imported" { provider = anypoint.admin connected_app_id = "" scopes = [] } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_connected_app_scopes.imported ``` ## `anypoint_environment` Use the `anypoint_environment` resource to manage Anypoint Platform environments. > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_environment" "example" { provider = anypoint.admin name = "my-sandbox-env" type = "sandbox" is_production = false organization_id = "your-org-id" } ``` ### Required Arguments - `name` - The name of the environment. ### Optional Arguments - `organization_id` - Organization ID where the environment will be created. If not provided, the organization ID is inferred from the connected app credentials. - `type` - The type of the environment (`design`, `sandbox`, `production`). Defaults to `sandbox`. - `is_production` - Whether this is a production environment. Defaults to `false`. - `arc_namespace` - The ARC namespace for the environment. - `client_id` - The client ID associated with the environment. ### Read-Only Attributes - `id` - The unique identifier for the environment. ### Import An existing environment can be imported using its environment ID (UUID). #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_environment.imported id = "" } resource "anypoint_environment" "imported" { provider = anypoint.admin organization_id = "" name = "" type = "sandbox" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_environment.imported ``` ## `anypoint_organization` Use the `anypoint_organization` resource to create and manage Anypoint Platform organizations (business groups). > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Entitlement State Behaviour The provider honours user-defined state for entitlements, not platform defaults. - Fields you declare are managed by Terraform — any platform-side change will be reverted on the next `apply`. - Fields you omit are unmanaged. Platform-side updates to those fields aren’t reflected in the plan and won’t be reverted. - Master-org-only entitlements (`hybrid`, `omni_gateway`, `service_mesh`, `worker_logging_override`, `runtime_fabric`, `design_center`) are inherited on sub-orgs and can’t be set via this resource on a business group. They are stripped from API requests to prevent HTTP 403 errors. Only declare entitlement fields you want Terraform to own. Leave everything else out of your config. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_organization" "example" { provider = anypoint.admin name = "my-sub-org" parent_organization_id = "parent-org-id" owner_id = "owner-user-id" entitlements = { create_sub_orgs = false create_environments = true global_deployment = false vcores_production = { assigned = 0 } vcores_sandbox = { assigned = 0 } vcores_design = { assigned = 0 } vpcs = { assigned = 0 } network_connections = { assigned = 0 } managed_gateway_small = { assigned = 0 } managed_gateway_large = { assigned = 0 } } } ``` ### Required Arguments - `name` - The name of the organization. - `owner_id` - The ID of the organization owner. Changing this forces a new resource. - `parent_organization_id` - The ID of the parent organization. Changing this forces a new resource. ### Optional Arguments - `entitlements` - (Block) Entitlements for the organization. Only declared fields are managed by Terraform. See [Nested Schema for `entitlements`](#nested-schema-for-entitlements). ### Read-Only Attributes - `id` - The unique identifier for the organization. - `client_id` - The client ID associated with the organization. - `created_at` - The creation timestamp of the organization. - `deleted_at` - The deletion timestamp of the organization. - `domain` - The domain of the organization. - `environments` - (Block List) The environments within the organization.. - `gdot_id` - The GDOT ID of the organization. - `idprovider_id` - The ID provider ID for the organization. - `is_automatic_admin_promotion_exempt` - Whether the organization is exempt from automatic admin promotion. - `is_federated` - Whether the organization is federated. - `is_master` - Whether the organization is a master organization. - `is_root` - Whether the organization is a root organization. - `mfa_required` - Whether MFA is required for the organization. - `org_type` - The type of the organization. - `parent_organization_ids` - List of parent organization IDs (ancestor chain). - `session_timeout` - The session timeout for the organization. - `sub_organization_ids` - List of sub-organization IDs. - `subscription` - (Block) The subscription details for the organization.. - `tenant_organization_ids` - List of tenant organization IDs. - `updated_at` - The last update timestamp of the organization. ### Nested Schema for `entitlements` Only the fields you declare are managed by Terraform. Fields you omit aren’t tracked and won’t be reverted if the platform changes them. - `create_environments` - Whether environments can be created. Defaults to `false`. - `create_sub_orgs` - Whether sub-organizations can be created. Defaults to `false`. - `global_deployment` - Whether global deployment is enabled. Defaults to `false`. - `runtime_fabric` - Whether Runtime Fabric is enabled. **Master-org-only** — ignored on business groups. - `design_center` - (Block) Design Center entitlement. **Master-org-only** — ignored on business groups. - `api` - Whether API Designer is enabled. - `mozart` - Whether Flow Designer (Mozart) is enabled. - `omni_gateway` - (Block) Omni Gateway entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `hybrid` - (Block) Hybrid entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `service_mesh` - (Block) Service Mesh entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `worker_logging_override` - (Block) Worker logging override entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `vcores_production` - (Block) Production vCore entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `vcores_sandbox` - (Block) Sandbox vCore entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `vcores_design` - (Block) Design vCore entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `vpcs` - (Block) VPC entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `network_connections` - (Block) Network connections entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `gateways` - (Block) Gateways entitlement. - `assigned` - Number of assigned units. - `load_balancer` - (Block) Load balancer entitlement. - `assigned` - Number of assigned units. - `managed_gateway_small` - (Block) Managed Gateway (small) entitlement. - `assigned` - Number of assigned units. - `managed_gateway_large` - (Block) Managed Gateway (large) entitlement. - `assigned` - Number of assigned units. - `mq_messages` - (Block) MQ messages entitlement. - `base` - Base number of MQ units. Defaults to `0`. - `add_on` - Add-on number of MQ units. Defaults to `0`. - `mq_requests` - (Block) MQ requests entitlement. - `base` - Base number of MQ units. Defaults to `0`. - `add_on` - Add-on number of MQ units. Defaults to `0`. > [!NOTE] `static_ips` and `vpns` entitlements are managed server-side by Anypoint and aren’t > settable via Terraform. Configure them through the Anypoint UI or API. ### Nested Schema for `environments` > [!NOTE] When a new organization is created, Anypoint Platform automatically provisions two > environments: Sandbox and Production. These appear in the `environments` read-only attribute after > the first apply and don’t need to be declared in your configuration. - `id` - The environment ID. _(Read-Only)_ - `name` - The environment name. _(Read-Only)_ - `organization_id` - The organization ID. _(Read-Only)_ - `client_id` - The environment client ID. _(Read-Only)_ - `type` - The environment type. _(Read-Only)_ - `is_production` - Whether the environment is a production environment. _(Read-Only)_ - `arc_namespace` - The ARC namespace of the environment. _(Optional)_ ### Nested Schema for `subscription` - `category` - The subscription category. _(Read-Only)_ - `type` - The subscription type. _(Read-Only)_ - `expiration` - The subscription expiration date. _(Read-Only)_ - `justification` - The subscription justification. _(Optional)_ ### Import An existing organization can be imported using its organization ID (UUID). Your HCL must declare `name`, `parent_organization_id`, and `owner_id` before importing — those are required attributes. The first `terraform plan` after import refreshes all read-only and optional attributes (including entitlements) from the Anypoint API. `parent_organization_id` is derived from the server-returned ancestor chain (`parent_organization_ids`) on the first refresh. If the derivation doesn’t match what you wrote in HCL, update the HCL to match — changing `parent_organization_id` triggers a destroy+recreate. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_organization.imported id = "" } resource "anypoint_organization" "imported" { provider = anypoint.admin name = "" parent_organization_id = "" owner_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_organization.imported ``` ## `anypoint_team` Use the `anypoint_team` resource to manage teams in Anypoint Platform. > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_team" "example" { provider = anypoint.admin team_name = "Development Team" parent_team_id = "root-team-id" team_type = "internal" } resource "anypoint_team" "sub_team" { provider = anypoint.admin team_name = "Frontend Team" parent_team_id = anypoint_team.example.id team_type = "internal" } ``` ### Required Arguments - `team_name` - The name of the team. - `parent_team_id` - The ID of the parent team. - `team_type` - The type of the team. ### Optional Arguments - `organization_id` - Organization ID where the team will be created. If not provided, the organization ID is inferred from the connected app credentials. ### Read-Only Attributes - `id` - The unique identifier for the team. - `created_at` - The timestamp when the team was created. - `updated_at` - The timestamp when the team was last updated. ### Import An existing team can be imported using its team ID (UUID). #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_team.imported id = "" } resource "anypoint_team" "imported" { provider = anypoint.admin organization_id = "" team_name = "" team_type = "internal" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_team.imported ``` # API Manager Resources Use API Manager resources to manage APIs and API configuration in API Manager. ## [](#anypoint_api_instance)`anypoint_api_instance` Use the `anypoint_api_instance` resource to create and manage API instances in Anypoint API Manager. An API instance binds an Exchange asset specification to an Omni Gateway target, defining how traffic is routed to upstream backends.

Supported gateway type: This provider currently supports MuleSoft Managed Omni Gateway (CloudHub 2.0) only. Self-managed Omni Gateway will be supported in a future release.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage)Example Usage

The top-level upstream_uri field is deprecated and will be removed in the next major version. Use the routing block in new configurations instead, which supports TLS, labels, multiple upstreams, and weighted routing. See Migrating from upstream_uri.
#### [](#minimal-configuration)Minimal configuration ```hcl resource "anypoint_api_instance" "minimal" { environment_id = var.environment_id gateway_id = var.gateway_id instance_label = "minimal-demo" spec = { asset_id = "my-api" group_id = var.organization_id version = "1.0.0" } endpoint = { base_path = "minimal" } routing = [ { upstreams = [ { uri = "http://backend.internal:8080" } ] } ] } ``` #### [](#weighted-multi-upstream-routing-canary-blue-green)Weighted multi-upstream routing (canary / blue-green) ```hcl resource "anypoint_api_instance" "weighted_routing" { environment_id = var.environment_id gateway_id = var.gateway_id instance_label = "weighted-routing-demo" spec = { asset_id = "my-api" group_id = var.organization_id version = "1.0.0" } endpoint = { base_path = "weightedRouting" } routing = [ { label = "canary" upstreams = [ { weight = 90 uri = "http://backend-stable.internal:8080" label = "stable" }, { weight = 10 uri = "http://backend-canary.internal:8080" label = "canary" } ] } ] } ``` ### [](#migrating-from-upstream-uri)Migrating from `upstream_uri` If you are using the deprecated `upstream_uri` field, replace it with an equivalent single-upstream `routing` block: ```hcl # Before (deprecated) resource "anypoint_api_instance" "example" { # ... upstream_uri = "http://backend.internal:8080" } # After resource "anypoint_api_instance" "example" { # ... routing = [ { upstreams = [ { uri = "http://backend.internal:8080" } ] } ] } ``` The two forms are semantically identical — `upstream_uri` was always shorthand for `routing = [{ upstreams = [{ weight = 100, uri = }] }]`. ### [](#routing-and-upstream-behavior)Routing and Upstream Behavior Always set `label` on every upstream. Labels are stable across URI changes and reordering — without a label, changing a URI is treated as "delete + add" instead of "edit," which can disrupt stateful backends (sticky sessions, cookies). When adding a route with a brand-new upstream, the provider runs two PATCHes: one to pre-register the upstream and get its ID, then the main PATCH with the updated routing. All other changes (weights, rules, reordering, removing routes) are a single PATCH.

