---
updatedAt: 2026-03-01T18:30:19.000Z
agentTools:
  siteIndex: https://techdocs.akamai.com/llms.txt
  projectIndex: https://techdocs.akamai.com/terraform/v9.3/llms.txt
---

# Protected operations

akamai_apr_protected_operations

> 📘
>
> Hello. Just a note to let you know the underlying API on which this resource is built is general release and has been vetted, but because this is a new feature for our Terraform provider, we've given it beta label.
>
> This status just means we've paused for a bit to get [your feedback](https://github.com/akamai/terraform-provider-akamai/issues) to make sure this resource works like you need and expect.

Create, update, or delete protected API operations. To delete an operation, run `terraform destroy`.

```json Declaration
resource "akamai_apr_protected_operations" "my_protected_operations" {
  config_id           = 12345
  security_policy_id  = "abcd_123456"
  operation_id        = "12a3bc4d-5678-9ef0-g12h-3i4jklm5no67"
  protected_operation = file("${path.module}/protected-operation.json")
}
```
```json Output
my_protected_operations = {
  config_id          = 12345
  id                 = "12345:abcd_123456"
  json               = jsonencode(
    {
      metadata   = {
        configId         = 12345
        configVersion    = 1
        securityPolicyId = "abcd_123456"
      }
      operations = [
        {
          apiEndPointId          = 408126
          operationId            = "12a3bc4d-5678-9ef0-g12h-3i4jklm5no67"
          protectedOperationLink = "/appsec/v1/configs/12345/versions/1/security-policies/abcd_123456/transactional-endpoints/account-protection/123a456b-c78d-9e0f-g1h2-3456789012i3"
          telemetryTypeStates    = {
            inline    = {
              ajaxSupportEnabled = false
              disabledAction     = "monitor"
              enabled            = false
            }
            nativeSdk = {
              ajaxSupportEnabled = false
              disabledAction     = "monitor"
              enabled            = false
            }
            standard  = {
              ajaxSupportEnabled = false
              disabledAction     = "monitor"
              enabled            = true
            }
          }
          traffic                = {
              inline   = {
                aggressive         = {
                  action = "monitor"
                }
                cautious           = {
                  action = "monitor"
                }
                overrideThresholds = false
                strict             = {
                  action = "monitor"
                }
              }
              standard = {
                aggressive         = {
                  action = "deny"
                }
                cautious           = {
                  action = "monitor"
                }
                overrideThresholds = false
                strict             = {
                  action = "monitor"
                }
              }
          }
        },
      ]
    }
  )
  operation_id       = null
  security_policy_id = "abcd_123456"
}
```

## Arguments

Pass all required arguments to get information about your protected API operations. Provide an operation's ID to limit the return.

[block:parameters]
{
  "data": {
    "h-0": "Argument",
    "h-1": "Required",
    "h-2": "Description",
    "0-0": "`config_id`",
    "0-1": "✔️",
    "0-2": "Your security configuration's ID.",
    "1-0": "`security_policy_id`",
    "1-1": "✔️",
    "1-2": "Your security policy's ID.",
    "2-0": "`operation_id`",
    "2-1": "",
    "2-2": "An API operation's ID.",
    "3-0": "`protected_operation`",
    "3-1": "",
    "3-2": "A JSON object containing details about the operation to protect. See [Protected operation JSON](#protected-operations-json) for the schema.<blockquote><strong>Note:</strong> Use the Bot Manager \\<a href=\"doc:bmgr-ds-transactional-endpoint>Transactional endpoint</a> data source to get your operation's settings.</blockquote>"
  },
  "cols": 3,
  "rows": 4,
  "align": [
    null,
    "center",
    null
  ]
}
[/block]

### Protected operations JSON

Your protected operations's details.