Removing a route doesn’t remove its upstreams from the backend catalog — they remain inert. Cleanup requires a manual API call. If two routes reference the same backend (same label or uri), write the upstream in both — the provider deduplicates them automatically.
### [](#required-arguments)Required Arguments - `environment_id` - (Required) The environment ID where the API instance is created. - `spec` - (Required) The Exchange asset specification backing this API instance. See [Nested Schema for `spec`](#nested-schema-for-spec). ### [](#optional-arguments)Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `technology` - Gateway technology. Only `omniGateway` is currently supported. Defaults to `omniGateway`. - `provider_id` - The identity provider ID for the API. - `instance_label` - A human-readable label for this API instance. - `approval_method` - Client approval method. Valid values: `manual`. Defaults to `null` (no approval required). Note: `automatic` approval is no longer supported. - `consumer_endpoint` - Consumer-facing endpoint URI (the public URL clients use to reach the API). - `upstream_uri` - **(Deprecated)** Shorthand for a single-upstream routing configuration. Will be removed in the next major version. Use `routing` instead. - `gateway_id` - The Omni Gateway UUID. When provided, the deployment block is auto-populated by fetching gateway details (`target_id`, `target_name`, `gateway_version`) from the Gateway Manager API. Mutually exclusive with a full `deployment` block. - `endpoint` - Endpoint and proxy configuration for the API instance. See [Nested Schema for `endpoint`](#nested-schema-for-endpoint). - `deployment` - Deployment target configuration. Auto-populated when `gateway_id` is set. See [Nested Schema for `deployment`](#nested-schema-for-deployment). - `routing` - (Block List) Routing rules with weighted upstream backends. Mutually exclusive with `upstream_uri`. See [Nested Schema for `routing`](#nested-schema-for-routing). ### [](#nested-schema-for-spec)Nested Schema for `spec` - `asset_id` - (Required) The Exchange asset ID. - `group_id` - (Required) The Exchange group (organization) ID. - `version` - (Required) The asset version. ### [](#nested-schema-for-endpoint)Nested Schema for `endpoint` - `deployment_type` - Deployment type. Valid values: `HY` (hybrid), `CH` (CloudHub), `CH2`, `RF` (Runtime Fabric). Defaults to `HY`. - `type` - Endpoint protocol type. Valid values: `http`, `rest`, `raml`. Defaults to `http`. - `base_path` - API base path for the Omni Gateway proxy listener (for example, `my-api`). The provider constructs the proxy URI as `http://0.0.0.0:8081/`. - `response_timeout` - Response timeout in milliseconds. ### [](#nested-schema-for-deployment)Nested Schema for `deployment` - `environment_id` - The environment ID for deployment (usually matches the top-level `environment_id`). - `type` - Deployment type. Valid values: `HY`, `CH`, `RF`. Defaults to `HY`. - `expected_status` - Expected deployment status. Valid values: `deployed`, `undeployed`. Defaults to `deployed`. - `overwrite` - Whether to overwrite an existing deployment. - `target_id` - The target gateway ID to deploy to. - `target_name` - The target gateway name. - `gateway_version` - The Omni Gateway runtime version. ### [](#nested-schema-for-routing)Nested Schema for `routing` - `upstreams` - (Required, Block List) Weighted upstream backends for this route. See [Nested Schema for `routing.upstreams`](#nested-schema-for-routing-upstreams). - `label` - A label for this route. - `rules` - (Block) Match conditions for this route. See [Nested Schema for `routing.rules`](#nested-schema-for-routing-rules). ### [](#nested-schema-for-routing-rules)Nested Schema for `routing.rules` - `methods` - Pipe-separated HTTP methods (for example, `GET`, `POST|PUT`). - `path` - URL path pattern to match (for example, `/api/*`). - `host` - Host header value to match. - `headers` - (Map) Header key-value pairs to match. ### [](#nested-schema-for-routing-upstreams)Nested Schema for `routing.upstreams` - `uri` - (Required) The upstream backend URI. - `weight` - Traffic weight percentage (0–100). Weights across upstreams should sum to 100. Defaults to `100`. - `label` - A label for this upstream. - `tls_context_id` - TLS context for upstream connections. Format: `secretGroupId/tlsContextId`. ### [](#read-only-attributes)Read-Only Attributes - `id` - The numeric identifier of the API instance (stored as string for Terraform compatibility). - `status` - The current status of the API instance. - `asset_id` - The Exchange asset ID (computed from API response). - `asset_version` - The Exchange asset version (computed from API response). - `product_version` - The product version (computed from API response). ### [](#import)Import An existing API instance can be imported using a composite ID. Use the 2-part form for root-org instances and the 3-part form when the instance belongs to a Business Group (sub-org). The `api_instance_id` is the numeric ID visible in the Anypoint API Manager URL. #### [](#using-an-import-block-terraform-1-5-recommended)Using an import block (Terraform ≥ 1.5 — recommended) Root org (2-part ID): ```hcl import { to = anypoint_api_instance.imported id = "/" } resource "anypoint_api_instance" "imported" { environment_id = "" spec = { asset_id = "" group_id = "" version = "1.0.0" } } ``` Sub-org (3-part ID): ```hcl import { to = anypoint_api_instance.imported id = "//" } resource "anypoint_api_instance" "imported" { organization_id = "" environment_id = "" spec = { asset_id = "" group_id = "" version = "1.0.0" } } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5)Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_api_instance.imported / # Sub-org: terraform import anypoint_api_instance.imported // ``` ## [](#anypoint_api_instance_sla_tier)`anypoint_api_instance_sla_tier` Use the `anypoint_api_instance_sla_tier` resource to define rate-limited access tiers for an API instance in Anypoint API Manager.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-2)Example Usage ```hcl resource "anypoint_api_instance_sla_tier" "gold" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = var.api_instance_id name = "Gold" description = "Gold tier with high volume limits for premium customers" auto_approve = true status = "ACTIVE" limits = [ { time_period_in_milliseconds = 60000 maximum_requests = 1000 visible = true }, { time_period_in_milliseconds = 3600000 maximum_requests = 50000 visible = true } ] } ``` ### [](#required-arguments-2)Required Arguments - `environment_id` - Environment ID where the API instance lives. - `api_instance_id` - Numeric ID of the API instance. - `name` - Name of the SLA tier. - `limits` - (Block List) Rate limits for this SLA tier. See [Nested Schema for `limits`](#nested-schema-for-limits). ### [](#optional-arguments-2)Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `description` - Description of the SLA tier. - `auto_approve` - Whether requests for this SLA tier are auto-approved. Defaults to `false`. - `status` - Status of the SLA tier. Valid values: `ACTIVE`, `INACTIVE`. ### [](#nested-schema-for-limits)Nested Schema for `limits` - `time_period_in_milliseconds` - (Required) Time period for the rate limit in milliseconds. - `maximum_requests` - (Required) Maximum number of requests allowed in the time period. - `visible` - Whether this limit is visible to API consumers. Defaults to `true`. ### [](#read-only-attributes-2)Read-Only Attributes - `id` - Unique identifier of the SLA tier. ### [](#import-2)Import An existing SLA tier can be imported using its composite ID: `organization_id/environment_id/api_instance_id/tier_name_or_tier_id`. The last segment accepts either the tier name (as shown in the Anypoint UI, for example `Gold`) or the numeric tier ID. Using the name is recommended — it is visible without API calls. #### [](#using-an-import-block-terraform-1-5-recommended-2)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_instance_sla_tier.imported id = "///" } resource "anypoint_api_instance_sla_tier" "imported" { organization_id = "" environment_id = "" api_instance_id = "" name = "" limits = [ { time_period_in_milliseconds = 60000 maximum_requests = 100 } ] } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-2)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_instance_sla_tier.imported /// ``` ## [](#anypoint_api_policy)`anypoint_api_policy` Use the `anypoint_api_policy` resource to apply a policy to an API instance in Anypoint API Manager. Set `policy_type` for known policies — the provider auto-resolves `group_id`, `asset_id`, and the default version. For custom policies not in the built-in registry, omit `policy_type` and provide `group_id`, `asset_id`, and `asset_version` directly.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-3)Example Usage #### [](#using-policy_type-for-a-known-policy)Using `policy_type` for a known policy ```hcl resource "anypoint_api_policy" "rate_limit" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = var.api_instance_id policy_type = "rate-limiting" label = "rate-limit-100rpm" order = 1 configuration_data = jsonencode({ key_selector = "#[attributes.queryParams['identifier']]" rate_limits = [ { maximum_requests = 100 time_period_in_milliseconds = 60000 } ] expose_headers = true clusterizable = true }) } ``` #### [](#using-explicit-group_id-asset_id-asset_version-for-a-custom-policy)Using explicit `group_id`, `asset_id`, `asset_version` for a custom policy ```hcl resource "anypoint_api_policy" "custom" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = var.api_instance_id group_id = "my-org-id" asset_id = "my-custom-policy" asset_version = "1.0.0" label = "custom-policy" order = 2 configuration_data = jsonencode({ custom_field = "value" }) } ``` ### [](#required-arguments-3)Required Arguments - `environment_id` - Environment ID where the API instance lives. - `api_instance_id` - Numeric ID of the API instance this policy is applied to. - `configuration_data` - Policy configuration as a JSON string. Use `jsonencode()` to set this. Fields vary by policy type; the provider validates known policies at plan time. ### [](#optional-arguments-3)Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `policy_type` - Known policy type name (for example, `rate-limiting`, `cors`, `jwt-validation`). When set, `group_id`, `asset_id`, and `asset_version` are auto-resolved from the built-in registry. You can still override `asset_version` to pin a specific version. - `group_id` - Exchange group ID for the policy asset. Auto-resolved when `policy_type` is set. - `asset_id` - Exchange asset ID that identifies the policy type. Auto-resolved when `policy_type` is set. - `asset_version` - Version of the policy asset from Exchange. Auto-resolved to default when `policy_type` is set, but can be overridden. - `label` - A human-readable label for this policy instance. - `order` - Execution order of the policy. Lower numbers execute first. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `pointcut_data` - Pointcut definition as a JSON string. Restricts the policy to specific resources (methods and/or URIs). When `null`, the policy applies to all resources. Use `jsonencode()` to set this. See [Pointcut Data](#pointcut-data). ### [](#read-only-attributes-3)Read-Only Attributes - `id` - Unique identifier of the applied policy. - `policy_template_id` - Policy template ID assigned by the server. ### [](#pointcut-data)Pointcut Data The optional `pointcut_data` attribute restricts the policy to specific HTTP methods and/or URI patterns, matching what is configured under "Apply configurations to specific methods & resources" in the Anypoint Platform UI. Each element in the array maps to one condition row in the UI: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions act as a logical OR — the policy applies if any condition matches. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-3)Import An existing API policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in the Anypoint API Manager URL or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-3)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy.imported id = "///" } resource "anypoint_api_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" policy_type = "" configuration_data = jsonencode({}) } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-3)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy.imported /// ``` # API, MCP, and A2A Policy Resources Use policy resources to apply policies declaratively to APIs, MCP servers, gateways, and AI agent resources. ## [](#anypoint_api_policy_a2a_agent_card)`anypoint_api_policy_a2a_agent_card` Use the `anypoint_api_policy_a2a_agent_card` resource to publish and manage an A2A Agent Card on an Anypoint API instance. The agent card describes your AI agent’s capabilities and is served at a configurable path.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage)Example Usage ```hcl resource "anypoint_api_policy_a2a_agent_card" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { content = "{\"name\": \"My Agent\", \"description\": \"An example A2A agent\"}" consumer_url = "https://example.com/agent" card_path = "/.well-known/agent-card.json" file_name = "agent-card.json" file_mime_type = "application/json" } order = 1 } ``` ### [](#required-arguments)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance to attach the agent card to. - `configuration` - (Block) Agent card content and serving configuration.. ### [](#optional-arguments)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies on the same API instance. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `2.0.0-20260327083212`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration)Nested Schema for `configuration` - `content` - (Required) The agent card content as a JSON string. - `card_path` - Path where the agent card is served. - `consumer_url` - Consumer-facing URL for the A2A agent. - `file_mime_type` - MIME type of the agent card file. - `file_name` - Filename for the agent card. - `file_source` - Source of the agent card file. ### [](#pointcut-data)Pointcut Data Use `pointcut_data` to limit the policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import)Import An existing `anypoint_api_policy_a2a_agent_card` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_a2a_agent_card.imported id = "///" } resource "anypoint_api_policy_a2a_agent_card" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_a2a_agent_card.imported /// ``` ## [](#anypoint_api_policy_a2a_pii_detector)`anypoint_api_policy_a2a_pii_detector` Use the `anypoint_api_policy_a2a_pii_detector` resource to detect and act on personally identifiable information (PII) in requests to an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-2)Example Usage ```hcl resource "anypoint_api_policy_a2a_pii_detector" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { entities = ["Email", "US SSN", "Credit Card", "Phone Number"] action = "Reject" } order = 1 } ``` ### [](#required-arguments-2)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - Numeric ID of the API instance to attach this policy to. - `configuration` - (Block) PII detection configuration.. ### [](#optional-arguments-2)Optional Arguments - `organization_id` - Organization ID. Defaults to the organization inferred from the connected app if not set. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies on the same API instance. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-2)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-2)Nested Schema for `configuration` - `entities` - (Required, List of String) PII entity types to detect. Valid values: `Email`, `Credit Card`, `Phone Number`, `US SSN`. - `action` - Action to take when PII is detected (for example, `Reject`). ### [](#pointcut-data-2)Pointcut Data Use `pointcut_data` to limit the policy to specific HTTP methods and URI patterns. This corresponds to the "Apply configurations to specific methods & resources" setting in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-2)Import An existing `anypoint_api_policy_a2a_pii_detector` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-2)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_a2a_pii_detector.imported id = "///" } resource "anypoint_api_policy_a2a_pii_detector" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-2)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_a2a_pii_detector.imported /// ``` ## [](#anypoint_api_policy_a2a_prompt_decorator)`anypoint_api_policy_a2a_prompt_decorator` Use the `anypoint_api_policy_a2a_prompt_decorator` resource to prepend or append text and file content to prompts on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-3)Example Usage ```hcl resource "anypoint_api_policy_a2a_prompt_decorator" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { text_decorators = [ { position = "prefix" text = "You are a helpful assistant." } ] } order = 1 } ``` ### [](#required-arguments-3)Required Arguments - `environment_id` - ID of the environment containing the API instance. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Decorator configuration.. ### [](#optional-arguments-3)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-3)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-3)Nested Schema for `configuration` - `file_decorators` - (Dynamic) File-based prompt decorators to inject. - `text_decorators` - (Dynamic) Text-based prompt decorators to inject. ### [](#pointcut-data-3)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-3)Import An existing `anypoint_api_policy_a2a_prompt_decorator` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-3)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_a2a_prompt_decorator.imported id = "///" } resource "anypoint_api_policy_a2a_prompt_decorator" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-3)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_a2a_prompt_decorator.imported /// ``` ## [](#anypoint_api_policy_a2a_schema_validation)`anypoint_api_policy_a2a_schema_validation` Use the `anypoint_api_policy_a2a_schema_validation` resource to manage an A2A Schema Validation policy on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-4)Example Usage ```hcl resource "anypoint_api_policy_a2a_schema_validation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = {} order = 1 } ``` ### [](#required-arguments-4)Required Arguments - `environment_id` - The environment ID. - `api_instance_id` - The API instance ID. - `configuration` - (Block) The policy configuration. This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`). ### [](#optional-arguments-4)Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `label` - A human-readable label for this policy instance. - `order` - The order of policy execution. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) List of upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string. Restricts the policy to specific resources (methods and/or URIs). When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-4)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - The policy template ID assigned by the server. ### [](#pointcut-data-4)Pointcut Data The optional `pointcut_data` attribute restricts the policy to specific HTTP methods and/or URI patterns, matching what is configured under "Apply configurations to specific methods & resources" in the Anypoint Platform UI. Each element in the array maps to one condition row in the UI: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions act as a logical OR — the policy applies if any condition matches. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-4)Import An existing `anypoint_api_policy_a2a_schema_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-4)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_a2a_schema_validation.imported id = "///" } resource "anypoint_api_policy_a2a_schema_validation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-4)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_a2a_schema_validation.imported /// ``` ## [](#anypoint_api_policy_a2a_token_rate_limit)`anypoint_api_policy_a2a_token_rate_limit` Use the `anypoint_api_policy_a2a_token_rate_limit` resource to enforce token-based rate limits on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-5)Example Usage ```hcl resource "anypoint_api_policy_a2a_token_rate_limit" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { maximum_tokens = 10000 time_period_in_milliseconds = 60000 key_selector = "#[attributes.headers['Authorization']]" } order = 1 } ``` ### [](#required-arguments-5)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Rate limit configuration.. ### [](#optional-arguments-5)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-5)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-4)Nested Schema for `configuration` - `maximum_tokens` - (Required) Maximum number of tokens allowed in the time period. - `time_period_in_milliseconds` - (Required) Duration of the rate limit window in milliseconds. - `key_selector` - DataWeave expression to extract the rate limit key from the request (for example, `#[attributes.headers['Authorization']]`). ### [](#pointcut-data-5)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-5)Import An existing `anypoint_api_policy_a2a_token_rate_limit` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-5)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_a2a_token_rate_limit.imported id = "///" } resource "anypoint_api_policy_a2a_token_rate_limit" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-5)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_a2a_token_rate_limit.imported /// ``` ## [](#anypoint_api_policy_body_transformation)`anypoint_api_policy_body_transformation` Use the `anypoint_api_policy_body_transformation` resource to apply a DataWeave script to transform request or response bodies on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-6)Example Usage ```hcl resource "anypoint_api_policy_body_transformation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { script = "%%dw 2.0\noutput application/json\n---\npayload" request_flow = "request" } order = 1 } ``` ### [](#required-arguments-6)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Transformation configuration.. ### [](#optional-arguments-6)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260127.133848`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-6)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-5)Nested Schema for `configuration` - `script` - (Required) The DataWeave transformation script. - `request_flow` - Which flow to apply the transformation to (`request` or `response`). ### [](#pointcut-data-6)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-6)Import An existing `anypoint_api_policy_body_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-6)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_body_transformation.imported id = "///" } resource "anypoint_api_policy_body_transformation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-6)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_body_transformation.imported /// ``` ## [](#anypoint_api_policy_circuit_breaker)`anypoint_api_policy_circuit_breaker` Use the `anypoint_api_policy_circuit_breaker` resource to protect upstream services from cascading failures by opening the circuit when error or slow-call thresholds are exceeded.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-7)Example Usage ```hcl resource "anypoint_api_policy_circuit_breaker" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { thresholds = { failure_rate_threshold = 50 slow_call_rate_threshold = 80 slow_call_duration_threshold = 5000 sliding_window_size = 100 minimum_number_of_calls = 10 wait_duration_in_open_state = 60000 } } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-7)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Circuit breaker thresholds.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy monitors. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-7)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.1`. ### [](#read-only-attributes-7)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-6)Nested Schema for `configuration` - `thresholds` - (Required, Dynamic) Circuit breaker threshold configuration object. ### [](#pointcut-data-7)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-7)Import An existing `anypoint_api_policy_circuit_breaker` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-7)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_circuit_breaker.imported id = "///" } resource "anypoint_api_policy_circuit_breaker" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-7)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_circuit_breaker.imported /// ``` ## [](#anypoint_api_policy_access_block)`anypoint_api_policy_access_block` Use the `anypoint_api_policy_access_block` resource to block all access to an Anypoint API instance. Combine with `pointcut_data` to restrict specific methods or URI patterns.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-8)Example Usage ```hcl resource "anypoint_api_policy_access_block" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = {} order = 1 } ``` ### [](#required-arguments-8)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance to block access to. - `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`). ### [](#optional-arguments-8)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-8)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#pointcut-data-8)Pointcut Data Use `pointcut_data` to restrict access blocking to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Block GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-8)Import An existing `anypoint_api_policy_access_block` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-8)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_access_block.imported id = "///" } resource "anypoint_api_policy_access_block" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-8)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_access_block.imported /// ``` ## [](#anypoint_api_policy_client_id_enforcement)`anypoint_api_policy_client_id_enforcement` Use the `anypoint_api_policy_client_id_enforcement` resource to require a valid client ID and secret on all requests to an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-9)Example Usage ```hcl resource "anypoint_api_policy_client_id_enforcement" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { credentials_origin_has_http_basic_authentication_header = "customExpression" client_id_expression = "#[attributes.headers['client_id']]" client_secret_expression = "#[attributes.headers['client_secret']]" } order = 1 } ``` ### [](#required-arguments-9)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Client credential extraction configuration.. ### [](#optional-arguments-9)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.3.3`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-9)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-7)Nested Schema for `configuration` - `client_id_expression` - DataWeave expression to extract the client ID from the request. - `client_secret_expression` - DataWeave expression to extract the client secret from the request. - `credentials_origin_has_http_basic_authentication_header` - How client credentials are provided (for example, `customExpression`, `httpBasicAuthenticationHeader`). ### [](#pointcut-data-9)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-9)Import An existing `anypoint_api_policy_client_id_enforcement` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-9)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_client_id_enforcement.imported id = "///" } resource "anypoint_api_policy_client_id_enforcement" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-9)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_client_id_enforcement.imported /// ``` ## [](#anypoint_api_policy_cors)`anypoint_api_policy_cors` Use the `anypoint_api_policy_cors` resource to configure Cross-Origin Resource Sharing (CORS) on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-10)Example Usage #### [](#public-resource-simple-branch)Public resource (simple branch) ```hcl resource "anypoint_api_policy_cors" "public" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { public_resource = true support_credentials = false origin_groups = [ { origins = ["https://example.com"] methods = ["GET", "POST", "PUT"] headers = ["Content-Type", "Authorization"] } ] } order = 1 } ``` #### [](#non-public-resource-credentialed-branch)Non-public resource (credentialed branch) When `public_resource = false`, the platform enforces a stricter schema. Each origin group must include a `name` field and `access_control_max_age`. Omitting either returns HTTP 400. ```hcl resource "anypoint_api_policy_cors" "private" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { public_resource = false support_credentials = true origin_groups = [ { name = "allowed-origins" origins = ["https://example.com"] methods = ["GET", "POST", "PUT"] headers = ["Content-Type", "Authorization"] access_control_max_age = 600 } ] } order = 1 } ``` ### [](#required-arguments-10)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) CORS configuration.. ### [](#optional-arguments-10)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.3.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-10)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-8)Nested Schema for `configuration` - `origin_groups` - (Required, Dynamic) Array of origin group configurations. Structure differs by branch — see below. - `public_resource` - Whether the resource is publicly accessible. Defaults to `false`. Controls which platform schema branch is used. - `support_credentials` - Whether to allow credentials in CORS requests. #### [](#origin_groups-public-branch-public_resource-true)`origin_groups` — public branch (`public_resource = true`)
Field Type Description

origins

list(string)

Allowed origin URLs.

methods

list(string)

Allowed HTTP methods (for example, ["GET","POST"]).

headers

list(string)

Allowed request headers.
#### [](#origin_groups-non-public-branch-public_resource-false)`origin_groups` — non-public branch (`public_resource = false`)
Field Required Type Description

name

yes

string

Unique label for this origin group. If omitted, the provider synthesizes group-<index>.

origins

no

list(string)

Allowed origin URLs.

methods

no

list(string)

HTTP methods. The provider automatically converts these to allowedMethods objects required by the platform.

headers

no

list(string)

Allowed request headers.

access_control_max_age

no

number

Preflight cache duration in seconds. Defaults to 30.

Using flat fields directly inside configuration (instead of the origin_groups array) is rejected by the platform with HTTP 400.
### [](#pointcut-data-10)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-10)Import An existing `anypoint_api_policy_cors` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-10)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_cors.imported id = "///" } resource "anypoint_api_policy_cors" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-10)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_cors.imported /// ``` ## [](#anypoint_api_policy_credential_injection_basic_auth)`anypoint_api_policy_credential_injection_basic_auth` Use the `anypoint_api_policy_credential_injection_basic_auth` resource to inject Basic Auth credentials into upstream requests on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-11)Example Usage ```hcl resource "anypoint_api_policy_credential_injection_basic_auth" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { username = "service-account" password = "service-password" overwrite = true } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-11)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Credential injection configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs to inject credentials into. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-11)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.1`. ### [](#read-only-attributes-11)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-9)Nested Schema for `configuration` - `username` - (Required) The username for authentication. - `password` - (Required) The password for authentication. - `custom_header` - Custom header name to inject credentials into instead of the standard `Authorization` header. - `overwrite` - Whether to overwrite an existing credential header on the request. Defaults to `false`. The provider always sends this field — omitting it doesn’t cause HTTP 400. ### [](#pointcut-data-11)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-11)Import An existing `anypoint_api_policy_credential_injection_basic_auth` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-11)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_credential_injection_basic_auth.imported id = "///" } resource "anypoint_api_policy_credential_injection_basic_auth" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-11)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_credential_injection_basic_auth.imported /// ``` ## [](#anypoint_api_policy_credential_injection_oauth2)`anypoint_api_policy_credential_injection_oauth2` Use the `anypoint_api_policy_credential_injection_oauth2` resource to fetch an OAuth 2.0 token and inject it into upstream requests on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-12)Example Usage ```hcl resource "anypoint_api_policy_credential_injection_oauth2" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { oauth_service = "https://auth.example.com/oauth2/token" client_id = "my-client-id" client_secret = "my-client-secret" scope = ["read", "write"] overwrite = true token_fetch_timeout = 5000 allow_request_without_credential = false } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-12)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) OAuth 2.0 token injection configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs to inject the token into. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-12)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.1`. ### [](#read-only-attributes-12)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-10)Nested Schema for `configuration` - `oauth_service` - (Required) URL of the OAuth 2.0 token service. - `client_id` - (Required) The OAuth 2.0 client ID. - `client_secret` - (Required) The OAuth 2.0 client secret. - `scope` - (Dynamic) Array of OAuth 2.0 scopes to request. - `token_fetch_timeout` - Timeout in milliseconds for fetching the OAuth token. Defaults to `10000`. The provider always sends this field — omitting it doesn’t cause HTTP 400. - `overwrite` - Whether to overwrite an existing credential header on the request. Defaults to `false`. The provider always sends this field. - `allow_request_without_credential` - Whether to allow requests to pass through without injected credentials. Defaults to `false`. The provider always sends this field. ### [](#pointcut-data-12)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-12)Import An existing `anypoint_api_policy_credential_injection_oauth2` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-12)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_credential_injection_oauth2.imported id = "///" } resource "anypoint_api_policy_credential_injection_oauth2" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-12)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_credential_injection_oauth2.imported /// ``` ## [](#anypoint_api_policy_credential_injection_oauth2_obo)`anypoint_api_policy_credential_injection_oauth2_obo` Use the `anypoint_api_policy_credential_injection_oauth2_obo` resource to exchange an incoming token for a downstream token using the OAuth 2.0 On-Behalf-Of flow, then inject it into upstream requests.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-13)Example Usage ```hcl resource "anypoint_api_policy_credential_injection_oauth2_obo" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { flow = "urn:ietf:params:oauth:grant-type:jwt-bearer" client_id = "my-client-id" client_secret = "my-client-secret" token_endpoint = "https://auth.example.com/oauth2/token" scope = "openid profile" timeout = 5000 } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-13)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) On-Behalf-Of token exchange configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs to inject the exchanged token into. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-13)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.1.0`. ### [](#read-only-attributes-13)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-11)Nested Schema for `configuration` - `client_id` - (Required) The OAuth 2.0 client ID. - `client_secret` - (Required) The OAuth 2.0 client secret. - `flow` - (Required) The OAuth 2.0 grant flow type. - `token_endpoint` - (Required) URL of the OAuth 2.0 token endpoint. - `ciba_enabled` - Whether CIBA (Client-Initiated Backchannel Authentication) is enabled. - `ciba_endpoint` - The backchannel authentication endpoint URL (used when `ciba_enabled` is `true`). - `ciba_binding_message` - A human-readable binding message sent to the user’s authentication device (used when `ciba_enabled` is `true`). - `ciba_login_hint_claim` - The claim used to identify the end user in the CIBA flow (used when `ciba_enabled` is `true`). - `distributed` - Whether to use distributed token caching across cluster nodes. - `requested_token_type` - The type of token to be returned by the token endpoint. - `scope` - Array or string of OAuth 2.0 scopes. - `subject_token_type` - The type of the subject token (for example, `urn:ietf:params:oauth:token-type:access_token`). - `target_type` - The target resource type for the On-Behalf-Of flow. - `target_value` - The target resource value for the On-Behalf-Of flow. - `timeout` - Timeout in milliseconds. ### [](#pointcut-data-13)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-13)Import An existing `anypoint_api_policy_credential_injection_oauth2_obo` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-13)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_credential_injection_oauth2_obo.imported id = "///" } resource "anypoint_api_policy_credential_injection_oauth2_obo" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-13)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_credential_injection_oauth2_obo.imported /// ``` ## [](#anypoint_api_policy_dataweave_request_filter)`anypoint_api_policy_dataweave_request_filter` Use the `anypoint_api_policy_dataweave_request_filter` resource to evaluate a DataWeave script against incoming requests and allow or reject them based on the result.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-14)Example Usage ```hcl resource "anypoint_api_policy_dataweave_request_filter" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { script = "%%dw 2.0\noutput application/json\n---\ntrue" requires_payload = false } order = 1 } ``` ### [](#required-arguments-14)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Filter script configuration.. ### [](#optional-arguments-14)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-14)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-12)Nested Schema for `configuration` - `script` - (Required) The DataWeave script to evaluate against the request. - `requires_payload` - Whether the script requires access to the request payload. ### [](#pointcut-data-14)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-14)Import An existing `anypoint_api_policy_dataweave_request_filter` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-14)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_dataweave_request_filter.imported id = "///" } resource "anypoint_api_policy_dataweave_request_filter" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-14)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_dataweave_request_filter.imported /// ``` ## [](#anypoint_api_policy_dataweave_body_transformation)`anypoint_api_policy_dataweave_body_transformation` Use the `anypoint_api_policy_dataweave_body_transformation` resource to transform request or response bodies using a DataWeave script on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-15)Example Usage ```hcl resource "anypoint_api_policy_dataweave_body_transformation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { script = "%%dw 2.0\noutput application/json\n---\npayload" request_flow = "request" } order = 1 } ``` ### [](#required-arguments-15)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Transformation configuration.. ### [](#optional-arguments-15)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-15)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-13)Nested Schema for `configuration` - `script` - (Required) The DataWeave transformation script. - `request_flow` - Which flow to apply the transformation to (`request` or `response`). ### [](#pointcut-data-15)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-15)Import An existing `anypoint_api_policy_dataweave_body_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-15)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_dataweave_body_transformation.imported id = "///" } resource "anypoint_api_policy_dataweave_body_transformation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-15)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_dataweave_body_transformation.imported /// ``` ## [](#anypoint_api_policy_dataweave_headers_transformation)`anypoint_api_policy_dataweave_headers_transformation` Use the `anypoint_api_policy_dataweave_headers_transformation` resource to transform request or response headers using a DataWeave script on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-16)Example Usage ```hcl resource "anypoint_api_policy_dataweave_headers_transformation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { script = "%%dw 2.0\noutput application/json\n---\npayload" requires_payload = false request_flow = "request" } order = 1 } ``` ### [](#required-arguments-16)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Header transformation configuration.. ### [](#optional-arguments-16)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-16)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-14)Nested Schema for `configuration` - `script` - (Required) The DataWeave transformation script. - `request_flow` - Which flow to apply the transformation to (`request` or `response`). - `requires_payload` - Whether the script requires access to the payload. ### [](#pointcut-data-16)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-16)Import An existing `anypoint_api_policy_dataweave_headers_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-16)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_dataweave_headers_transformation.imported id = "///" } resource "anypoint_api_policy_dataweave_headers_transformation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-16)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_dataweave_headers_transformation.imported /// ``` ## [](#anypoint_api_policy_external_oauth2_access_token_enforcement)`anypoint_api_policy_external_oauth2_access_token_enforcement` Use the `anypoint_api_policy_external_oauth2_access_token_enforcement` resource to validate OAuth 2.0 access tokens against an external authorization server on an Anypoint API instance.

This policy is only supported on mule4 API instances.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-17)Example Usage ```hcl resource "anypoint_api_policy_external_oauth2_access_token_enforcement" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { token_url = "https://auth.example.com/oauth2/token" scope_validation_criteria = "AND" scopes = "read write" expose_headers = false skip_client_id_validation = true } order = 1 } ``` ### [](#required-arguments-17)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Token validation configuration.. ### [](#optional-arguments-17)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.6.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-17)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-15)Nested Schema for `configuration` - `token_url` - (Required) URL of the OAuth 2.0 token endpoint. - `authentication_timeout` - Authentication request timeout in milliseconds. - `expose_headers` - Whether to expose rate-limit headers in the response. - `max_cache_entries` - Maximum number of entries in the token cache. - `scope_validation_criteria` - How scopes are validated (`AND` or `OR`). - `scopes` - Space-separated list of required OAuth scopes. - `secure_trust_store` - Whether to use a secure trust store for token validation. - `skip_client_id_validation` - Whether to skip client ID validation. ### [](#pointcut-data-17)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-17)Import An existing `anypoint_api_policy_external_oauth2_access_token_enforcement` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-17)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_external_oauth2_access_token_enforcement.imported id = "///" } resource "anypoint_api_policy_external_oauth2_access_token_enforcement" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-17)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_external_oauth2_access_token_enforcement.imported /// ``` ## [](#anypoint_api_policy_header_injection)`anypoint_api_policy_header_injection` Use the `anypoint_api_policy_header_injection` resource to add custom headers to inbound requests or outbound responses on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-18)Example Usage ```hcl resource "anypoint_api_policy_header_injection" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { inbound_headers = [ { name = "X-Custom-Header" value = "custom-value" } ] outbound_headers = [] } order = 1 } ``` ### [](#required-arguments-18)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Header injection configuration.. ### [](#optional-arguments-18)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.3.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-18)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-16)Nested Schema for `configuration` - `inbound_headers` - (Dynamic) Array of inbound headers to inject or remove. - `outbound_headers` - (Dynamic) Array of outbound headers to inject or remove. ### [](#pointcut-data-18)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-18)Import An existing `anypoint_api_policy_header_injection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-18)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_header_injection.imported id = "///" } resource "anypoint_api_policy_header_injection" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-18)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_header_injection.imported /// ``` ## [](#anypoint_api_policy_header_removal)`anypoint_api_policy_header_removal` Use the `anypoint_api_policy_header_removal` resource to strip specific headers from inbound requests or outbound responses on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-19)Example Usage ```hcl resource "anypoint_api_policy_header_removal" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { inbound_headers = [ { name = "X-Remove-Me" } ] outbound_headers = [] } order = 1 } ``` ### [](#required-arguments-19)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Header removal configuration.. ### [](#optional-arguments-19)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-19)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-17)Nested Schema for `configuration` - `inbound_headers` - (Dynamic) Array of inbound headers to remove. - `outbound_headers` - (Dynamic) Array of outbound headers to remove. ### [](#pointcut-data-19)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-19)Import An existing `anypoint_api_policy_header_removal` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-19)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_header_removal.imported id = "///" } resource "anypoint_api_policy_header_removal" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-19)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_header_removal.imported /// ``` ## [](#anypoint_api_policy_header_transformation)`anypoint_api_policy_header_transformation` Use the `anypoint_api_policy_header_transformation` resource to transform request or response headers using a DataWeave script on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-20)Example Usage ```hcl resource "anypoint_api_policy_header_transformation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { script = "%%dw 2.0\noutput application/json\n---\npayload" requires_payload = false request_flow = "request" } order = 1 } ``` ### [](#required-arguments-20)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Transformation configuration.. ### [](#optional-arguments-20)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260127.134148`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-20)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-18)Nested Schema for `configuration` - `script` - (Required) The DataWeave transformation script. - `request_flow` - Which flow to apply the transformation to (`request` or `response`). - `requires_payload` - Whether the script requires access to the payload. ### [](#pointcut-data-20)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-20)Import An existing `anypoint_api_policy_header_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-20)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_header_transformation.imported id = "///" } resource "anypoint_api_policy_header_transformation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-20)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_header_transformation.imported /// ``` ## [](#anypoint_api_policy_health_check)`anypoint_api_policy_health_check` Use the `anypoint_api_policy_health_check` resource to expose a health check endpoint on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-21)Example Usage ```hcl resource "anypoint_api_policy_health_check" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { endpoint = "/health" path = "/health" status_code = "200" } order = 1 } ``` ### [](#required-arguments-21)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Health check configuration.. ### [](#optional-arguments-21)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-21)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-19)Nested Schema for `configuration` - `endpoint` - The health check endpoint URL. - `path` - The health check path. - `status_code` - The expected HTTP status code for a healthy response. ### [](#pointcut-data-21)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-21)Import An existing `anypoint_api_policy_health_check` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-21)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_health_check.imported id = "///" } resource "anypoint_api_policy_health_check" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-21)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_health_check.imported /// ``` ## [](#anypoint_api_policy_http_basic_authentication)`anypoint_api_policy_http_basic_authentication` Use the `anypoint_api_policy_http_basic_authentication` resource to enforce HTTP Basic Authentication on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-22)Example Usage ```hcl resource "anypoint_api_policy_http_basic_authentication" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { username = "admin" password = "secret" } order = 1 } ``` ### [](#required-arguments-22)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Authentication credentials.. ### [](#optional-arguments-22)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.3.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-22)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-20)Nested Schema for `configuration` - `username` - (Required) The username for authentication. - `password` - (Required) The password for authentication. ### [](#pointcut-data-22)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-22)Import An existing `anypoint_api_policy_http_basic_authentication` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-22)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_http_basic_authentication.imported id = "///" } resource "anypoint_api_policy_http_basic_authentication" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-22)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_http_basic_authentication.imported /// ``` ## [](#anypoint_api_policy_http_caching)`anypoint_api_policy_http_caching` Use the `anypoint_api_policy_http_caching` resource to cache HTTP responses on an Anypoint API instance to reduce upstream load and improve response times.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-23)Example Usage ```hcl resource "anypoint_api_policy_http_caching" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { http_caching_key = "#[attributes.requestPath]" max_cache_entries = 1000 ttl = 600 distributed = false persist_cache = false use_http_cache_headers = true invalidation_header = "X-Cache-Invalidate" } order = 1 } ``` ### [](#required-arguments-23)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Cache configuration.. ### [](#optional-arguments-23)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-23)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-21)Nested Schema for `configuration` - `http_caching_key` - Expression to compute the cache key. - `max_cache_entries` - Maximum number of entries in the cache. - `ttl` - Time-to-live in seconds for cached entries. - `distributed` - Whether the cache is distributed across the cluster. - `persist_cache` - Whether to persist the cache to disk. - `use_http_cache_headers` - Whether to honor standard HTTP caching headers. - `invalidation_header` - Header name that triggers cache invalidation. - `request_expression` - Expression to evaluate on the request for caching decisions. - `response_expression` - Expression to evaluate on the response for caching decisions. ### [](#pointcut-data-23)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-23)Import An existing `anypoint_api_policy_http_caching` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-23)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_http_caching.imported id = "///" } resource "anypoint_api_policy_http_caching" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-23)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_http_caching.imported /// ``` ## [](#anypoint_api_policy_idle_timeout)`anypoint_api_policy_idle_timeout` Use the `anypoint_api_policy_idle_timeout` resource to close idle upstream connections after a configurable period on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-24)Example Usage ```hcl resource "anypoint_api_policy_idle_timeout" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { timeout = 30000 } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-24)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Timeout configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy monitors. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-24)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.1`. ### [](#read-only-attributes-24)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-22)Nested Schema for `configuration` - `timeout` - (Required) Idle connection timeout in milliseconds. ### [](#pointcut-data-24)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-24)Import An existing `anypoint_api_policy_idle_timeout` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-24)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_idle_timeout.imported id = "///" } resource "anypoint_api_policy_idle_timeout" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-24)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_idle_timeout.imported /// ``` ## [](#anypoint_api_policy_intask_authentication_policy)`anypoint_api_policy_intask_authentication_policy` Use the `anypoint_api_policy_intask_authentication_policy` resource to delegate authentication to a secondary OAuth 2.0 provider on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-25)Example Usage ```hcl resource "anypoint_api_policy_intask_authentication_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { secondary_auth_provider = "example-provider" authorization_endpoint = "https://auth.example.com/authorize" token_endpoint = "https://auth.example.com/token" redirect_uri = "https://app.example.com/callback" scopes = "openid profile" response_type = "code" token_timeout = 3600 } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-25)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Authentication configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-25)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260113204639`. ### [](#read-only-attributes-25)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-23)Nested Schema for `configuration` - `authorization_endpoint` - (Required) URL of the OAuth 2.0 authorization endpoint. - `redirect_uri` - (Required) The redirect URI for the OAuth 2.0 flow. - `secondary_auth_provider` - (Required) Name of the secondary authentication provider. - `token_endpoint` - (Required) URL of the OAuth 2.0 token endpoint. - `body_encoding` - Encoding for the token request body. - `challenge_response_status_code` - HTTP status code for the challenge response. - `code_challenge_method` - The PKCE code challenge method (for example, `S256`). - `response_type` - The OAuth 2.0 response type (for example, `code`). - `scopes` - Space-separated list of required OAuth scopes. - `token_audience` - Expected audience value for the token. - `token_timeout` - Token validity timeout in seconds. - `user_email_header` - Header name to extract the user email from. - `user_id_header` - Header name to extract the user ID from. ### [](#pointcut-data-25)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-25)Import An existing `anypoint_api_policy_intask_authentication_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-25)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_intask_authentication_policy.imported id = "///" } resource "anypoint_api_policy_intask_authentication_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-25)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_intask_authentication_policy.imported /// ``` ## [](#anypoint_api_policy_intask_authorization_code_policy)`anypoint_api_policy_intask_authorization_code_policy` Use the `anypoint_api_policy_intask_authorization_code_policy` resource to enforce the OAuth 2.0 Authorization Code flow via a secondary provider on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-26)Example Usage ```hcl resource "anypoint_api_policy_intask_authorization_code_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { secondary_auth_provider = "example-provider" authorization_endpoint = "https://auth.example.com/authorize" token_endpoint = "https://auth.example.com/token" redirect_uri = "https://app.example.com/callback" scopes = "openid profile" response_type = "code" } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-26)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Authorization code flow configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-26)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.0`. ### [](#read-only-attributes-26)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-24)Nested Schema for `configuration` - `authorization_endpoint` - (Required) URL of the OAuth 2.0 authorization endpoint. - `redirect_uri` - (Required) The redirect URI for the OAuth 2.0 flow. - `secondary_auth_provider` - (Required) Name of the secondary authentication provider. - `token_endpoint` - (Required) URL of the OAuth 2.0 token endpoint. - `body_encoding` - Encoding for the token request body. - `challenge_response_status_code` - HTTP status code for the challenge response. - `code_challenge_method` - The PKCE code challenge method (for example, `S256`). - `response_type` - The OAuth 2.0 response type (for example, `code`). - `scopes` - Space-separated list of required OAuth scopes. - `token_timeout` - Token validity timeout in seconds. ### [](#pointcut-data-26)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-26)Import An existing `anypoint_api_policy_intask_authorization_code_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-26)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_intask_authorization_code_policy.imported id = "///" } resource "anypoint_api_policy_intask_authorization_code_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-26)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_intask_authorization_code_policy.imported /// ``` ## [](#anypoint_api_policy_ip_allowlist)`anypoint_api_policy_ip_allowlist` Use the `anypoint_api_policy_ip_allowlist` resource to restrict access to an Anypoint API instance to a specific set of IP addresses or CIDR blocks.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-27)Example Usage ```hcl resource "anypoint_api_policy_ip_allowlist" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { ip_expression = "#[attributes.remoteAddress]" ips = ["10.0.0.0/8", "172.16.0.0/12"] methods_string = "GET|POST" } order = 1 } ``` ### [](#required-arguments-27)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Allowlist configuration.. ### [](#optional-arguments-27)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-27)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-25)Nested Schema for `configuration` - `ip_expression` - (Required) Expression to extract the client IP address from the request. - `ips` - (Required, List of String) IP addresses or CIDR blocks to allow. Must be a list of strings, not a comma-separated string. - `methods_string` - Pipe-separated list of HTTP methods this policy applies to (for example, `GET|POST`). ### [](#pointcut-data-27)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-27)Import An existing `anypoint_api_policy_ip_allowlist` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-27)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_ip_allowlist.imported id = "///" } resource "anypoint_api_policy_ip_allowlist" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-27)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_ip_allowlist.imported /// ``` ## [](#anypoint_api_policy_ip_blocklist)`anypoint_api_policy_ip_blocklist` Use the `anypoint_api_policy_ip_blocklist` resource to deny access to an Anypoint API instance from specific IP addresses or CIDR blocks.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-28)Example Usage ```hcl resource "anypoint_api_policy_ip_blocklist" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { ip_expression = "#[attributes.remoteAddress]" ips = ["192.168.1.0/24", "10.0.0.1"] methods_string = "GET|POST" } order = 1 } ``` ### [](#required-arguments-28)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Blocklist configuration.. ### [](#optional-arguments-28)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-28)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-26)Nested Schema for `configuration` - `ip_expression` - (Required) Expression to extract the client IP address from the request. - `ips` - (Required, List of String) IP addresses or CIDR blocks to block. Must be a list of strings, not a comma-separated string. - `methods_string` - Pipe-separated list of HTTP methods this policy applies to (for example, `GET|POST`). ### [](#pointcut-data-28)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-28)Import An existing `anypoint_api_policy_ip_blocklist` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-28)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_ip_blocklist.imported id = "///" } resource "anypoint_api_policy_ip_blocklist" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-28)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_ip_blocklist.imported /// ``` ## [](#anypoint_api_policy_injection_protection)`anypoint_api_policy_injection_protection` Use the `anypoint_api_policy_injection_protection` resource to detect and block SQL, script, and other injection attacks on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-29)Example Usage ```hcl resource "anypoint_api_policy_injection_protection" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { protect_path_and_query = true protect_headers = true protect_body = true reject_requests = true built_in_protections = ["sql-injection", "script-injection"] } order = 1 } ``` ### [](#required-arguments-29)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Injection protection configuration.. ### [](#optional-arguments-29)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-29)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-27)Nested Schema for `configuration` - `built_in_protections` - (Dynamic) Built-in injection protection types to enable (for example, `sql-injection`, `script-injection`). - `custom_protections` - (Dynamic) Custom injection protection regex patterns. - `protect_path_and_query` - Whether to apply injection protection to path and query parameters. - `protect_headers` - Whether to apply injection protection to headers. - `protect_body` - Whether to apply injection protection to the request body. - `reject_requests` - Whether to reject requests that match injection patterns. ### [](#pointcut-data-29)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-29)Import An existing `anypoint_api_policy_injection_protection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-29)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_injection_protection.imported id = "///" } resource "anypoint_api_policy_injection_protection" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-29)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_injection_protection.imported /// ``` ## [](#anypoint_api_policy_json_threat_protection)`anypoint_api_policy_json_threat_protection` Use the `anypoint_api_policy_json_threat_protection` resource to protect an Anypoint API instance against malicious JSON payloads by enforcing structural limits.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-30)Example Usage ```hcl resource "anypoint_api_policy_json_threat_protection" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { max_container_depth = 10 max_string_value_length = 256 max_object_entry_name_length = 128 max_object_entry_count = 50 max_array_element_count = 50 } order = 1 } ``` ### [](#required-arguments-30)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) JSON structural limits.. ### [](#optional-arguments-30)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.2.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-30)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-28)Nested Schema for `configuration` - `max_container_depth` - Maximum nesting depth for JSON containers. - `max_string_value_length` - Maximum length for JSON string values. - `max_object_entry_name_length` - Maximum length for JSON object entry names. - `max_object_entry_count` - Maximum number of entries in a JSON object. - `max_array_element_count` - Maximum number of elements in a JSON array. ### [](#pointcut-data-30)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-30)Import An existing `anypoint_api_policy_json_threat_protection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-30)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_json_threat_protection.imported id = "///" } resource "anypoint_api_policy_json_threat_protection" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-30)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_json_threat_protection.imported /// ``` ## [](#anypoint_api_policy_jwt_validation)`anypoint_api_policy_jwt_validation` Use the `anypoint_api_policy_jwt_validation` resource to validate JWT tokens on incoming requests to an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-31)Example Usage ```hcl resource "anypoint_api_policy_jwt_validation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id asset_version = "1.4.0" configuration = { jwt_origin = "httpBearerAuthenticationHeader" signing_method = "rsa" signing_key_length = 256 jwt_key_origin = "jwks" jwks_url = "https://example.com/.well-known/jwks.json" jwks_service_time_to_live = 60 jwks_service_connection_timeout = 10000 skip_client_id_validation = true validate_aud_claim = false mandatory_aud_claim = false mandatory_exp_claim = false mandatory_nbf_claim = false validate_custom_claim = true jwt_expression = "#[attributes.headers['jwt']]" client_id_expression = "#[vars.claimSet.client_id]" supported_audiences = "aud.example.com" mandatory_custom_claims = [ { key = "key1" value = "value1" }, { key = "key2" value = "value2" } ] } order = 1 } ``` ### [](#required-arguments-31)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `asset_version` - Policy asset version (for example, `1.4.0`). Must match the version deployed in your organization’s Exchange. - `configuration` - (Block) JWT validation configuration. ### [](#optional-arguments-31)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-31)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-29)Nested Schema for `configuration` - `jwt_origin` - (Required) Where the JWT token is extracted from (for example, `httpBearerAuthenticationHeader`). - `claims_to_headers` - (Dynamic) Array mapping JWT claims to response headers. - `client_id_expression` - Expression to extract the client ID from the request. - `custom_key_expression` - Custom expression to resolve the signing key. - `jwks_service_connection_timeout` - Connection timeout in milliseconds for the JWKS endpoint. - `jwks_service_time_to_live` - TTL in seconds for cached JWKS keys. - `jwks_url` - URL to the JWKS endpoint for key retrieval. - `jwt_expression` - Custom expression to extract the JWT token. - `jwt_key_origin` - Source of the signing key (for example, `jwks`, `text`). - `mandatory_aud_claim` - Whether the `aud` claim is mandatory. - `mandatory_custom_claims` - (Dynamic) Custom claims that must be present. - `mandatory_exp_claim` - Whether the `exp` (expiration) claim is mandatory. - `mandatory_nbf_claim` - Whether the `nbf` (not before) claim is mandatory. - `non_mandatory_custom_claims` - (Dynamic) Optional custom claims to validate if present. - `signing_key_length` - The key length for the signing algorithm. - `signing_method` - The signing algorithm (for example, `rsa`, `hmac`). - `skip_client_id_validation` - Whether to skip client ID validation. - `supported_audiences` - Comma-separated list of supported audience values. - `text_key` - The inline signing key when `jwt_key_origin` is `text`. - `validate_aud_claim` - Whether to validate the `aud` (audience) claim. - `validate_custom_claim` - Whether to validate custom claims. ### [](#pointcut-data-31)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-31)Import An existing `anypoint_api_policy_jwt_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-31)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_jwt_validation.imported id = "///" } resource "anypoint_api_policy_jwt_validation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-31)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_jwt_validation.imported /// ``` ## [](#anypoint_api_policy_ldap_authentication)`anypoint_api_policy_ldap_authentication` Use the `anypoint_api_policy_ldap_authentication` resource to authenticate incoming requests against an LDAP directory on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-32)Example Usage ```hcl resource "anypoint_api_policy_ldap_authentication" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { ldap_server_url = "ldap://ldap.example.com:389" ldap_server_user_dn = "cn=admin,dc=example,dc=com" ldap_server_user_password = "admin-password" ldap_search_base = "ou=users,dc=example,dc=com" ldap_search_filter = "(uid={0})" ldap_search_in_subtree = true } order = 1 } ``` ### [](#required-arguments-32)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) LDAP connection and search configuration.. ### [](#optional-arguments-32)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.4.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-32)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-30)Nested Schema for `configuration` - `ldap_server_url` - (Required) URL of the LDAP server. - `ldap_server_user_dn` - (Required) Distinguished name of the LDAP bind user. - `ldap_server_user_password` - (Required) Password for the LDAP bind user. - `ldap_search_base` - (Required) Base DN for LDAP searches. - `ldap_search_filter` - (Required) LDAP search filter expression. - `ldap_search_in_subtree` - Whether to search in subtrees. ### [](#pointcut-data-32)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-32)Import An existing `anypoint_api_policy_ldap_authentication` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-32)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_ldap_authentication.imported id = "///" } resource "anypoint_api_policy_ldap_authentication" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-32)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_ldap_authentication.imported /// ``` ## [](#anypoint_api_policy_bedrock_llm_provider_policy)`anypoint_api_policy_bedrock_llm_provider_policy` Use the `anypoint_api_policy_bedrock_llm_provider_policy` resource to configure AWS Bedrock as the LLM provider for an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-33)Example Usage ```hcl resource "anypoint_api_policy_bedrock_llm_provider_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { aws_access_key_id = "AKIAIOSFODNN7EXAMPLE" aws_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" aws_region = "us-east-1" service_name = "bedrock" timeout = 30000 } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-33)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) AWS Bedrock connection configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-33)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.1`. ### [](#read-only-attributes-33)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-31)Nested Schema for `configuration` - `aws_access_key_id` - (Required) AWS access key ID. - `aws_region` - (Required) AWS region for the Bedrock service. - `aws_secret_access_key` - (Required) AWS secret access key. - `aws_session_token` - AWS session token for temporary credentials. - `service_name` - The AWS service name. - `timeout` - Request timeout in milliseconds. ### [](#pointcut-data-33)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-33)Import An existing `anypoint_api_policy_bedrock_llm_provider_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-33)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_bedrock_llm_provider_policy.imported id = "///" } resource "anypoint_api_policy_bedrock_llm_provider_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-33)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_bedrock_llm_provider_policy.imported /// ``` ## [](#anypoint_api_policy_gemini_llm_provider_policy)`anypoint_api_policy_gemini_llm_provider_policy` Use the `anypoint_api_policy_gemini_llm_provider_policy` resource to configure Google Gemini as the LLM provider for an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-34)Example Usage ```hcl resource "anypoint_api_policy_gemini_llm_provider_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { api_key = "AIzaSy-xxxxxxxxxxxx" timeout = 30000 } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-34)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Gemini connection configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-34)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.0`. ### [](#read-only-attributes-34)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-32)Nested Schema for `configuration` - `api_key` - (Required) API key for the Gemini LLM provider. - `model_mapper` - (Dynamic) Array of model name mappings. - `timeout` - Request timeout in milliseconds. ### [](#pointcut-data-34)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-34)Import An existing `anypoint_api_policy_gemini_llm_provider_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-34)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_gemini_llm_provider_policy.imported id = "///" } resource "anypoint_api_policy_gemini_llm_provider_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-34)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_gemini_llm_provider_policy.imported /// ``` ## [](#anypoint_api_policy_gemini_transcoding_policy)`anypoint_api_policy_gemini_transcoding_policy` Use the `anypoint_api_policy_gemini_transcoding_policy` resource to transcode requests and responses between the OpenAI API format and the Google Gemini API format on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-35)Example Usage ```hcl resource "anypoint_api_policy_gemini_transcoding_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = {} upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-35)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`). - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-35)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.0`. ### [](#read-only-attributes-35)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#pointcut-data-35)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-35)Import An existing `anypoint_api_policy_gemini_transcoding_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-35)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_gemini_transcoding_policy.imported id = "///" } resource "anypoint_api_policy_gemini_transcoding_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-35)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_gemini_transcoding_policy.imported /// ``` ## [](#anypoint_api_policy_llm_gw_core_policy)`anypoint_api_policy_llm_gw_core_policy` Use the `anypoint_api_policy_llm_gw_core_policy` resource to route LLM requests to the correct provider backend based on a vendor header on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-36)Example Usage ```hcl resource "anypoint_api_policy_llm_gw_core_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { header_name = "X-LLM-Vendor" vendor_header_mapping = [ { vendor = "openai" header_value = "openai" } ] } order = 1 } ``` ### [](#required-arguments-36)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Vendor routing configuration.. ### [](#optional-arguments-36)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20251230075635`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-36)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-33)Nested Schema for `configuration` - `header_name` - (Required) Name of the header used for vendor routing. - `vendor_header_mapping` - (Required, Dynamic) Array mapping vendor names to header values. ### [](#pointcut-data-36)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-36)Import An existing `anypoint_api_policy_llm_gw_core_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-36)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_llm_gw_core_policy.imported id = "///" } resource "anypoint_api_policy_llm_gw_core_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-36)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_llm_gw_core_policy.imported /// ``` ## [](#anypoint_api_policy_llm_proxy_core)`anypoint_api_policy_llm_proxy_core` Use the `anypoint_api_policy_llm_proxy_core` resource to enable core LLM proxy functionality on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-37)Example Usage ```hcl resource "anypoint_api_policy_llm_proxy_core" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = {} order = 1 } ``` ### [](#required-arguments-37)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`). ### [](#optional-arguments-37)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260127095720`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-37)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#pointcut-data-37)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-37)Import An existing `anypoint_api_policy_llm_proxy_core` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-37)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_llm_proxy_core.imported id = "///" } resource "anypoint_api_policy_llm_proxy_core" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-37)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_llm_proxy_core.imported /// ``` ## [](#anypoint_api_policy_llm_proxy_core_policy)`anypoint_api_policy_llm_proxy_core_policy` Use the `anypoint_api_policy_llm_proxy_core_policy` resource to route LLM proxy requests to the correct provider backend based on a vendor header on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-38)Example Usage ```hcl resource "anypoint_api_policy_llm_proxy_core_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { header_name = "X-LLM-Vendor" vendor_header_mapping = [ { vendor = "openai" header_value = "openai" } ] } order = 1 } ``` ### [](#required-arguments-38)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Vendor routing configuration.. ### [](#optional-arguments-38)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260108100848`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-38)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-34)Nested Schema for `configuration` - `header_name` - (Required) Name of the header used for vendor routing. - `vendor_header_mapping` - (Required, Dynamic) Array mapping vendor names to header values. ### [](#pointcut-data-38)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-38)Import An existing `anypoint_api_policy_llm_proxy_core_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-38)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_llm_proxy_core_policy.imported id = "///" } resource "anypoint_api_policy_llm_proxy_core_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-38)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_llm_proxy_core_policy.imported /// ``` ## [](#anypoint_api_policy_mcp_access_control)`anypoint_api_policy_mcp_access_control` Use the `anypoint_api_policy_mcp_access_control` resource to define access control rules for MCP tools on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-39)Example Usage ```hcl resource "anypoint_api_policy_mcp_access_control" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { rules = [ { tool = "list_files" action = "allow" } ] auth_type = "bearer" } order = 1 } ``` ### [](#required-arguments-39)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Access control configuration.. ### [](#optional-arguments-39)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-39)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-35)Nested Schema for `configuration` - `rules` - (Required, Dynamic) Array of access control rules. - `auth_type` - Authentication type (for example, `bearer`, `api_key`). ### [](#pointcut-data-39)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-39)Import An existing `anypoint_api_policy_mcp_access_control` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-39)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_access_control.imported id = "///" } resource "anypoint_api_policy_mcp_access_control" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-39)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_access_control.imported /// ``` ## [](#anypoint_api_policy_mcp_global_access_policy)`anypoint_api_policy_mcp_global_access_policy` Use the `anypoint_api_policy_mcp_global_access_policy` resource to define global access rules for all MCP tools on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-40)Example Usage ```hcl resource "anypoint_api_policy_mcp_global_access_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { rules = [ { action = "allow" } ] } order = 1 } ``` ### [](#required-arguments-40)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Access control configuration.. ### [](#optional-arguments-40)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-40)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-36)Nested Schema for `configuration` - `rules` - (Required, Dynamic) Array of access control rules. ### [](#pointcut-data-40)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-40)Import An existing `anypoint_api_policy_mcp_global_access_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-40)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_global_access_policy.imported id = "///" } resource "anypoint_api_policy_mcp_global_access_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-40)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_global_access_policy.imported /// ``` ## [](#anypoint_api_policy_mcp_pii_detector)`anypoint_api_policy_mcp_pii_detector` Use the `anypoint_api_policy_mcp_pii_detector` resource to detect personally identifiable information (PII) in MCP requests and responses on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-41)Example Usage ```hcl resource "anypoint_api_policy_mcp_pii_detector" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { entities = ["EMAIL", "PHONE_NUMBER", "CREDIT_CARD"] } order = 1 } ``` ### [](#required-arguments-41)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) PII detection configuration.. ### [](#optional-arguments-41)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-41)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-37)Nested Schema for `configuration` - `entities` - (Required, Dynamic) PII entity types to detect (for example, `EMAIL`, `PHONE_NUMBER`, `CREDIT_CARD`). ### [](#pointcut-data-41)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-41)Import An existing `anypoint_api_policy_mcp_pii_detector` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-41)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_pii_detector.imported id = "///" } resource "anypoint_api_policy_mcp_pii_detector" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-41)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_pii_detector.imported /// ``` ## [](#anypoint_api_policy_mcp_schema_validation)`anypoint_api_policy_mcp_schema_validation` Use the `anypoint_api_policy_mcp_schema_validation` resource to validate MCP tool input and output against their declared schemas on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-42)Example Usage ```hcl resource "anypoint_api_policy_mcp_schema_validation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { validate_tool_schema = true } order = 1 } ``` ### [](#required-arguments-42)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Schema validation configuration.. ### [](#optional-arguments-42)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-42)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-38)Nested Schema for `configuration` - `validate_tool_schema` - Whether to validate MCP tool input/output against schema. ### [](#pointcut-data-42)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-42)Import An existing `anypoint_api_policy_mcp_schema_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-42)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_schema_validation.imported id = "///" } resource "anypoint_api_policy_mcp_schema_validation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-42)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_schema_validation.imported /// ``` ## [](#anypoint_api_policy_mcp_support)`anypoint_api_policy_mcp_support` Use the `anypoint_api_policy_mcp_support` resource to enable Model Context Protocol (MCP) support on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-43)Example Usage ```hcl resource "anypoint_api_policy_mcp_support" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = {} order = 1 } ``` ### [](#required-arguments-43)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) This policy doesn’t require any configuration fields — pass an empty block (`configuration = {}`). ### [](#optional-arguments-43)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-43)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#pointcut-data-43)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-43)Import An existing `anypoint_api_policy_mcp_support` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-43)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_support.imported id = "///" } resource "anypoint_api_policy_mcp_support" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-43)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_support.imported /// ``` ## [](#anypoint_api_policy_mcp_tool_mapping)`anypoint_api_policy_mcp_tool_mapping` Use the `anypoint_api_policy_mcp_tool_mapping` resource to remap MCP tool names from a source name to a target name on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-44)Example Usage ```hcl resource "anypoint_api_policy_mcp_tool_mapping" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { tool_mappings = [ { source_tool = "original_tool" target_tool = "mapped_tool" } ] log_mappings = true } order = 1 } ``` ### [](#required-arguments-44)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Tool mapping configuration.. ### [](#optional-arguments-44)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-44)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-39)Nested Schema for `configuration` - `tool_mappings` - (Required, Dynamic) Array of tool name mappings from source to target. - `log_mappings` - Whether to log tool mapping operations. ### [](#pointcut-data-44)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-44)Import An existing `anypoint_api_policy_mcp_tool_mapping` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-44)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_tool_mapping.imported id = "///" } resource "anypoint_api_policy_mcp_tool_mapping" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-44)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_tool_mapping.imported /// ``` ## [](#anypoint_api_policy_mcp_transcoding_router)`anypoint_api_policy_mcp_transcoding_router` Use the `anypoint_api_policy_mcp_transcoding_router` resource to route and transcode MCP requests to backend services on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-45)Example Usage ```hcl resource "anypoint_api_policy_mcp_transcoding_router" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { transcoding_path = "/mcp" routes = [ { tool = "example_tool" backend = "https://backend.example.com" } ] } order = 1 } ``` ### [](#required-arguments-45)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Transcoding router configuration.. ### [](#optional-arguments-45)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1-20260414150102`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-45)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-40)Nested Schema for `configuration` - `routes` - (Required, Dynamic) Array of routing rules mapping tools to backends. - `transcoding_path` - Base path for MCP transcoding requests. ### [](#pointcut-data-45)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-45)Import An existing `anypoint_api_policy_mcp_transcoding_router` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-45)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_mcp_transcoding_router.imported id = "///" } resource "anypoint_api_policy_mcp_transcoding_router" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-45)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_mcp_transcoding_router.imported /// ``` ## [](#anypoint_api_policy_message_logging)`anypoint_api_policy_message_logging` Use the `anypoint_api_policy_message_logging` resource to log request and response messages on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-46)Example Usage ```hcl resource "anypoint_api_policy_message_logging" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { logging_configuration = [ { item_name = "request" item_data = { message = "#[payload]" conditional = "#[true]" level = "INFO" first_section = true second_section = false } } ] } order = 1 } ``` ### [](#required-arguments-46)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Logging configuration.. ### [](#optional-arguments-46)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `2.0.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-46)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-41)Nested Schema for `configuration` - `logging_configuration` - (Required, Dynamic) Array of logging rule objects. Each element must use the `item_name` + `item_data` wrapper — the platform rejects flat field structures with HTTP 400. Each element requires the following structure: ```hcl logging_configuration = [ { item_name = "" # unique label for this logging rule item_data = { message = "" # DataWeave expression or literal, e.g. "#[payload]" level = "" # Log level: DEBUG, INFO, WARN, ERROR (default: INFO) conditional = "" # Optional DataWeave boolean expression, e.g. "#[true]" category = "" # Optional logger category name first_section = # Log on request phase (default: true) second_section = # Log on response phase (default: false) } } ] ``` ### [](#pointcut-data-46)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-46)Import An existing `anypoint_api_policy_message_logging` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-46)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_message_logging.imported id = "///" } resource "anypoint_api_policy_message_logging" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-46)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_message_logging.imported /// ``` ## [](#anypoint_api_policy_message_logging_outbound)`anypoint_api_policy_message_logging_outbound` Use the `anypoint_api_policy_message_logging_outbound` resource to log outbound responses from upstream services on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-47)Example Usage ```hcl resource "anypoint_api_policy_message_logging_outbound" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { logging_configuration = [ { item_name = "response" item_data = { message = "#[payload]" conditional = "#[true]" level = "INFO" first_section = false second_section = true } } ] } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-47)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Logging configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-47)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `2.0.2`. ### [](#read-only-attributes-47)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-42)Nested Schema for `configuration` - `logging_configuration` - (Required, Dynamic) Array of logging rule objects. Each element must use the `item_name` + `item_data` wrapper — the platform rejects flat field structures with HTTP 400. Each element requires the following structure: ```hcl logging_configuration = [ { item_name = "" # unique label for this logging rule item_data = { message = "" # DataWeave expression or literal, e.g. "#[payload]" level = "" # Log level: DEBUG, INFO, WARN, ERROR (default: INFO) conditional = "" # Optional DataWeave boolean expression, e.g. "#[true]" category = "" # Optional logger category name first_section = # Log on request phase (default: true) second_section = # Log on response phase (default: false) } } ] ``` ### [](#pointcut-data-47)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-47)Import An existing `anypoint_api_policy_message_logging_outbound` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-47)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_message_logging_outbound.imported id = "///" } resource "anypoint_api_policy_message_logging_outbound" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-47)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_message_logging_outbound.imported /// ``` ## [](#anypoint_api_policy_model_based_routing)`anypoint_api_policy_model_based_routing` Use the `anypoint_api_policy_model_based_routing` resource to route LLM requests to the appropriate upstream based on the requested model on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-48)Example Usage ```hcl resource "anypoint_api_policy_model_based_routing" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { supported_vendors = [ { vendor = "openai" models = ["gpt-4", "gpt-3.5-turbo"] } ] } order = 1 } ``` ### [](#required-arguments-48)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Routing configuration.. ### [](#optional-arguments-48)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260127100214`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-48)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-43)Nested Schema for `configuration` - `supported_vendors` - (Required, Dynamic) Array of supported LLM vendor configurations. - `fallback` - (Dynamic) Fallback vendor configuration object. ### [](#pointcut-data-48)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-48)Import An existing `anypoint_api_policy_model_based_routing` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-48)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_model_based_routing.imported id = "///" } resource "anypoint_api_policy_model_based_routing" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-48)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_model_based_routing.imported /// ``` ## [](#anypoint_api_policy_agent_connection_telemetry)`anypoint_api_policy_agent_connection_telemetry` Use the `anypoint_api_policy_agent_connection_telemetry` resource to collect telemetry data from agent connections on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-49)Example Usage ```hcl resource "anypoint_api_policy_agent_connection_telemetry" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { source_agent_id = "agent-001" } order = 1 } ``` ### [](#required-arguments-49)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Telemetry configuration.. ### [](#optional-arguments-49)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-49)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-44)Nested Schema for `configuration` - `source_agent_id` - Identifier for the source agent connection. ### [](#pointcut-data-49)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-49)Import An existing `anypoint_api_policy_agent_connection_telemetry` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-49)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_agent_connection_telemetry.imported id = "///" } resource "anypoint_api_policy_agent_connection_telemetry" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-49)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_agent_connection_telemetry.imported /// ``` ## [](#anypoint_api_policy_native_aws_lambda)`anypoint_api_policy_native_aws_lambda` Use the `anypoint_api_policy_native_aws_lambda` resource to invoke an AWS Lambda function natively from an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-50)Example Usage ```hcl resource "anypoint_api_policy_native_aws_lambda" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { arn = "arn:aws:lambda:us-east-1:123456789012:function:my-function" payload_passthrough = false invocation_mode = "synchronous" authentication_mode = "static_credentials" credentials = { access_key_id = "AKIAIOSFODNN7EXAMPLE" secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-50)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Lambda invocation configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-50)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.1`. ### [](#read-only-attributes-50)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-45)Nested Schema for `configuration` - `arn` - (Required) The ARN of the AWS Lambda function. - `payload_passthrough` - (Required) Whether to pass the request payload directly to Lambda. - `invocation_mode` - (Required) Lambda invocation mode (`synchronous` or `asynchronous`). - `authentication_mode` - (Required) AWS authentication mode (for example, `static_credentials`, `iam_role`). - `credentials` - (Dynamic) AWS credentials object with `access_key_id`, `secret_access_key`, and optional `session_token`. ### [](#pointcut-data-50)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-50)Import An existing `anypoint_api_policy_native_aws_lambda` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-50)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_native_aws_lambda.imported id = "///" } resource "anypoint_api_policy_native_aws_lambda" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-50)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_native_aws_lambda.imported /// ``` ## [](#anypoint_api_policy_native_ext_authz)`anypoint_api_policy_native_ext_authz` Use the `anypoint_api_policy_native_ext_authz` resource to delegate authorization decisions to an external service via gRPC or HTTP on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-51)Example Usage ```hcl resource "anypoint_api_policy_native_ext_authz" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { uri = "grpc://auth-service:9090" server_type = "grpc" request_timeout = 5000 } order = 1 } ``` ### [](#required-arguments-51)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) External authorization configuration.. ### [](#optional-arguments-51)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.2.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-51)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-46)Nested Schema for `configuration` - `uri` - (Required) The URI of the external authorization service. - `server_type` - (Required) The server type (for example, `grpc`, `http`). - `allowed_headers` - (Dynamic) Headers to forward to the external service. - `include_peer_certificate` - Whether to include the peer certificate in the authorization request. - `path_prefix` - Path prefix for the external authorization request. - `request_timeout` - Request timeout in milliseconds. - `server_api_version` - The API version of the external authorization server. - `service_request_headers_to_add` - (Dynamic) Headers to add to the authorization request. - `service_response_client_headers` - (Dynamic) Headers from the authorization response to send to the client. - `service_response_client_headers_on_success` - (Dynamic) Headers to send on successful authorization. - `service_response_upstream_headers` - (Dynamic) Headers from the authorization response to send upstream. - `service_response_upstream_headers_to_append` - (Dynamic) Headers from the authorization response to append upstream. ### [](#pointcut-data-51)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-51)Import An existing `anypoint_api_policy_native_ext_authz` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-51)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_native_ext_authz.imported id = "///" } resource "anypoint_api_policy_native_ext_authz" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-51)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_native_ext_authz.imported /// ``` ## [](#anypoint_api_policy_native_ext_proc)`anypoint_api_policy_native_ext_proc` Use the `anypoint_api_policy_native_ext_proc` resource to stream request and response messages to an external gRPC processing service on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-52)Example Usage ```hcl resource "anypoint_api_policy_native_ext_proc" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { uri = "grpc://ext-proc-service:9091" message_timeout = 5000 failure_mode_allow = false request_header_mode = "SEND" response_header_mode = "SKIP" } order = 1 } ``` ### [](#required-arguments-52)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) External processor configuration.. ### [](#optional-arguments-52)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-52)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-47)Nested Schema for `configuration` - `uri` - (Required) The URI of the external processing service. - `allow_mode_override` - Whether to allow the external processor to override the processing mode. - `failure_mode_allow` - Whether to allow requests when the external processor fails. - `max_message_timeout` - Maximum message processing timeout in milliseconds. - `message_timeout` - Message processing timeout in milliseconds. - `request_body_mode` - Processing mode for the request body. - `request_header_mode` - Processing mode for request headers (for example, `SEND`, `SKIP`). - `request_trailer_mode` - Processing mode for request trailers. - `response_body_mode` - Processing mode for the response body. - `response_header_mode` - Processing mode for response headers (for example, `SEND`, `SKIP`). - `response_trailer_mode` - Processing mode for response trailers. ### [](#pointcut-data-52)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-52)Import An existing `anypoint_api_policy_native_ext_proc` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-52)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_native_ext_proc.imported id = "///" } resource "anypoint_api_policy_native_ext_proc" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-52)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_native_ext_proc.imported /// ``` ## [](#anypoint_api_policy_oauth2_token_introspection)`anypoint_api_policy_oauth2_token_introspection` Use the `anypoint_api_policy_oauth2_token_introspection` resource to validate OAuth 2.0 tokens by introspecting them against an authorization server on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-53)Example Usage ```hcl resource "anypoint_api_policy_oauth2_token_introspection" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { introspection_url = "https://auth.example.com/oauth2/introspect" authorization_value = "Bearer your-token-here" validated_token_ttl = 600 skip_client_id_validation = true expose_headers = false } order = 1 } ``` ### [](#required-arguments-53)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Token introspection configuration.. ### [](#optional-arguments-53)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-53)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-48)Nested Schema for `configuration` - `introspection_url` - (Required) URL of the OAuth 2.0 token introspection endpoint. - `authorization_value` - (Required) Authorization header value for the introspection request. - `authentication_timeout` - Authentication request timeout in milliseconds. - `consumer_by` - How to identify the API consumer (for example, `client_id`). - `expose_headers` - Whether to expose rate-limit headers in the response. - `max_cache_entries` - Maximum number of entries in the token cache. - `scope_validation_criteria` - How scopes are validated (`AND` or `OR`). - `skip_client_id_validation` - Whether to skip client ID validation. - `validated_token_ttl` - TTL in seconds for validated token cache entries. ### [](#pointcut-data-53)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-53)Import An existing `anypoint_api_policy_oauth2_token_introspection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-53)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_oauth2_token_introspection.imported id = "///" } resource "anypoint_api_policy_oauth2_token_introspection" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-53)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_oauth2_token_introspection.imported /// ``` ## [](#anypoint_api_policy_openai_transcoding_policy)`anypoint_api_policy_openai_transcoding_policy` Use the `anypoint_api_policy_openai_transcoding_policy` resource to configure OpenAI as the LLM provider for an Anypoint API instance, handling request and response transcoding.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-54)Example Usage ```hcl resource "anypoint_api_policy_openai_transcoding_policy" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { api_key = "sk-xxxxxxxxxxxx" timeout = 30000 } upstream_ids = [anypoint_api_upstream.example.id] } ``` ### [](#required-arguments-54)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) OpenAI connection configuration.. - `upstream_ids` - (Required, List of String) Upstream IDs this policy applies to. - `pointcut_data` - Pointcut definition as a JSON string.. ### [](#optional-arguments-54)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `asset_version` - The policy asset version. Defaults to `1.0.0`. ### [](#read-only-attributes-54)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-49)Nested Schema for `configuration` - `api_key` - (Required) API key for the OpenAI LLM provider. - `model_mapper` - (Dynamic) Array of model name mappings. - `timeout` - Request timeout in milliseconds. ### [](#pointcut-data-54)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-54)Import An existing `anypoint_api_policy_openai_transcoding_policy` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-54)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_openai_transcoding_policy.imported id = "///" } resource "anypoint_api_policy_openai_transcoding_policy" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-54)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_openai_transcoding_policy.imported /// ``` ## [](#anypoint_api_policy_semantic_prompt_guard_policy_openai)`anypoint_api_policy_semantic_prompt_guard_policy_openai` Use the `anypoint_api_policy_semantic_prompt_guard_policy_openai` resource to block prompts that semantically match denied topics using OpenAI embeddings on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-55)Example Usage ```hcl resource "anypoint_api_policy_semantic_prompt_guard_policy_openai" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { openai_url = "https://api.openai.com/v1" openai_api_key = "sk-xxxxxxxxxxxx" openai_embedding_model = "text-embedding-ada-002" timeout = 5000 deny_topics = [ { topic = "harmful content" description = "Block harmful content generation" } ] } order = 1 } ``` ### [](#required-arguments-55)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Prompt guard configuration.. ### [](#optional-arguments-55)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260130084752`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-55)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-50)Nested Schema for `configuration` - `deny_topics` - (Required, Dynamic) Array of topics to deny in prompt guard evaluation. - `openai_api_key` - (Required) API key for the OpenAI service. - `openai_url` - (Required) URL of the OpenAI API. - `openai_embedding_model` - The OpenAI embedding model to use. - `threshold` - (Dynamic) Threshold configuration object for similarity scoring. - `timeout` - Timeout value in milliseconds. ### [](#pointcut-data-55)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-55)Import An existing `anypoint_api_policy_semantic_prompt_guard_policy_openai` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-55)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_semantic_prompt_guard_policy_openai.imported id = "///" } resource "anypoint_api_policy_semantic_prompt_guard_policy_openai" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-55)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_semantic_prompt_guard_policy_openai.imported /// ``` ## [](#anypoint_api_policy_semantic_routing_policy_huggingface)`anypoint_api_policy_semantic_routing_policy_huggingface` Use the `anypoint_api_policy_semantic_routing_policy_huggingface` resource to route requests to different upstreams based on semantic similarity using HuggingFace embeddings on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-56)Example Usage ```hcl resource "anypoint_api_policy_semantic_routing_policy_huggingface" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { huggingface_url = "https://api-inference.huggingface.co/models/sentence-transformers/all-MiniLM-L6-v2" huggingface_api_key = "hf_xxxxxxxxxxxx" timeout = 5000 routes = [ { description = "Route for customer queries" upstream_id = "upstream-1" } ] } order = 1 } ``` ### [](#required-arguments-56)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Semantic routing configuration.. ### [](#optional-arguments-56)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260130095514`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-56)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-51)Nested Schema for `configuration` - `huggingface_api_key` - (Required) API key for the HuggingFace service. - `huggingface_url` - (Required) URL of the HuggingFace inference API. - `routes` - (Required, Dynamic) Array of routing rules. - `fallback_route` - (Dynamic) Fallback route configuration when no semantic match is found. - `threshold` - (Dynamic) Threshold configuration object for similarity scoring. - `timeout` - Timeout value in milliseconds. ### [](#pointcut-data-56)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-56)Import An existing `anypoint_api_policy_semantic_routing_policy_huggingface` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-56)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_semantic_routing_policy_huggingface.imported id = "///" } resource "anypoint_api_policy_semantic_routing_policy_huggingface" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-56)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_semantic_routing_policy_huggingface.imported /// ``` ## [](#anypoint_api_policy_rate_limiting)`anypoint_api_policy_rate_limiting` Use the `anypoint_api_policy_rate_limiting` resource to limit the number of requests an API instance accepts within a configurable time window.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-57)Example Usage ```hcl resource "anypoint_api_policy_rate_limiting" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { rate_limits = [ { maximum_requests = 100 time_period_in_milliseconds = 60000 } ] expose_headers = false clusterizable = true } order = 1 } ``` ### [](#required-arguments-57)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Rate limit configuration.. ### [](#optional-arguments-57)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.4.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-57)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-52)Nested Schema for `configuration` - `rate_limits` - (Required, Dynamic) Array of rate limit rules with `maximum_requests` and `time_period_in_milliseconds`. - `key_selector` - Expression to extract the rate limit key from the request. - `expose_headers` - Whether to expose rate-limit headers in the response. - `clusterizable` - Whether rate limit counters are shared across a cluster. ### [](#pointcut-data-57)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-57)Import An existing `anypoint_api_policy_rate_limiting` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-57)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_rate_limiting.imported id = "///" } resource "anypoint_api_policy_rate_limiting" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-57)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_rate_limiting.imported /// ``` ## [](#anypoint_api_policy_rate_limiting_sla_based)`anypoint_api_policy_rate_limiting_sla_based` Use the `anypoint_api_policy_rate_limiting_sla_based` resource to enforce rate limits based on client SLA tiers on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-58)Example Usage ```hcl resource "anypoint_api_policy_rate_limiting_sla_based" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { client_id_expression = "#[attributes.headers['client_id']]" client_secret_expression = "#[attributes.headers['client_secret']]" expose_headers = false clusterizable = true } order = 1 } ``` ### [](#required-arguments-58)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) SLA-based rate limit configuration.. ### [](#optional-arguments-58)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.3.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-58)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-53)Nested Schema for `configuration` - `client_id_expression` - DataWeave expression to extract the client ID from the request. - `client_secret_expression` - DataWeave expression to extract the client secret from the request. - `expose_headers` - Whether to expose rate-limit headers in the response. - `clusterizable` - Whether rate limit counters are shared across a cluster. ### [](#pointcut-data-58)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-58)Import An existing `anypoint_api_policy_rate_limiting_sla_based` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-58)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_rate_limiting_sla_based.imported id = "///" } resource "anypoint_api_policy_rate_limiting_sla_based" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-58)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_rate_limiting_sla_based.imported /// ``` ## [](#anypoint_api_policy_response_timeout)`anypoint_api_policy_response_timeout` Use the `anypoint_api_policy_response_timeout` resource to enforce a maximum response time on upstream requests from an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-59)Example Usage ```hcl resource "anypoint_api_policy_response_timeout" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { timeout = 30000 } order = 1 } ``` ### [](#required-arguments-59)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Timeout configuration.. ### [](#optional-arguments-59)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-59)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-54)Nested Schema for `configuration` - `timeout` - (Required) Response timeout in milliseconds. ### [](#pointcut-data-59)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-59)Import An existing `anypoint_api_policy_response_timeout` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-59)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_response_timeout.imported id = "///" } resource "anypoint_api_policy_response_timeout" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-59)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_response_timeout.imported /// ``` ## [](#anypoint_api_policy_script_evaluation_transformation)`anypoint_api_policy_script_evaluation_transformation` Use the `anypoint_api_policy_script_evaluation_transformation` resource to evaluate and transform request or response payloads using a DataWeave script on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-60)Example Usage ```hcl resource "anypoint_api_policy_script_evaluation_transformation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { script = "%%dw 2.0\noutput application/json\n---\npayload" requires_payload = false request_flow = "request" } order = 1 } ``` ### [](#required-arguments-60)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Script configuration.. ### [](#optional-arguments-60)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.0-20260127.133315`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-60)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-55)Nested Schema for `configuration` - `script` - (Required) The DataWeave transformation script. - `request_flow` - Which flow to apply the transformation to (`request` or `response`). - `requires_payload` - Whether the script requires access to the payload. ### [](#pointcut-data-60)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-60)Import An existing `anypoint_api_policy_script_evaluation_transformation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-60)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_script_evaluation_transformation.imported id = "///" } resource "anypoint_api_policy_script_evaluation_transformation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-60)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_script_evaluation_transformation.imported /// ``` ## [](#anypoint_api_policy_sse_logging)`anypoint_api_policy_sse_logging` Use the `anypoint_api_policy_sse_logging` resource to log Server-Sent Events (SSE) traffic on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-61)Example Usage ```hcl resource "anypoint_api_policy_sse_logging" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { logs = [ { message = "#[payload]" level = "INFO" } ] } order = 1 } ``` ### [](#required-arguments-61)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) SSE logging configuration.. ### [](#optional-arguments-61)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-61)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-56)Nested Schema for `configuration` - `logs` - (Required, Dynamic) Array of log entry configurations. ### [](#pointcut-data-61)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-61)Import An existing `anypoint_api_policy_sse_logging` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-61)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_sse_logging.imported id = "///" } resource "anypoint_api_policy_sse_logging" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-61)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_sse_logging.imported /// ``` ## [](#anypoint_api_policy_spec_validation)`anypoint_api_policy_spec_validation` Use the `anypoint_api_policy_spec_validation` resource to validate incoming requests against the API specification on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-62)Example Usage ```hcl resource "anypoint_api_policy_spec_validation" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { block_operation = true strict_params_validation = true } order = 1 } ``` ### [](#required-arguments-62)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Spec validation configuration.. ### [](#optional-arguments-62)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-62)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-57)Nested Schema for `configuration` - `block_operation` - Whether to block operations not defined in the API spec. - `strict_params_validation` - Whether to strictly validate query and header parameters. ### [](#pointcut-data-62)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-62)Import An existing `anypoint_api_policy_spec_validation` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-62)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_spec_validation.imported id = "///" } resource "anypoint_api_policy_spec_validation" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-62)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_spec_validation.imported /// ``` ## [](#anypoint_api_policy_spike_control)`anypoint_api_policy_spike_control` Use the `anypoint_api_policy_spike_control` resource to queue and throttle traffic spikes on an Anypoint API instance, delaying excess requests instead of rejecting them immediately.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-63)Example Usage ```hcl resource "anypoint_api_policy_spike_control" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { maximum_requests = 100 time_period_in_milliseconds = 1000 delay_time_in_millis = 500 delay_attempts = 3 queuing_limit = 5 expose_headers = false } order = 1 } ``` ### [](#required-arguments-63)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Spike control configuration.. ### [](#optional-arguments-63)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.2.2`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-63)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-58)Nested Schema for `configuration` - `maximum_requests` - (Required) Maximum number of requests allowed in the time period. - `time_period_in_milliseconds` - (Required) The time period in milliseconds for the spike control window. - `delay_time_in_millis` - (Required) The delay in milliseconds before retrying queued requests. - `delay_attempts` - (Required) The number of retry attempts before rejecting a queued request. - `queuing_limit` - Maximum number of requests that can be queued. - `expose_headers` - Whether to expose rate-limit headers in the response. ### [](#pointcut-data-63)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-63)Import An existing `anypoint_api_policy_spike_control` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-63)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_spike_control.imported id = "///" } resource "anypoint_api_policy_spike_control" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-63)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_spike_control.imported /// ``` ## [](#anypoint_api_policy_stream_idle_timeout)`anypoint_api_policy_stream_idle_timeout` Use the `anypoint_api_policy_stream_idle_timeout` resource to close idle SSE or streaming connections after a configurable period on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-64)Example Usage ```hcl resource "anypoint_api_policy_stream_idle_timeout" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { timeout = 30000 } order = 1 } ``` ### [](#required-arguments-64)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Timeout configuration.. ### [](#optional-arguments-64)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.0.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-64)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-59)Nested Schema for `configuration` - `timeout` - (Required) Stream idle timeout in milliseconds. ### [](#pointcut-data-64)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-64)Import An existing `anypoint_api_policy_stream_idle_timeout` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-64)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_stream_idle_timeout.imported id = "///" } resource "anypoint_api_policy_stream_idle_timeout" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-64)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_stream_idle_timeout.imported /// ``` ## [](#anypoint_api_policy_tracing)`anypoint_api_policy_tracing` Use the `anypoint_api_policy_tracing` resource to instrument distributed tracing on an Anypoint API instance.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-65)Example Usage ```hcl resource "anypoint_api_policy_tracing" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { span_name = "api-request" sampling = { probability = 0.1 } labels = [] } order = 1 } ``` ### [](#required-arguments-65)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) Tracing configuration.. ### [](#optional-arguments-65)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.1.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-65)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-60)Nested Schema for `configuration` - `span_name` - Custom name for the tracing span. - `sampling` - (Dynamic) Tracing sampling configuration object. - `labels` - (Dynamic) Array of custom labels to attach to traces. ### [](#pointcut-data-65)Pointcut Data Use `pointcut_data` to scope this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-65)Import An existing `anypoint_api_policy_tracing` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-65)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_tracing.imported id = "///" } resource "anypoint_api_policy_tracing" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-65)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_tracing.imported /// ``` ## [](#anypoint_api_policy_xml_threat_protection)`anypoint_api_policy_xml_threat_protection` Use the `anypoint_api_policy_xml_threat_protection` resource to protect an Anypoint API instance against malicious XML payloads by enforcing structural limits.

This policy is only supported on mule4 API instances.

Connected App: This resource requires a standard connected app (client credentials). An admin connected app isn’t needed. The connected app must have relevant scopes.
### [](#example-usage-66)Example Usage ```hcl resource "anypoint_api_policy_xml_threat_protection" "example" { organization_id = var.organization_id environment_id = var.environment_id api_instance_id = anypoint_api_instance.example.id configuration = { max_node_depth = 10 max_attribute_count_per_element = 10 max_child_count = 50 max_text_length = 256 max_attribute_length = 128 max_comment_length = 128 } order = 1 } ``` ### [](#required-arguments-66)Required Arguments - `environment_id` - ID of the environment where the API instance lives. - `api_instance_id` - ID of the API instance this policy is applied to. - `configuration` - (Block) XML structural limits.. ### [](#optional-arguments-66)Optional Arguments - `organization_id` - Organization ID. If omitted, defaults to the organization of the connected app. - `label` - A human-readable label for this policy instance. - `order` - Execution order relative to other policies. Lower numbers run first. - `asset_version` - The policy asset version. Defaults to `1.2.1`. - `disabled` - Whether the policy is disabled. Defaults to `false`. - `upstream_ids` - (List of String) Upstream IDs this policy applies to. When omitted, applies to all upstreams. - `pointcut_data` - Scope the policy to specific HTTP methods and URI patterns as a JSON string. When `null`, the policy applies to all resources. Use `jsonencode()` to set this.. ### [](#read-only-attributes-66)Read-Only Attributes - `id` - The policy ID. - `policy_template_id` - Policy template ID assigned by the platform. ### [](#nested-schema-for-configuration-61)Nested Schema for `configuration` - `max_node_depth` - Maximum XML node nesting depth. - `max_attribute_count_per_element` - Maximum number of attributes per XML element. - `max_child_count` - Maximum number of child elements per XML node. - `max_text_length` - Maximum length for XML text nodes. - `max_attribute_length` - Maximum length for XML attribute values. - `max_comment_length` - Maximum length for XML comments. ### [](#pointcut-data-66)Pointcut Data Use `pointcut_data` to limit this policy to specific request methods and URI patterns. This mirrors the "Apply configurations to specific methods & resources" option in the Anypoint Platform UI. Each array element defines one condition: - `methodRegex` — pipe-separated HTTP methods (for example, `GET`, `GET|POST`). Omit or set to `.*` to match all methods. - `uriTemplateRegex` — regex for the URI path (for example, `/api/v1/.`**). Omit or set to `.`** to match all paths. Multiple conditions are evaluated as a logical OR. ```hcl # Apply policy to GET and POST requests on /api/v1/* only pointcut_data = jsonencode([ { methodRegex = "GET|POST" uriTemplateRegex = "/api/v1/.*" } ]) # Multiple conditions pointcut_data = jsonencode([ { methodRegex = "GET" uriTemplateRegex = "/api/v1/read/.*" }, { methodRegex = "POST|PUT" uriTemplateRegex = "/api/v1/write/.*" } ]) ``` ### [](#import-66)Import An existing `anypoint_api_policy_xml_threat_protection` policy can be imported using its composite ID: `organization_id/environment_id/api_instance_id/policy_id`. The `policy_id` is the numeric ID of the policy, visible in Anypoint API Manager or from the API response. #### [](#using-an-import-block-terraform-1-5-recommended-66)Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_api_policy_xml_threat_protection.imported id = "///" } resource "anypoint_api_policy_xml_threat_protection" "imported" { organization_id = "" environment_id = "" api_instance_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### [](#using-the-cli-deprecated-terraform-1-5-66)Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_api_policy_xml_threat_protection.imported /// ``` --- product: MuleSoft Terraform Provider --- # CloudHub 2.0 Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use CloudHub 2.0 resources to manage private spaces, network configuration, TLS contexts, VPN connections, and related infrastructure components. These resources help you provision and manage CloudHub 2.0 infrastructure declaratively with Terraform. ## `anypoint_private_space_config` Use the `anypoint_private_space_config` resource to manage a CloudHub 2.0 private space together with its network configuration and firewall rules as a single composite resource. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. ### Example Usage #### Minimal (space only, no network) ```hcl resource "anypoint_private_space_config" "example" { name = "my-private-space" } ``` #### Basic (space + network) ```hcl resource "anypoint_private_space_config" "example" { name = "my-private-space" organization_id = var.organization_id enable_egress = true network { region = "us-east-1" cidr_block = "10.0.0.0/22" } } ``` #### Full (space + network + firewall rules) ```hcl resource "anypoint_private_space_config" "example" { name = "my-private-space" organization_id = var.organization_id enable_egress = true enable_iam_role = false network { region = "us-east-1" cidr_block = "10.0.0.0/22" reserved_cidrs = ["10.0.3.0/24"] } firewall_rules = [ { cidr_block = "0.0.0.0/0" protocol = "tcp" from_port = 30500 to_port = 32500 type = "inbound" }, { cidr_block = "0.0.0.0/0" protocol = "tcp" from_port = 0 to_port = 65535 type = "outbound" }, ] } output "private_space_id" { value = anypoint_private_space_config.example.id } output "network_dns_target" { value = anypoint_private_space_config.example.network.dns_target } output "inbound_static_ips" { value = anypoint_private_space_config.example.network.inbound_static_ips } ``` ### Required Arguments - `name` - The name of the private space. ### Optional Arguments - `organization_id` - Organization ID where the private space will be created. Defaults to the provider organization. - `enable_egress` - Whether to enable egress for the private space. Defaults to `false`. - `enable_iam_role` - Whether to enable IAM role for the private space. Defaults to `false`. - `firewall_rules` - (List of Object) Firewall rules for the private space. Omit to use platform-managed default rules. - `cidr_block` - (Required) The CIDR block for the firewall rule. - `protocol` - (Required) The protocol (`tcp`, `udp`, `icmp`). - `from_port` - (Required) The starting port. - `to_port` - (Required) The ending port. - `type` - (Required) The rule direction (`inbound` or `outbound`). - `network` - (Block) Network configuration for the private space. Omit to create the space without a network. - `region` - The AWS region for the private network. Forces replacement if changed. - `cidr_block` - The CIDR block for the private network. Forces replacement if changed. - `reserved_cidrs` - (List of String) Reserved CIDR blocks for the private network. ### Read-Only Attributes - `id` - The unique identifier for the private space. - `status` - The current status of the private space (for example, `Running`, `Provisioning`). - `root_organization_id` - The root organization ID of the private space. - `mule_app_deployment_count` - The number of Mule apps currently deployed in the private space. - `days_left_for_relaxed_quota` - The number of days left for the relaxed deployment quota. - `vpc_migration_in_progress` - Whether a VPC migration is currently in progress. - `managed_firewall_rules` - (List of String) Platform-managed firewall rule identifiers. - `global_space_status` - (Map of String) Per-region global space status details. Within the `network` block: - `inbound_static_ips` - (List of String) Inbound static IPs assigned to the private network. - `inbound_internal_static_ips` - (List of String) Inbound internal static IPs assigned to the private network. - `outbound_static_ips` - (List of String) Outbound static IPs assigned to the private network. - `dns_target` - The DNS target hostname for the private network. ### Import An existing private space configuration can be imported using its private space ID (UUID). Use the simple ID for root-org private spaces, or `/` for Business Groups. After import, run `terraform plan` to verify the state matches the actual configuration. The imported state captures all network and firewall settings from the platform. #### Using an import block (Terraform ≥ 1.5 — recommended) Root org: ```hcl import { to = anypoint_private_space_config.imported id = "" } resource "anypoint_private_space_config" "imported" { name = "" } ``` Sub-org (Business Group): ```hcl import { to = anypoint_private_space_config.imported id = "/" } resource "anypoint_private_space_config" "imported" { name = "" organization_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_private_space_config.imported # Sub-org: terraform import anypoint_private_space_config.imported / ``` ## `anypoint_private_space_association` Use the `anypoint_private_space_association` resource to create and manage associations between a CloudHub 2.0 private space and environments. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. ### Example Usage ```hcl resource "anypoint_private_space_association" "example" { private_space_id = var.private_space_id associations = [ { organization_id = "080f1918-0096-4cac-85b5-b1cd9cdf9260" environment = "all" } ] } ``` ### Required Arguments - `private_space_id` - The ID of the private space. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `associations` - (Block List) List of associations to create between the private space and environments. When omitted, the provider reads the existing associations from the API and populates this field automatically.. ### Read-Only Attributes - `id` - The unique identifier for the Private Space Association resource. - `created_associations` - (Block List) List of associations read from the Anypoint Platform API after apply or import.. ### Nested Schema for `associations` - `organization_id` - (Required) The organization ID for the association. - `environment` - (Required) The environment for the association. Valid values: an environment UUID, `all`, `production`, or `sandbox`. ### Nested Schema for `created_associations` - `id` - The ID of the created association. - `organization_id` - The organization ID of the association. - `environment` - The environment of the association. ### Import An existing private space association can be imported using the private space ID, or a composite `/` when the private space belongs to a Business Group (sub-org). #### Using an import block (Terraform ≥ 1.5 — recommended) Root org (simple ID): ```hcl import { to = anypoint_private_space_association.imported id = "" } resource "anypoint_private_space_association" "imported" { private_space_id = "" organization_id = "" } ``` Sub-org (composite ID): ```hcl import { to = anypoint_private_space_association.imported id = "/" } resource "anypoint_private_space_association" "imported" { private_space_id = "" organization_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_private_space_association.imported # Sub-org: terraform import anypoint_private_space_association.imported / ``` ## `anypoint_private_space_upgrade` Use the `anypoint_private_space_upgrade` resource to schedule an upgrade for a CloudHub 2.0 private space. Deleting this resource cancels the scheduled upgrade. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. ### Example Usage ```hcl resource "anypoint_private_space_upgrade" "example" { private_space_id = var.private_space_id organization_id = var.organization_id date = "2025-09-12" opt_in = true } ``` ### Required Arguments - `private_space_id` - The ID of the private space to upgrade. - `date` - The date when the upgrade should be scheduled (format: `YYYY-MM-DD`). - `opt_in` - Whether to opt in to the upgrade. ### Optional Arguments - `organization_id` - Organization ID where the private space is located. If not provided, the organization ID is inferred from the connected app credentials. ### Read-Only Attributes - `id` - The unique identifier for the upgrade operation. - `scheduled_update_time` - The scheduled update time returned by the API. - `status` - The status of the upgrade operation. ### Import An existing scheduled upgrade can be imported using a composite ID. Use the 3-part form for root-org private spaces and the 4-part form when the private space belongs to a Business Group (sub-org). #### Using an import block (Terraform ≥ 1.5 — recommended) Root org (3-part ID): ```hcl import { to = anypoint_private_space_upgrade.imported id = "::" } resource "anypoint_private_space_upgrade" "imported" { private_space_id = "" date = "" opt_in = true } ``` Sub-org (4-part ID): ```hcl import { to = anypoint_private_space_upgrade.imported id = ":::" } resource "anypoint_private_space_upgrade" "imported" { private_space_id = "" organization_id = "" date = "" opt_in = true } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_private_space_upgrade.imported :: # Sub-org: terraform import anypoint_private_space_upgrade.imported ::: ``` ## `anypoint_privatespace_advanced_config` Use the `anypoint_privatespace_advanced_config` resource to manage advanced configuration for an Anypoint Private Space, including ingress settings and IAM role configuration. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. ### Example Usage ```hcl resource "anypoint_privatespace_advanced_config" "example" { private_space_id = var.private_space_id ingress_configuration = { read_response_timeout = "600" protocol = "https-redirect" logs = { port_log_level = "INFO" filters = [] } deployment = { status = "APPLIED" last_seen_timestamp = 1753719215000 } } enable_iam_role = true } ``` ### Required Arguments - `private_space_id` - The ID of the private space to configure. ### Optional Arguments - `organization_id` - Organization ID where the private space is located. If not provided, the organization ID is inferred from the connected app credentials. - `ingress_configuration` - (Block) Ingress configuration for the private space.. - `enable_iam_role` - Whether to enable IAM role for the private space. Defaults to `false`. ### Read-Only Attributes - `id` - The unique identifier of the advanced configuration. ### Nested Schema for `ingress_configuration` - `read_response_timeout` - Read response timeout in seconds. Defaults to `"300"`. - `protocol` - Protocol for ingress configuration. Defaults to `"https-redirect"`. - `logs` - (Block) Logs configuration for ingress.. - `deployment` - (Block) Deployment configuration for ingress.. ### Nested Schema for `ingress_configuration.logs` - `port_log_level` - Port log level. Defaults to `"ERROR"`. - `filters` - (Block List) List of log filters. Defaults to `[]`. - `ip` - (Required) IP address for the filter. - `level` - (Required) Log level for the filter. ### Nested Schema for `ingress_configuration.deployment` - `status` - Deployment status. Defaults to `"APPLIED"`. - `last_seen_timestamp` - Last seen timestamp. ### Import An existing private space advanced configuration can be imported using its private space ID (UUID). Use the simple ID for root-org private spaces, or `/` for Business Groups. #### Using an import block (Terraform ≥ 1.5 — recommended) Root org: ```hcl import { to = anypoint_privatespace_advanced_config.imported id = "" } resource "anypoint_privatespace_advanced_config" "imported" { private_space_id = "" } ``` Sub-org (Business Group): ```hcl import { to = anypoint_privatespace_advanced_config.imported id = "/" } resource "anypoint_privatespace_advanced_config" "imported" { private_space_id = "" organization_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_privatespace_advanced_config.imported # Sub-org: terraform import anypoint_privatespace_advanced_config.imported / ``` ## `anypoint_tls_context` Use the `anypoint_tls_context` resource to manage a CloudHub 2.0 TLS context with support for both PEM and JKS keystores. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. ### Example Usage #### PEM keystore ```hcl resource "anypoint_tls_context" "pem_example" { private_space_id = "your-private-space-id" name = "example-pem-tls-context" keystore_type = "PEM" certificate = file("cert.pem") key = file("key.pem") key_filename = "key.pem" certificate_filename = "cert.pem" ciphers = { aes128_gcm_sha256 = true aes128_sha256 = false aes256_gcm_sha384 = false aes256_sha256 = false dhe_rsa_aes128_sha256 = false dhe_rsa_aes256_gcm_sha384 = false dhe_rsa_aes256_sha256 = false ecdhe_ecdsa_aes128_gcm_sha256 = true ecdhe_ecdsa_aes256_gcm_sha384 = true ecdhe_rsa_aes128_gcm_sha256 = true ecdhe_rsa_aes256_gcm_sha384 = true ecdhe_ecdsa_chacha20_poly1305 = false ecdhe_rsa_chacha20_poly1305 = false dhe_rsa_chacha20_poly1305 = false tls_aes256_gcm_sha384 = true tls_chacha20_poly1305_sha256 = true tls_aes128_gcm_sha256 = true } } ``` #### JKS keystore ```hcl resource "anypoint_tls_context" "jks_example" { private_space_id = "your-private-space-id" name = "example-jks-tls-context" keystore_type = "JKS" keystore_base64 = var.jks_keystore_base64 store_passphrase = var.jks_store_passphrase key_passphrase = var.jks_key_passphrase alias = "my-alias" keystore_filename = "keystore.jks" ciphers = { aes128_gcm_sha256 = false aes128_sha256 = false aes256_gcm_sha384 = true aes256_sha256 = false dhe_rsa_aes128_sha256 = false dhe_rsa_aes256_gcm_sha384 = false dhe_rsa_aes256_sha256 = false ecdhe_ecdsa_aes128_gcm_sha256 = false ecdhe_ecdsa_aes256_gcm_sha384 = true ecdhe_rsa_aes128_gcm_sha256 = false ecdhe_rsa_aes256_gcm_sha384 = true ecdhe_ecdsa_chacha20_poly1305 = false ecdhe_rsa_chacha20_poly1305 = false dhe_rsa_chacha20_poly1305 = false tls_aes256_gcm_sha384 = true tls_chacha20_poly1305_sha256 = false tls_aes128_gcm_sha256 = false } } ``` ### Required Arguments - `private_space_id` - The ID of the private space this TLS context belongs to. - `name` - The name of the TLS context. - `ciphers` - (Block) Cipher configuration for the TLS context.. ### Optional Arguments - `organization_id` - Organization ID where the private space is located. If not provided, the organization ID is inferred from the connected app credentials. - `keystore_type` - The type of keystore: `PEM` or `JKS`. Required when creating a new TLS context. Populated automatically on import from the API response. - `certificate` - _(Sensitive)_ PEM certificate content. Required for PEM keystore. - `key` - _(Sensitive)_ PEM private key content. Required for PEM keystore. - `key_filename` - Filename for the private key (PEM keystore). - `certificate_filename` - Filename for the certificate (PEM keystore). - `keystore_base64` - _(Sensitive)_ Base64-encoded JKS keystore content. Required for JKS keystore. - `store_passphrase` - _(Sensitive)_ Store passphrase for the JKS keystore. Required for JKS keystore. - `alias` - Alias for the JKS keystore. Required for JKS keystore. - `keystore_filename` - Filename for the JKS keystore. Required for JKS keystore. - `key_passphrase` - _(Sensitive)_ Passphrase for the private key. ### Read-Only Attributes - `id` - The unique identifier for the TLS context. - `type` - The type of TLS context. - `trust_store` - (Block) Trust store information.. - `key_store` - (Block) Key store information.. ### Nested Schema for `ciphers` - `aes128_gcm_sha256` - Enable AES128-GCM-SHA256. Defaults to `false`. - `aes128_sha256` - Enable AES128-SHA256. Defaults to `false`. - `aes256_gcm_sha384` - Enable AES256-GCM-SHA384. Defaults to `false`. - `aes256_sha256` - Enable AES256-SHA256. Defaults to `false`. - `dhe_rsa_aes128_sha256` - Enable DHE-RSA-AES128-SHA256. Defaults to `false`. - `dhe_rsa_aes256_gcm_sha384` - Enable DHE-RSA-AES256-GCM-SHA384. Defaults to `false`. - `dhe_rsa_aes256_sha256` - Enable DHE-RSA-AES256-SHA256. Defaults to `false`. - `ecdhe_ecdsa_aes128_gcm_sha256` - Enable ECDHE-ECDSA-AES128-GCM-SHA256. Defaults to `false`. - `ecdhe_ecdsa_aes256_gcm_sha384` - Enable ECDHE-ECDSA-AES256-GCM-SHA384. Defaults to `false`. - `ecdhe_rsa_aes128_gcm_sha256` - Enable ECDHE-RSA-AES128-GCM-SHA256. Defaults to `false`. - `ecdhe_rsa_aes256_gcm_sha384` - Enable ECDHE-RSA-AES256-GCM-SHA384. Defaults to `false`. - `ecdhe_ecdsa_chacha20_poly1305` - Enable ECDHE-ECDSA-CHACHA20-POLY1305. Defaults to `false`. - `ecdhe_rsa_chacha20_poly1305` - Enable ECDHE-RSA-CHACHA20-POLY1305. Defaults to `false`. - `dhe_rsa_chacha20_poly1305` - Enable DHE-RSA-CHACHA20-POLY1305. Defaults to `false`. - `tls_aes256_gcm_sha384` - Enable TLS-AES256-GCM-SHA384. Defaults to `false`. - `tls_chacha20_poly1305_sha256` - Enable TLS-CHACHA20-POLY1305-SHA256. Defaults to `false`. - `tls_aes128_gcm_sha256` - Enable TLS-AES128-GCM-SHA256. Defaults to `false`. ### Nested Schema for `trust_store` - `filename` - Trust store filename. - `expiration_date` - Trust store expiration date. - `type` - Trust store type. ### Nested Schema for `key_store` - `filename` - Key store filename. - `type` - Key store type. - `cn` - Common name from the certificate. - `san` - (List of String) Subject alternative names. - `expiration_date` - Key store expiration date. ### Import An existing TLS context can be imported using a composite ID. Use the 2-part form for root-org private spaces and the 3-part form for Business Groups. #### Using an import block (Terraform ≥ 1.5 — recommended) Root org (2-part ID): ```hcl import { to = anypoint_tls_context.imported id = ":" } resource "anypoint_tls_context" "imported" { private_space_id = "" organization_id = "" name = "" # keystore_type is populated automatically from the API response on import } ``` Sub-org (3-part ID): ```hcl import { to = anypoint_tls_context.imported id = "::" } resource "anypoint_tls_context" "imported" { private_space_id = "" organization_id = "" name = "" keystore_type = "PEM" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_tls_context.imported : # Sub-org: terraform import anypoint_tls_context.imported :: ``` ## `anypoint_vpn_connection` Use the `anypoint_vpn_connection` resource to create a VPN connection in a CloudHub 2.0 private space. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. ### Example Usage ```hcl resource "anypoint_vpn_connection" "example" { private_space_id = anypoint_private_space.example.id name = "my-vpn-connection" vpns = [ { local_asn = "64512" remote_asn = "65534" remote_ip_address = "203.0.113.1" static_routes = [] vpn_tunnels = [ { psk = "my-pre-shared-key-1" ptp_cidr = "169.254.10.0/30" startup_action = "start" } ] } ] } ``` ### Required Arguments - `private_space_id` - The ID of the private space. - `name` - The name of the VPN connection. - `vpns` - (Block List) List of VPN configurations.. ### Optional Arguments - `organization_id` - Organization ID where the private space is located. If not provided, the organization ID is inferred from the connected app credentials. ### Read-Only Attributes - `id` - The unique identifier for the VPN connection. ### Nested Schema for `vpns` - `local_asn` - (Required) Local ASN for the VPN. - `remote_asn` - (Required) Remote ASN for the VPN. - `remote_ip_address` - (Required) Remote IP address for the VPN. - `vpn_tunnels` - (Required, Block List) List of VPN tunnel configurations.. - `name` - The name of the VPN. - `static_routes` - (List of String) List of static routes. - `connection_name` - The connection name of the VPN. _(Read-Only)_ - `vpn_connection_status` - The status of the VPN connection. _(Read-Only)_ - `vpn_id` - The ID of the VPN. _(Read-Only)_ - `connection_id` - The connection ID of the VPN. _(Read-Only)_ ### Nested Schema for `vpns.vpn_tunnels` - `psk` - (Required) Pre-shared key for the VPN tunnel. - `startup_action` - (Required) Startup action for the VPN tunnel. - `ptp_cidr` - Point-to-point CIDR for the VPN tunnel. - `is_logs_enabled` - Whether logs are enabled for the VPN tunnel. _(Read-Only)_ ### Import An existing VPN connection can be imported using a composite ID. Use the 2-part form for root-org private spaces and the 3-part form for Business Groups. #### Using an import block (Terraform ≥ 1.5 — recommended) Root org (2-part ID): ```hcl import { to = anypoint_vpn_connection.imported id = "/" } resource "anypoint_vpn_connection" "imported" { private_space_id = "" organization_id = "" name = "" vpns = [] } ``` Sub-org (3-part ID): ```hcl import { to = anypoint_vpn_connection.imported id = "//" } resource "anypoint_vpn_connection" "imported" { private_space_id = "" organization_id = "" name = "" vpns = [] } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_vpn_connection.imported / # Sub-org: terraform import anypoint_vpn_connection.imported // ``` --- product: MuleSoft Terraform Provider --- # How the Provider Works > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The MuleSoft Terraform provider manages MuleSoft Platform resources using a declarative Infrastructure as Code (IaC) model. The following concepts explain how the provider provisions and manages resources across the MuleSoft Platform. ## Declarative Configuration With Terraform, you define the desired state of your MuleSoft Platform resources in Terraform configuration files. Terraform compares the desired state with the current platform configuration and applies the required changes to reconcile both states. This approach helps maintain consistency across environments and supports version-controlled infrastructure management. ## Control Plane and Runtime Plane The provider manages resources across both the control plane and the runtime plane. The control plane includes resources such as: - API Manager - Access Management - Secrets Manager - MCP server and AI agent resources - Policies and governance configuration The runtime plane includes deployment and infrastructure resources such as: - CloudHub 2.0 private spaces - Managed Omni Gateway resources - Network configuration - VPN connections - TLS contexts This separation enables you to manage APIs, gateways, policies, and infrastructure resources independently from application implementations. ## Resource Management The provider manages resources declaratively through Terraform configuration files. When you apply a Terraform configuration: - Resources defined in the configuration are created or updated. - Resources removed from the configuration can be removed from the platform during reconciliation. - Changes made outside Terraform can be overwritten during future Terraform runs, depending on the resource behavior. ## API, MCP, and AI Agent Resources The provider supports multiple resource types across the MuleSoft Platform. Supported resources include: - API Manager resources - MCP server resources - AI agent resources - API, MCP, and A2A policies - CloudHub 2.0 infrastructure resources - Access Management resources - Secrets Manager resources These resources can be managed together as part of a unified Terraform workflow. ## Multi-Environment Configuration Terraform enables consistent configuration across environments such as development, staging, and production. You can reuse Terraform configurations across environments while reducing manual configuration drift and maintaining consistent platform configuration. ## See Also - [MuleSoft Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/) - [Install and Configure the Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/install-configure) - [Resources](https://docs.mulesoft.com/mulesoft-terraform-provider/resources) --- product: MuleSoft Terraform Provider --- # Install and Configure the Terraform Provider > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To use the MuleSoft Terraform provider, install the provider from the Terraform Registry and configure authentication for your MuleSoft Platform organization. The provider supports Terraform-based management for MuleSoft Platform resources, including CloudHub 2.0, API Manager, Access Management, Secrets Manager, MCP servers, and AI agent resources. ## Access the Provider in the Terraform Registry Go to the Terraform Registry and search for the MuleSoft Terraform provider. For provider installation instructions and the complete list of supported resources, see the [MuleSoft Terraform provider documentation](https://registry.terraform.io/providers/mulesoft/anypoint/latest/docs). ## Add the Provider Add the provider to your Terraform configuration file: ```hcl terraform { required_providers { anypoint = { source = "mulesoft/anypoint" version = "~> 1.0.0" } } } ``` > [!NOTE] Replace `1.0.0` with the latest version. See the > [MuleSoft Anypoint provider on the Terraform Registry](https://registry.terraform.io/providers/mulesoft/anypoint/latest) > for the current release. ## Initialize Terraform Run the following command to download and install the provider: ```bash terraform init ``` ## Configure Credentials The provider supports two types of connected apps depending on the resources you manage. ### Standard Connected App Most resources use a standard connected app (client credentials only): ```bash export TF_VAR_anypoint_client_id="" export TF_VAR_anypoint_client_secret="" export TF_VAR_anypoint_base_url="https://anypoint.mulesoft.com" ``` ### Admin Connected App Some resources require an admin connected app configured with user credentials. This is needed for resources that authenticate on behalf of a user: ```bash export TF_VAR_anypoint_admin_client_id="" export TF_VAR_anypoint_admin_client_secret="" export TF_VAR_anypoint_admin_username="" export TF_VAR_anypoint_admin_password="" export TF_VAR_anypoint_base_url="https://anypoint.mulesoft.com" ``` ## Configure the Provider Configure the provider using the authentication method required for your resources. ### Standard Connected App ```hcl provider "anypoint" { client_id = var.anypoint_client_id client_secret = var.anypoint_client_secret base_url = var.anypoint_base_url } ``` ### Admin Connected App ```hcl provider "anypoint" { alias = "admin" username = var.anypoint_admin_username password = var.anypoint_admin_password client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret base_url = var.anypoint_base_url } ``` The provider also supports additional authentication methods, including access token authentication and control plane configuration. For the complete provider configuration reference, see the [MuleSoft Terraform provider documentation](https://registry.terraform.io/providers/mulesoft/anypoint/latest/docs). ## See Also - [MuleSoft Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/) - [How the Provider Works](https://docs.mulesoft.com/mulesoft-terraform-provider/how-provider-works) - [Resources](https://docs.mulesoft.com/mulesoft-terraform-provider/resources) --- product: MuleSoft Terraform Provider --- # Managed Omni Gateway Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Managed Omni Gateway resources to manage gateway instances deployed in CloudHub 2.0 private spaces. ## `anypoint_managed_omni_gateway` Use the `anypoint_managed_omni_gateway` resource to manage a CloudHub 2.0 Managed Omni Gateway instance in Anypoint Platform. > [!NOTE] **Supported gateway type:** This provider currently supports **MuleSoft Managed Omni > Gateway** (CloudHub 2.0) only. Self-managed Omni Gateway will be supported in a future release. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Tracing note:** The Gateway Manager API doesn’t echo back `configuration.tracing` in > POST/PUT responses. The provider retains the plan-requested value in state after create/update so > that `tracing.enabled = true` works correctly. On the next `terraform refresh` or `plan`, the > provider reads the live value from the API for accurate drift detection. ### Example Usage ```hcl resource "anypoint_managed_omni_gateway" "example" { name = "my-omni-gateway" environment_id = "env-id-here" target_id = "target-private-space-id" release_channel = "lts" size = "small" ingress = { forward_ssl_session = true last_mile_security = true } properties = { upstream_response_timeout = 15 connection_idle_timeout = 60 } logging = { level = "info" forward_logs = true } tracing = { enabled = false } } ``` ### Required Arguments - `name` - The name of the managed Omni Gateway. - `environment_id` - The environment ID where the gateway will be deployed. - `target_id` - The target (private space) ID for the gateway deployment. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `runtime_version` - The Omni Gateway runtime version (for example, `1.9.9`). If omitted, the provider auto-selects the latest version for the chosen `release_channel`. - `release_channel` - The release channel for the gateway. Valid values: `lts`, `edge`. Defaults to `lts`. - `size` - The size of the gateway instance. Valid values: `small`, `large`. Defaults to `small`. - `ingress` - (Block) Ingress configuration for the gateway.. - `properties` - (Block) Runtime properties for the gateway.. - `logging` - (Block) Logging configuration for the gateway.. - `tracing` - (Block) Distributed tracing configuration for the gateway.. ### Read-Only Attributes - `id` - The unique identifier of the managed Omni Gateway. - `status` - The current status of the managed Omni Gateway. ### Nested Schema for `ingress` - `public_url` - The public URL for the gateway ingress. Auto-derived from the target domain when empty. - `internal_url` - The internal URL for the gateway ingress. Auto-derived from the target domain when empty. - `forward_ssl_session` - Whether to forward SSL sessions to upstream services. Defaults to `true`. - `last_mile_security` - Whether to enable last-mile security (TLS between gateway and upstream). Defaults to `true`. ### Nested Schema for `properties` - `upstream_response_timeout` - Timeout in seconds for upstream service responses. Defaults to `15`. - `connection_idle_timeout` - Timeout in seconds for idle connections. Defaults to `60`. ### Nested Schema for `logging` - `level` - The log level. Valid values: `debug`, `info`, `warn`, `error`. Defaults to `info`. - `forward_logs` - Whether to forward logs to Anypoint Monitoring. Defaults to `true`. ### Nested Schema for `tracing` - `enabled` - Whether distributed tracing is enabled. Defaults to `false`. ### Import An existing Managed Omni Gateway can be imported using a composite ID. Use the 2-part form for root-org gateways and the 3-part form when the gateway belongs to a Business Group (sub-org). The `gateway_id` is the UUID of the gateway visible in Runtime Manager or the Gateway Manager API. #### Using an import block (Terraform ≥ 1.5 — recommended) Root org (2-part ID): ```hcl import { to = anypoint_managed_omni_gateway.imported id = "/" } resource "anypoint_managed_omni_gateway" "imported" { name = "" environment_id = "" target_id = "" } ``` Sub-org (3-part ID): ```hcl import { to = anypoint_managed_omni_gateway.imported id = "//" } resource "anypoint_managed_omni_gateway" "imported" { organization_id = "" name = "" environment_id = "" target_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell # Root org: terraform import anypoint_managed_omni_gateway.imported / # Sub-org: terraform import anypoint_managed_omni_gateway.imported // ``` --- product: MuleSoft Terraform Provider --- # MCP and AI Agent Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use these resources to manage MCP servers and AI agent resources. ## `anypoint_mcp_server` Use the `anypoint_mcp_server` resource to create and manage MCP servers in Anypoint API Manager. An MCP server represents an MCP server specification deployed to an Omni Gateway target with routing rules and upstream backends. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Status after create:** After a successful `terraform apply` the `status` field is > populated from a GET request made immediately after the POST. The platform typically returns > `status = "active"` right away. > [!NOTE] **`upstream_uri` vs `routing`:** `upstream_uri` and `routing` are mutually exclusive. Use > `upstream_uri` for a single upstream. Only one upstream per route is supported for MCP servers — > multi-upstream weighted routing isn’t available. > [!NOTE] **`upstream_id`:** The computed `upstream_id` attribute is the server-assigned ID for the > first upstream. Reference it in outbound policy `upstream_ids` to bind policies to this MCP > server’s upstream. ### Example Usage #### Basic MCP server with `upstream_uri` ```hcl resource "anypoint_mcp_server" "example" { organization_id = var.organization_id environment_id = var.environment_id technology = "omniGateway" instance_label = "atlassian-mcp-server" spec = { asset_id = "my-mcp-spec" group_id = var.organization_id version = "1.0.0" } endpoint = { deployment_type = "HY" base_path = "mcp1" } gateway_id = var.gateway_id upstream_uri = "http://example.com" } ``` #### MCP server with explicit routing ```hcl resource "anypoint_mcp_server" "advanced" { organization_id = var.organization_id environment_id = var.environment_id technology = "omniGateway" instance_label = "enterprise-tools-mcp" spec = { asset_id = "postman-mcp-server" group_id = var.organization_id version = "1.0.0" } endpoint = { deployment_type = "HY" base_path = "mcp-tools" } gateway_id = var.gateway_id routing = [ { upstreams = [ { weight = 100 uri = "http://mcp-tools.internal:8080" } ] } ] } ``` ### Required Arguments - `environment_id` - The environment ID where the MCP server will be created. - `spec` - (Block) The Exchange asset specification backing this MCP server.. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `technology` - The gateway technology. Only `omniGateway` is currently supported. Defaults to `omniGateway`. - `provider_id` - The identity provider ID for the MCP server. - `instance_label` - A human-readable label for this MCP server. - `approval_method` - Client approval method. Valid values: `manual`, `automatic`. Defaults to `null` (no approval required). - `consumer_endpoint` - Consumer-facing endpoint URI (the public URL clients use to reach the MCP server). For MCP, this is the proxy URI that clients connect to. - `upstream_uri` - Shorthand for a single-upstream routing configuration. Mutually exclusive with `routing`. - `gateway_id` - The Omni Gateway UUID. When provided, the deployment block is auto-populated from the Gateway Manager. Mutually exclusive with a full `deployment` block. - `endpoint` - (Block) Endpoint and proxy configuration.. - `deployment` - (Block) Deployment target configuration. Auto-populated when `gateway_id` is set.. - `routing` - (Block List) Routing rules with upstream backends. Mutually exclusive with `upstream_uri`.. ### Read-Only Attributes - `id` - The numeric identifier of the MCP server (stored as string for Terraform compatibility). - `status` - The current status of the MCP server. - `asset_id` - The Exchange asset ID (computed from MCP server response). - `asset_version` - The Exchange asset version (computed from MCP server response). - `product_version` - The product version (computed from MCP server response). - `upstream_id` - The server-assigned upstream ID for the first upstream. Use this to reference the upstream in outbound policy `upstream_ids`. ### Nested Schema for `spec` - `asset_id` - (Required) The Exchange asset ID. - `group_id` - (Required) The Exchange group (organization) ID. - `version` - (Required) The asset version. ### Nested Schema for `endpoint` - `deployment_type` - Deployment type. Valid values: `HY` (hybrid), `CH` (CloudHub), `RF` (Runtime Fabric). Defaults to `HY`. - `type` - Endpoint protocol type. For MCP servers, this is `mcp`. Defaults to `mcp`. - `base_path` - MCP server base path for Omni Gateway (for example, `my-mcp-server`). The provider constructs the proxy URI as `http://0.0.0.0:8081/`. - `uri` - Direct implementation URI. Mutually exclusive with `base_path`. - `response_timeout` - Response timeout in milliseconds. ### Nested Schema for `deployment` - `environment_id` - The environment ID for deployment (usually matches the top-level `environment_id`). - `type` - Deployment type. Valid values: `HY`, `CH`, `RF`. Defaults to `HY`. - `expected_status` - Expected deployment status. Valid values: `deployed`, `undeployed`. Defaults to `deployed`. - `overwrite` - Whether to overwrite an existing deployment. - `target_id` - The target gateway ID to deploy to. - `target_name` - The target gateway name. - `gateway_version` - The Omni Gateway runtime version. ### Nested Schema for `routing` - `upstreams` - (Required, Block List) Upstream backends for this route. For MCP servers, these are the actual MCP server implementation endpoints.. - `label` - A label for this route. - `rules` - (Block) Match conditions for this route.. ### Nested Schema for `routing.rules` - `methods` - Pipe-separated HTTP methods (for example, `GET`, `POST|PUT`). - `path` - URL path pattern to match (for example, `/api/*`). - `host` - Host header value to match. - `headers` - (Map) Header key-value pairs to match. ### Nested Schema for `routing.upstreams` - `uri` - (Required) The upstream backend URI. For MCP servers, this is the actual MCP server implementation URI that requests are forwarded to. - `weight` - Traffic weight percentage (0–100). Defaults to `100`. - `label` - A label for this upstream. - `tls_context_id` - TLS context for upstream connections. Format: `secretGroupId/tlsContextId`. ### Import An existing MCP server can be imported using its composite ID: `organization_id/environment_id/mcp_server_id`. The `mcp_server_id` is the numeric ID visible in the Anypoint API Manager URL. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_mcp_server.imported id = "//" } resource "anypoint_mcp_server" "imported" { organization_id = "" environment_id = "" spec = { asset_id = "" group_id = "" version = "1.0.0" } } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_mcp_server.imported // ``` ## `anypoint_agent_instance` Use the `anypoint_agent_instance` resource to create and manage Agent instances in Anypoint API Manager. An Agent instance represents an Agent specification deployed to an Omni Gateway target with routing rules and upstream backends. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Status after create:** After a successful `terraform apply` the `status` field is > populated from a GET request made immediately after the POST. The platform typically returns > `status = "active"` right away. If your Gateway isn’t yet ready, the provider retries the POST up > to 5 times with a 20-second backoff before failing. > [!NOTE] **`upstream_uri` vs `routing`:** `upstream_uri` and `routing` are mutually exclusive. Use > `upstream_uri` for a single upstream — the provider expands it to > `[{upstreams: [{weight: 100, uri: }]}]` automatically. Only one upstream per route is > supported; multi-upstream weighted routing isn’t available for Agent instances. ### Example Usage #### Basic Agent instance with `upstream_uri` ```hcl resource "anypoint_agent_instance" "example" { organization_id = var.organization_id environment_id = var.environment_id technology = "omniGateway" instance_label = "customer-support-agent" spec = { asset_id = "my-agent-spec" group_id = var.organization_id version = "1.0.0" } endpoint = { deployment_type = "HY" base_path = "agent/support" } gateway_id = var.gateway_id upstream_uri = "http://agent-service.internal:8080" } ``` #### Agent instance with explicit routing ```hcl resource "anypoint_agent_instance" "advanced" { organization_id = var.organization_id environment_id = var.environment_id technology = "omniGateway" instance_label = "sales-agent" spec = { asset_id = "my-agent-spec" group_id = var.organization_id version = "1.0.0" } endpoint = { deployment_type = "HY" base_path = "agent/sales" } gateway_id = var.gateway_id routing = [ { upstreams = [ { weight = 100 uri = "http://sales-agent.internal:8080" } ] } ] } ``` ### Required Arguments - `environment_id` - The environment ID where the Agent instance will be created. - `spec` - (Block) The Exchange asset specification backing this Agent instance.. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `technology` - The gateway technology. Only `omniGateway` is currently supported. Defaults to `omniGateway`. - `provider_id` - The identity provider ID for the Agent. - `instance_label` - A human-readable label for this Agent instance. - `approval_method` - Client approval method. Valid values: `manual`, `automatic`. Defaults to `null` (no approval required). - `consumer_endpoint` - Consumer-facing endpoint URI (the public URL clients use to reach the Agent). - `upstream_uri` - Shorthand for a single-upstream routing configuration. Mutually exclusive with `routing`. - `gateway_id` - The Omni Gateway UUID. When provided, the deployment block is auto-populated from the Gateway Manager. Mutually exclusive with a full `deployment` block. - `endpoint` - (Block) Endpoint and proxy configuration.. - `deployment` - (Block) Deployment target configuration. Auto-populated when `gateway_id` is set.. - `routing` - (Block List) Routing rules with weighted upstream backends. Mutually exclusive with `upstream_uri`.. ### Read-Only Attributes - `id` - The numeric identifier of the Agent instance (stored as string for Terraform compatibility). - `status` - The current status of the Agent instance. - `asset_id` - The Exchange asset ID (computed from Agent response). - `asset_version` - The Exchange asset version (computed from Agent response). - `product_version` - The product version (computed from Agent response). ### Nested Schema for `spec` - `asset_id` - (Required) The Exchange asset ID. - `group_id` - (Required) The Exchange group (organization) ID. - `version` - (Required) The asset version. ### Nested Schema for `endpoint` - `deployment_type` - Deployment type. Valid values: `HY` (hybrid), `CH` (CloudHub), `RF` (Runtime Fabric). Defaults to `HY`. - `type` - Endpoint protocol type. For Agent instances, this is `a2a` (Agent-to-Agent). Defaults to `a2a`. - `base_path` - Agent base path for Omni Gateway (for example, `my-agent`). The provider constructs the proxy URI as `http://0.0.0.0:8081/`. - `uri` - Direct implementation URI. Mutually exclusive with `base_path`. - `response_timeout` - Response timeout in milliseconds. ### Nested Schema for `deployment` - `environment_id` - The environment ID for deployment (usually matches the top-level `environment_id`). - `type` - Deployment type. Valid values: `HY`, `CH`, `RF`. Defaults to `HY`. - `expected_status` - Expected deployment status. Valid values: `deployed`, `undeployed`. Defaults to `deployed`. - `overwrite` - Whether to overwrite an existing deployment. - `target_id` - The target gateway ID to deploy to. - `target_name` - The target gateway name. - `gateway_version` - The Omni Gateway runtime version. ### Nested Schema for `routing` - `upstreams` - (Required, Block List) Weighted upstream backends for this route.. - `label` - A label for this route. - `rules` - (Block) Match conditions for this route.. ### Nested Schema for `routing.rules` - `methods` - Pipe-separated HTTP methods (for example, `GET`, `POST|PUT`). - `path` - URL path pattern to match (for example, `/api/*`). - `host` - Host header value to match. - `headers` - (Map) Header key-value pairs to match. ### Nested Schema for `routing.upstreams` - `uri` - (Required) The upstream backend URI. - `weight` - Traffic weight percentage (0–100). Defaults to `100`. - `label` - A label for this upstream. - `tls_context_id` - TLS context for upstream connections. Format: `secretGroupId/tlsContextId`. ### Import An existing Agent instance can be imported using its composite ID: `organization_id/environment_id/agent_instance_id`. The `agent_instance_id` is the numeric ID visible in the Anypoint API Manager URL. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_agent_instance.imported id = "//" } resource "anypoint_agent_instance" "imported" { organization_id = "" environment_id = "" spec = { asset_id = "" group_id = "" version = "1.0.0" } } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_agent_instance.imported // ``` --- product: MuleSoft Terraform Provider --- # MuleSoft Terraform Provider > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The MuleSoft Terraform provider enables you to manage MuleSoft resources using Infrastructure as Code (IaC). Use this provider to provision and manage MuleSoft resources declaratively through Terraform configuration files. The provider supports infrastructure and platform configuration across CloudHub 2.0, API Manager, Access Management, Secrets Manager, MCP servers, and A2A instances. ## Key Capabilities - Manage CloudHub 2.0 resources, including private spaces, network configuration, ingress and egress rules, VPN connections, and TLS contexts. - Create and manage managed Omni Gateway resources in CloudHub 2.0. - Manage Access Management resources, including business groups and teams. - Configure Secrets Manager resources, including secret groups, certificates, keystores, truststores, and shared secrets. - Create and manage API Manager resources, including API instances and SLA tiers. - Create and manage MCP servers and A2A instances. - Apply API, MCP, and A2A policies declaratively. ## Terraform Integration with MuleSoft The MuleSoft Terraform provider enables a declarative approach to managing platform resources. Instead of configuring resources through the UI or API calls, you define the desired state in Terraform configuration files. Terraform then provisions and updates resources to match that state. This approach helps ensure consistency across environments and supports version-controlled configuration management. The provider supports GitOps-based workflows, so you can manage MuleSoft resources alongside your cloud infrastructure resources. The provider integrates with Terraform workflows and can be used together with cloud providers such as AWS, Azure, and Google Cloud. ## See Also - [Install and Configure the Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/install-configure) - [How the Provider Works](https://docs.mulesoft.com/mulesoft-terraform-provider/how-provider-works) - [Resources](https://docs.mulesoft.com/mulesoft-terraform-provider/resources) --- product: MuleSoft Terraform Provider --- # MuleSoft Terraform Provider Release Notes > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The MuleSoft Terraform Provider enables you to manage MuleSoft resources declaratively using Terraform, supporting infrastructure-as-code workflows for API Manager, Runtime Manager, and other Anypoint Platform components. These release notes are provided for the MuleSoft Terraform Provider: - [MuleSoft Terraform Provider Release Notes](https://docs.mulesoft.com/release-notes/terraform/terraform-release-notes) ## See Also - [MuleSoft Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/) - [Known Issues](https://help.salesforce.com/s/issues) --- product: MuleSoft Terraform Provider --- # Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The MuleSoft Terraform provider includes resources for managing infrastructure, API management, security, governance, and AI-related components across the MuleSoft Platform. ## CloudHub 2.0 Resources Use these resources to manage CloudHub 2.0 infrastructure and networking components. - [`anypoint_private_space_config`](https://docs.mulesoft.com/mulesoft-terraform-provider/cloudhub2-resources#anypoint_private_space_config) - [`anypoint_private_space_association`](https://docs.mulesoft.com/mulesoft-terraform-provider/cloudhub2-resources#anypoint_private_space_association) - [`anypoint_private_space_upgrade`](https://docs.mulesoft.com/mulesoft-terraform-provider/cloudhub2-resources#anypoint_private_space_upgrade) - [`anypoint_privatespace_advanced_config`](https://docs.mulesoft.com/mulesoft-terraform-provider/cloudhub2-resources#anypoint_privatespace_advanced_config) - [`anypoint_tls_context`](https://docs.mulesoft.com/mulesoft-terraform-provider/cloudhub2-resources#anypoint_tls_context) - [`anypoint_vpn_connection`](https://docs.mulesoft.com/mulesoft-terraform-provider/cloudhub2-resources#anypoint_vpn_connection) ## Managed Omni Gateway Resources Use these resources to manage managed Omni Gateway instances in CloudHub 2.0. - [`anypoint_managed_omni_gateway`](https://docs.mulesoft.com/mulesoft-terraform-provider/managed-gateway-resources#anypoint_managed_omni_gateway) ## Access Management Resources Use these resources to manage Access Management configuration. - [`anypoint_connected_app_scopes`](https://docs.mulesoft.com/mulesoft-terraform-provider/access-management-resources#anypoint_connected_app_scopes) - [`anypoint_environment`](https://docs.mulesoft.com/mulesoft-terraform-provider/access-management-resources#anypoint_environment) - [`anypoint_organization`](https://docs.mulesoft.com/mulesoft-terraform-provider/access-management-resources#anypoint_organization) - [`anypoint_team`](https://docs.mulesoft.com/mulesoft-terraform-provider/access-management-resources#anypoint_team) ## Secrets Manager Resources Use these resources to manage Secrets Manager configuration. - [`anypoint_secret_group`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group) - [`anypoint_secret_group_certificate`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group_certificate) - [`anypoint_secret_group_certificate_pinset`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group_certificate_pinset) - [`anypoint_secret_group_keystore`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group_keystore) - [`anypoint_secret_group_shared_secret`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group_shared_secret) - [`anypoint_secret_group_tls_context`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group_tls_context) - [`anypoint_secret_group_truststore`](https://docs.mulesoft.com/mulesoft-terraform-provider/secret-manager-resources#anypoint_secret_group_truststore) ## API Manager Resources Use these resources to manage APIs and API configuration in API Manager. - [`anypoint_api_instance`](https://docs.mulesoft.com/mulesoft-terraform-provider/api-manager-resources#anypoint_api_instance) - [`anypoint_api_instance_sla_tier`](https://docs.mulesoft.com/mulesoft-terraform-provider/api-manager-resources#anypoint_api_instance_sla_tier) ## MCP and AI Agent Resources Use these resources to manage MCP servers and AI agent resources. - [`anypoint_mcp_server`](https://docs.mulesoft.com/mulesoft-terraform-provider/mcp-resources#anypoint_mcp_server) - [`anypoint_agent_instance`](https://docs.mulesoft.com/mulesoft-terraform-provider/mcp-resources#anypoint_agent_instance) ## API, MCP, and A2A Policy Resources Use these resources to apply policies declaratively to APIs, MCP servers, gateways, and AI agent resources. - [`anypoint_api_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/api-manager-resources#anypoint_api_policy) - [`anypoint_api_policy_a2a_agent_card`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_a2a_agent_card) - [`anypoint_api_policy_a2a_pii_detector`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_a2a_pii_detector) - [`anypoint_api_policy_a2a_prompt_decorator`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_a2a_prompt_decorator) - [`anypoint_api_policy_a2a_schema_validation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_a2a_schema_validation) - [`anypoint_api_policy_a2a_token_rate_limit`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_a2a_token_rate_limit) - [`anypoint_api_policy_body_transformation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_body_transformation) - [`anypoint_api_policy_circuit_breaker`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_circuit_breaker) - [`anypoint_api_policy_access_block`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_access_block) - [`anypoint_api_policy_client_id_enforcement`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_client_id_enforcement) - [`anypoint_api_policy_cors`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_cors) - [`anypoint_api_policy_credential_injection_basic_auth`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_credential_injection_basic_auth) - [`anypoint_api_policy_credential_injection_oauth2`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_credential_injection_oauth2) - [`anypoint_api_policy_credential_injection_oauth2_obo`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_credential_injection_oauth2_obo) - [`anypoint_api_policy_dataweave_request_filter`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_dataweave_request_filter) - [`anypoint_api_policy_dataweave_body_transformation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_dataweave_body_transformation) - [`anypoint_api_policy_dataweave_headers_transformation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_dataweave_headers_transformation) - [`anypoint_api_policy_external_oauth2_access_token_enforcement`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_external_oauth2_access_token_enforcement) - [`anypoint_api_policy_header_injection`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_header_injection) - [`anypoint_api_policy_header_removal`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_header_removal) - [`anypoint_api_policy_header_transformation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_header_transformation) - [`anypoint_api_policy_health_check`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_health_check) - [`anypoint_api_policy_http_basic_authentication`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_http_basic_authentication) - [`anypoint_api_policy_http_caching`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_http_caching) - [`anypoint_api_policy_idle_timeout`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_idle_timeout) - [`anypoint_api_policy_intask_authentication_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_intask_authentication_policy) - [`anypoint_api_policy_intask_authorization_code_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_intask_authorization_code_policy) - [`anypoint_api_policy_ip_allowlist`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_ip_allowlist) - [`anypoint_api_policy_ip_blocklist`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_ip_blocklist) - [`anypoint_api_policy_injection_protection`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_injection_protection) - [`anypoint_api_policy_json_threat_protection`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_json_threat_protection) - [`anypoint_api_policy_jwt_validation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_jwt_validation) - [`anypoint_api_policy_ldap_authentication`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_ldap_authentication) - [`anypoint_api_policy_bedrock_llm_provider_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_bedrock_llm_provider_policy) - [`anypoint_api_policy_gemini_llm_provider_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_gemini_llm_provider_policy) - [`anypoint_api_policy_gemini_transcoding_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_gemini_transcoding_policy) - [`anypoint_api_policy_llm_gw_core_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_llm_gw_core_policy) - [`anypoint_api_policy_llm_proxy_core`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_llm_proxy_core) - [`anypoint_api_policy_llm_proxy_core_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_llm_proxy_core_policy) - [`anypoint_api_policy_mcp_access_control`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_access_control) - [`anypoint_api_policy_mcp_global_access_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_global_access_policy) - [`anypoint_api_policy_mcp_pii_detector`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_pii_detector) - [`anypoint_api_policy_mcp_schema_validation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_schema_validation) - [`anypoint_api_policy_mcp_support`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_support) - [`anypoint_api_policy_mcp_tool_mapping`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_tool_mapping) - [`anypoint_api_policy_mcp_transcoding_router`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_mcp_transcoding_router) - [`anypoint_api_policy_message_logging`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_message_logging) - [`anypoint_api_policy_message_logging_outbound`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_message_logging_outbound) - [`anypoint_api_policy_model_based_routing`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_model_based_routing) - [`anypoint_api_policy_agent_connection_telemetry`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_agent_connection_telemetry) - [`anypoint_api_policy_native_aws_lambda`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_native_aws_lambda) - [`anypoint_api_policy_native_ext_authz`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_native_ext_authz) - [`anypoint_api_policy_native_ext_proc`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_native_ext_proc) - [`anypoint_api_policy_oauth2_token_introspection`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_oauth2_token_introspection) - [`anypoint_api_policy_openai_transcoding_policy`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_openai_transcoding_policy) - [`anypoint_api_policy_semantic_prompt_guard_policy_openai`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_semantic_prompt_guard_policy_openai) - [`anypoint_api_policy_semantic_routing_policy_huggingface`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_semantic_routing_policy_huggingface) - [`anypoint_api_policy_rate_limiting`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_rate_limiting) - [`anypoint_api_policy_rate_limiting_sla_based`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_rate_limiting_sla_based) - [`anypoint_api_policy_response_timeout`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_response_timeout) - [`anypoint_api_policy_script_evaluation_transformation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_script_evaluation_transformation) - [`anypoint_api_policy_sse_logging`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_sse_logging) - [`anypoint_api_policy_spec_validation`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_spec_validation) - [`anypoint_api_policy_spike_control`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_spike_control) - [`anypoint_api_policy_stream_idle_timeout`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_stream_idle_timeout) - [`anypoint_api_policy_tracing`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_tracing) - [`anypoint_api_policy_xml_threat_protection`](https://docs.mulesoft.com/mulesoft-terraform-provider/a2a-resources#anypoint_api_policy_xml_threat_protection) For the complete list of supported policy resources, see the [Terraform Registry resources documentation](https://registry.terraform.io/providers/mulesoft/anypoint/latest/docs/resources). ## See Also - [MuleSoft Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/) - [Install and Configure the Terraform Provider](https://docs.mulesoft.com/mulesoft-terraform-provider/install-configure) - [How the Provider Works](https://docs.mulesoft.com/mulesoft-terraform-provider/how-provider-works) --- product: MuleSoft Terraform Provider --- # Secrets Manager Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Secrets Manager resources to manage secret groups, certificates, keystores, truststores, shared secrets, and TLS contexts in Anypoint Platform. These resources support declarative secrets and TLS configuration management for managed gateways and related infrastructure components. ## `anypoint_secret_group` Use the `anypoint_secret_group` resource to manage secret groups in Anypoint Secrets Manager. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Lifecycle:** Deleting this resource also cascade-deletes all sub-resources on the > platform (keystores, truststores, certificates, shared secrets, TLS contexts, certificate > pinsets). Sub-resource Terraform resources (`anypoint_secret_group_keystore`, etc.) must be > declared as dependents — destroy them first in your config or Terraform will remove them from > state automatically when the secret group is destroyed. ### Example Usage ```hcl resource "anypoint_secret_group" "example" { environment_id = var.environment_id name = "terraform-secrets" downloadable = false } ``` ### Required Arguments - `environment_id` - Environment ID where the secret group is created. - `name` - Name of the secret group. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `downloadable` - Whether the secrets in this group can be downloaded. Defaults to `false`. ### Read-Only Attributes - `id` - Unique identifier of the secret group. - `current_state` - Current state of the secret group. ### Import An existing `anypoint_secret_group` can be imported using its composite ID: `organization_id/environment_id/secret_group_id`. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group.imported id = "//" } resource "anypoint_secret_group" "imported" { organization_id = "" environment_id = "" name = "" downloadable = false } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group.imported // ``` ## `anypoint_secret_group_certificate` Use the `anypoint_secret_group_certificate` resource to manage certificates within a secret group in Anypoint Secrets Manager. Supports PEM, JKS, PKCS12, and JCEKS formats. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Delete behaviour:** The Anypoint Secrets Manager API doesn’t expose individual DELETE > endpoints for sub-resources. `terraform destroy` removes this resource from Terraform state only — > the certificate is deleted on the platform when the parent `anypoint_secret_group` is destroyed. ### Example Usage ```hcl resource "anypoint_secret_group_certificate" "example" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "my-certificate" type = "PEM" certificate_base64 = base64encode(file("${path.module}/certs/cert.pem")) } ``` ### Required Arguments - `environment_id` - Environment ID. - `secret_group_id` - Secret group ID that this certificate belongs to. - `name` - Name of the certificate. - `certificate_base64` - _(Sensitive)_ Base64-encoded certificate file content. For PEM: `base64encode(file("cert.pem"))`. For binary: `filebase64("cert.der")`. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `type` - Certificate format: `PEM`, `JKS`, `PKCS12`, or `JCEKS`. Defaults to `PEM`. ### Read-Only Attributes - `id` - Unique identifier of the certificate. - `expiration_date` - Expiration date of the certificate. - `algorithm` - Signature algorithm of the certificate. ### Import An existing `anypoint_secret_group_certificate` can be imported using its composite ID: `organization_id/environment_id/secret_group_id/certificate_id`. > [!NOTE] `certificate_base64` is a write-only field and won’t be populated after import. Set it > manually to avoid drift on the next plan. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group_certificate.imported id = "///" } resource "anypoint_secret_group_certificate" "imported" { organization_id = "" environment_id = "" secret_group_id = "" name = "" type = "PEM" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group_certificate.imported /// ``` ## `anypoint_secret_group_certificate_pinset` Use the `anypoint_secret_group_certificate_pinset` resource to manage certificate pinsets within a secret group in Anypoint Secrets Manager. A certificate pinset is used for certificate pinning validation. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Delete behaviour:** The Anypoint Secrets Manager API doesn’t expose individual DELETE > endpoints for sub-resources. `terraform destroy` removes this resource from Terraform state only — > the certificate pinset is deleted on the platform when the parent `anypoint_secret_group` is > destroyed. ### Example Usage ```hcl resource "anypoint_secret_group_certificate_pinset" "example" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "my-cert-pinset" certificate_pinset_base64 = base64encode(file("${path.module}/certs/cert.pem")) } ``` ### Required Arguments - `environment_id` - Environment ID. - `secret_group_id` - Secret group ID that this certificate pinset belongs to. - `name` - Name of the certificate pinset. - `certificate_pinset_base64` - _(Sensitive)_ Base64-encoded certificate file for pinning. For PEM: `base64encode(file("cert.pem"))`. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. ### Read-Only Attributes - `id` - Unique identifier of the certificate pinset. - `expiration_date` - Expiration date of the pinned certificate. - `algorithm` - Signature algorithm of the pinned certificate. ### Import An existing `anypoint_secret_group_certificate_pinset` can be imported using its composite ID: `organization_id/environment_id/secret_group_id/certificate_pinset_id`. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group_certificate_pinset.imported id = "///" } resource "anypoint_secret_group_certificate_pinset" "imported" { organization_id = "" environment_id = "" secret_group_id = "" name = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group_certificate_pinset.imported /// ``` ## `anypoint_secret_group_keystore` Use the `anypoint_secret_group_keystore` resource to manage keystores within a secret group in Anypoint Secrets Manager. Supports PEM, JKS, PKCS12, and JCEKS formats. Use `filebase64()` to read binary files (JKS/PKCS12) or `base64encode(file(…​))` for PEM text files. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Delete behaviour:** The Anypoint Secrets Manager API doesn’t expose individual DELETE > endpoints for sub-resources. `terraform destroy` removes this resource from Terraform state only — > the keystore is deleted on the platform when the parent `anypoint_secret_group` is destroyed. ### Example Usage #### PEM keystore ```hcl resource "anypoint_secret_group_keystore" "pem" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "tls-pem-keystore" type = "PEM" certificate_base64 = base64encode(file("${path.module}/certs/cert.pem")) key_base64 = base64encode(file("${path.module}/certs/key.pem")) } ``` #### PEM keystore with CA chain ```hcl resource "anypoint_secret_group_keystore" "pem_with_ca" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "tls-pem-with-truststore" type = "PEM" certificate_base64 = base64encode(file("${path.module}/certs/cert.pem")) key_base64 = base64encode(file("${path.module}/certs/key.pem")) ca_path_base64 = base64encode(file("${path.module}/certs/truststore.pem")) } ``` #### JKS keystore ```hcl resource "anypoint_secret_group_keystore" "jks" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "tls-jks-keystore" type = "JKS" keystore_file_base64 = filebase64("${path.module}/certs/keystore.jks") store_passphrase = var.jks_store_passphrase key_passphrase = var.jks_key_passphrase alias = "myalias" } ``` ### Required Arguments - `environment_id` - Environment ID. Changing this forces a new resource. - `secret_group_id` - Secret group ID that this keystore belongs to. Changing this forces a new resource. - `name` - Name of the keystore. ### Optional Arguments - `organization_id` - Organization ID. If not provided, inferred from the connected app credentials. - `type` - Keystore format: `PEM`, `JKS`, `PKCS12`, or `JCEKS`. Defaults to `PEM`. Changing this forces a new resource. - `certificate_base64` - _(Sensitive)_ Base64-encoded certificate content. For PEM: `base64encode(file("cert.pem"))`. For binary DER: `filebase64("cert.der")`. Used for PEM type. - `key_base64` - _(Sensitive)_ Base64-encoded private key content. For PEM: `base64encode(file("key.pem"))`. Required for PEM type. - `keystore_file_base64` - _(Sensitive)_ Base64-encoded keystore file. Use `filebase64("keystore.jks")` or `filebase64("keystore.p12")`. Required for JKS, PKCS12, and JCEKS types. - `store_passphrase` - _(Sensitive)_ Store-level passphrase. Required for JKS, PKCS12, and JCEKS types. - `key_passphrase` - _(Sensitive)_ Private-key entry passphrase. Required for JKS, PKCS12, and JCEKS types. Optional for PEM encrypted keys. - `alias` - Entry alias within the keystore. Used for JKS, PKCS12, and JCEKS types. - `ca_path_base64` - _(Sensitive)_ Base64-encoded CA certificate chain (appended as truststore). Optional for all types. ### Read-Only Attributes - `id` - Unique identifier of the keystore. - `expiration_date` - Expiration date of the certificate in the keystore. - `algorithm` - Signature algorithm of the certificate. ### Import An existing `anypoint_secret_group_keystore` can be imported using its composite ID: `organization_id/environment_id/secret_group_id/keystore_id`. > [!NOTE] File content fields (`certificate_base64`, `key_base64`, etc.) are write-only and won’t be > populated after import. Set them manually to avoid drift. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group_keystore.imported id = "///" } resource "anypoint_secret_group_keystore" "imported" { organization_id = "" environment_id = "" secret_group_id = "" name = "" type = "PEM" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group_keystore.imported /// ``` ## `anypoint_secret_group_shared_secret` Use the `anypoint_secret_group_shared_secret` resource to manage shared secrets within a secret group in Anypoint Secrets Manager. Supports four types: `UsernamePassword`, `S3Credential`, `SymmetricKey`, and `Blob`. Provide the type-specific fields based on the chosen type. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Delete behaviour:** The Anypoint Secrets Manager API doesn’t expose individual DELETE > endpoints for sub-resources. `terraform destroy` removes this resource from Terraform state only — > the shared secret is deleted on the platform when the parent `anypoint_secret_group` is destroyed. ### Example Usage #### UsernamePassword ```hcl resource "anypoint_secret_group_shared_secret" "db_creds" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "db-credentials" type = "UsernamePassword" username = "admin" password = var.db_password } ``` #### S3Credential ```hcl resource "anypoint_secret_group_shared_secret" "s3" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "s3-backup-creds" type = "S3Credential" access_key_id = var.aws_access_key secret_access_key = var.aws_secret_key expiration_date = "2026-12-31" } ``` #### SymmetricKey ```hcl resource "anypoint_secret_group_shared_secret" "symmetric" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "encryption-key" type = "SymmetricKey" key = base64encode("my-256-bit-secret-key-value-here") } ``` #### Blob ```hcl resource "anypoint_secret_group_shared_secret" "blob" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "api-token" type = "Blob" content = var.api_token } ``` ### Required Arguments - `environment_id` - Environment ID. - `secret_group_id` - Secret group ID that this shared secret belongs to. - `name` - Name of the shared secret. - `type` - Type of shared secret: `UsernamePassword`, `S3Credential`, `SymmetricKey`, or `Blob`. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `expiration_date` - Optional expiration date (for example, `2026-03-31`). - `username` - Username (for `UsernamePassword` type). - `password` - _(Sensitive)_ Password (for `UsernamePassword` type). - `access_key_id` - AWS access key ID (for `S3Credential` type). - `secret_access_key` - _(Sensitive)_ AWS secret access key (for `S3Credential` type). - `key` - _(Sensitive)_ Base64-encoded symmetric key (for `SymmetricKey` type). - `content` - _(Sensitive)_ Secret content string (for `Blob` type). ### Read-Only Attributes - `id` - Unique identifier of the shared secret. ### Import An existing `anypoint_secret_group_shared_secret` can be imported using its composite ID: `organization_id/environment_id/secret_group_id/shared_secret_id`. > [!NOTE] Sensitive fields (passwords, secrets) are write-only and won’t be populated after import. > Set them manually to avoid drift. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group_shared_secret.imported id = "///" } resource "anypoint_secret_group_shared_secret" "imported" { organization_id = "" environment_id = "" secret_group_id = "" name = "" type = "UsernamePassword" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group_shared_secret.imported /// ``` ## `anypoint_secret_group_truststore` Use the `anypoint_secret_group_truststore` resource to manage truststores within a secret group in Anypoint Secrets Manager. Supports PEM, JKS, PKCS12, and JCEKS formats. Use `base64encode(file(…​))` for PEM text files or `filebase64(…​)` for binary JKS/PKCS12 files. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Delete behaviour:** The Anypoint Secrets Manager API doesn’t expose individual DELETE > endpoints for sub-resources. `terraform destroy` removes this resource from Terraform state only — > the truststore is deleted on the platform when the parent `anypoint_secret_group` is destroyed. ### Example Usage #### PEM truststore ```hcl resource "anypoint_secret_group_truststore" "pem" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "ca-truststore" type = "PEM" truststore_base64 = base64encode(file("${path.module}/certs/truststore.pem")) } ``` #### JKS truststore ```hcl resource "anypoint_secret_group_truststore" "jks" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "ca-truststore-jks" type = "JKS" truststore_base64 = filebase64("${path.module}/certs/truststore.jks") passphrase = var.jks_passphrase } ``` ### Required Arguments - `environment_id` - Environment ID. - `secret_group_id` - Secret group ID that this truststore belongs to. - `name` - Name of the truststore. - `truststore_base64` - _(Sensitive)_ Base64-encoded truststore file content. For PEM: `base64encode(file("truststore.pem"))`. For JKS/PKCS12: `filebase64("truststore.jks")`. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `type` - Truststore format: `PEM`, `JKS`, `PKCS12`, or `JCEKS`. Defaults to `PEM`. - `passphrase` - _(Sensitive)_ Passphrase for the truststore. Required for JKS, PKCS12, and JCEKS formats. ### Read-Only Attributes - `id` - Unique identifier of the truststore. - `expiration_date` - Expiration date of the certificate in the truststore. - `algorithm` - Signature algorithm of the certificate. ### Import An existing `anypoint_secret_group_truststore` can be imported using its composite ID: `organization_id/environment_id/secret_group_id/truststore_id`. > [!NOTE] `truststore_base64` is a write-only field and won’t be populated after import. Set it > manually to avoid drift on the next plan. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group_truststore.imported id = "///" } resource "anypoint_secret_group_truststore" "imported" { organization_id = "" environment_id = "" secret_group_id = "" name = "" type = "PEM" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group_truststore.imported /// ``` ## `anypoint_secret_group_tls_context` Use the `anypoint_secret_group_tls_context` resource to manage an Omni Gateway TLS context within a secret group in Anypoint Secrets Manager. The target is fixed to `OmniGateway` in this provider. References keystore and truststore resources by their IDs — the provider automatically builds the internal path references (`keystores/{id}`, `truststores/{id}`). > [!NOTE] **Target mapping:** The Anypoint Secrets Manager API requires `target: "FlexGateway"` for > Omni Gateway TLS contexts. The provider accepts `OmniGateway` in HCL and automatically maps it to > `FlexGateway` before calling the API. If you create TLS contexts directly via the API or CLI, use > `"FlexGateway"` as the target value. > [!NOTE] **Connected App:** This resource requires a **standard connected app** (client > credentials). An admin connected app isn’t needed. The connected app must have relevant scopes. > [!NOTE] **Delete behaviour:** The Anypoint Secrets Manager API doesn’t expose individual DELETE > endpoints for sub-resources. `terraform destroy` removes this resource from Terraform state only — > the TLS context is deleted on the platform when the parent `anypoint_secret_group` is destroyed. ### Example Usage #### Basic TLS context ```hcl resource "anypoint_secret_group_tls_context" "example" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "omni-tls-context" keystore_id = anypoint_secret_group_keystore.tls.id truststore_id = anypoint_secret_group_truststore.ca.id min_tls_version = "TLSv1.3" max_tls_version = "TLSv1.3" alpn_protocols = ["h2", "http/1.1"] enable_client_cert_validation = false skip_server_cert_validation = false } ``` #### mTLS-enabled TLS context ```hcl resource "anypoint_secret_group_tls_context" "mtls" { environment_id = var.environment_id secret_group_id = anypoint_secret_group.main.id name = "mtls-context" keystore_id = anypoint_secret_group_keystore.tls.id truststore_id = anypoint_secret_group_truststore.ca.id min_tls_version = "TLSv1.3" max_tls_version = "TLSv1.3" alpn_protocols = ["h2", "http/1.1"] enable_client_cert_validation = true skip_server_cert_validation = false } ``` ### Required Arguments - `environment_id` - Environment ID. - `secret_group_id` - Secret group ID that this TLS context belongs to. - `name` - Name of the TLS context. ### Optional Arguments - `organization_id` - Organization ID. If not provided, the organization ID is inferred from the connected app credentials. - `keystore_id` - ID of the keystore in the same secret group. Use `anypoint_secret_group_keystore.example.id` to reference it. - `truststore_id` - ID of the truststore in the same secret group. Use `anypoint_secret_group_truststore.example.id` to reference it. - `min_tls_version` - Minimum TLS version. Valid values: `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. Defaults to `TLSv1.3`. - `max_tls_version` - Maximum TLS version. Valid values: `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. Defaults to `TLSv1.3`. - `alpn_protocols` - (List of String) ALPN protocol negotiation list. Valid values: `h2`, `http/1.1`. Order determines preference: `["h2", "http/1.1"]` prefers H2, `["http/1.1", "h2"]` prefers HTTP/1.1. - `cipher_suites` - (List of String) Allowed cipher suites. Empty list means use defaults. - `enable_client_cert_validation` - Enable mutual TLS client certificate validation (inbound). Defaults to `false`. - `skip_server_cert_validation` - Skip server certificate validation (outbound). Defaults to `false`. ### Read-Only Attributes - `id` - Unique identifier of the TLS context. - `target` - Target runtime for the TLS context. Always `OmniGateway` in Terraform. The provider maps this to `FlexGateway` when calling the Secrets Manager API. - `expiration_date` - Expiration date of the TLS context. ### Import An existing `anypoint_secret_group_tls_context` can be imported using its composite ID: `organization_id/environment_id/secret_group_id/tls_context_id`. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { to = anypoint_secret_group_tls_context.imported id = "///" } resource "anypoint_secret_group_tls_context" "imported" { organization_id = "" environment_id = "" secret_group_id = "" name = "" keystore_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_secret_group_tls_context.imported /// ```