<table>
  <thead>
    <th>Parameter</th>
    <th>Description</th>
  </thead>
  <tbody>
    <tr>
      <td><code>apiEndPointId</code></td>
      <td>An endpoint's ID.</td>
    </tr>
    <tr>
      <td><code>operationId</code></td>
      <td>An API operation's ID.</td>
    </tr>
    <tr>
      <td><code>telemetryTypeStates</code></td>
      <td>An object that contains the operation's types of telemetry, their enablement statuses, and their actions and thresholds. 
        These telemetry types are available:
        <ul>
          <li><code>inline</code>. Collects incoming inline telemetry traffic.</li>
          <li><code>nativeSdk</code>. Collects incoming SDK telemetry traffic.</li>
          <li><code>standard</code>. Collects incoming standard telemetry traffic.</li>
      </ul> 
        For each telemetry type, you can set these attributes: 
            <ul>
              <li><code>ajaxSupportEnabled</code>. Whether to use AJAX for challenge actions.</li>
              <li><code>enabled</code>. Required. Whether to include inline telemetry.</li>
              <li><code>disabledAction</code>. Conditionally required. If <code>enabled</code> is <code>false</code>, 
                provide an action to take on unexpected traffic. Possible actions are:
                <div class="Flex-two">
                  <div class="Flex-item-two">
                    <ul>
                      <li class="inner-list-behavior"><code>deny</code></li>
                      <li class="inner-list-behavior"><code>monitor</code></li>
                      <li class="inner-list-behavior"><code>tarpit</code></li>
                      <li class="inner-list-behavior"><code>delay</code></li>
                    </ul>
                  </div>
                  <div class="Flex-item-two">
                    <ul>
                      <li class="inner-list-behavior"><code>slow</code></li>
                      <li class="inner-list-behavior"><code>none</code></li>
                      <li class="inner-list-behavior"><code>custom</code></li>
                    </ul>
                  </div>
                </div>
              </li>
          </li>
      </td>
    </tr>
    <tr>
      <td><code>traffic</code></td>
      <td>The types of traffic to take action upon. These types of traffic are available:
        <ul>
          <li><code>inline</code>. Attaches user telemetry directly to the protected request without using a 
            first-party cookie. If you set the threshold override to true, don't pass <code>threshold</code>.</li>
          <li><code>nativeSdkAndroid</code>. Attaches telemetry traffic directly from a native Android mobile 
            application. If you set the threshold override to true, don't pass <code>threshold</code>.</li>
          <li><code>nativeSdkIos</code>. Attaches telemetry traffic directly from a native iOS mobile application. 
            If you set the threshold override to true, don't pass <code>threshold</code>.</li>
          <li><code>standard</code>. Uses first-party cookies to associate and transmit user behavior data. If you 
            set the threshold override to true, don't pass <code>threshold</code>.</li>
        </ul>
          For each traffic type, you can set these attributes: 
            <ul>
              <li><code>aggressive</code>. Aggressive response settings object. Contains:
                <ul>
                  <li><code>threshold</code>. The point at which to trigger the response action. Set to a default of<code>90</code> with an available range of <code>2</code>-<code>100</code>.</li>
                  <li><code>action</code>. The action to take once the threshold is triggered. Possible actions are:
                    <div class="Flex-two">
                      <div class="Flex-item-two">
                        <ul>
                          <li class="inner-list-behavior"><code>deny</code></li>
                          <li class="inner-list-behavior"><code>monitor</code></li>
                          <li class="inner-list-behavior"><code>tarpit</code></li>
                          <li class="inner-list-behavior"><code>delay</code></li>
                        </ul>
                      </div>
                      <div class="Flex-item-two">
                        <ul>
                          <li class="inner-list-behavior"><code>slow</code></li>
                          <li class="inner-list-behavior"><code>none</code></li>
                          <li class="inner-list-behavior"><code>custom</code></li>
                        </ul>
                      </div>
                    </div>
                  </li>
                  <li><code>overrideThresholds</code>. Whether to override threshold scores. Used when you want to customize actions on an endpoint.</li>
                </ul>
              </li>
              <li><code>cautious</code>. Cautious response settings object Contains:
                <ul>
                  <li><code>threshold</code>. The point at which to trigger the response action with an available range of <code>0</code>-<code>98</code>.</li>
                  <li><code>action</code>. The action to take once the threshold is triggered. Possible actions are:
                    <div class="Flex-two">
                      <div class="Flex-item-two">
                        <ul>
                          <li class="inner-list-behavior"><code>deny</code></li>
                          <li class="inner-list-behavior"><code>monitor</code></li>
                          <li class="inner-list-behavior"><code>tarpit</code></li>
                          <li class="inner-list-behavior"><code>delay</code></li>
                        </ul>
                      </div>
                      <div class="Flex-item-two">
                        <ul>
                          <li class="inner-list-behavior"><code>slow</code></li>
                          <li class="inner-list-behavior"><code>none</code></li>
                          <li class="inner-list-behavior"><code>custom</code></li>
                        </ul>
                      </div>
                    </div>
                  </li>
                  <li><code>overrideThresholds</code>. Whether to override threshold scores. Used when you want to customize actions on an endpoint.</li>
                </ul>
              </li>
              <li><code>strict</code>. Strict response settings object. Contains:
                <ul>
                  <li><code>threshold</code> The point at which to trigger the response action. Set to a default of <code>50</code>. Available range is <code>1</code>-<code>99</code>.</li>
                  <li><code>action</code>. The action to take once the threshold is triggered. Possible actions are:
                    <div class="Flex-two">
                      <div class="Flex-item-two">
                        <ul>
                          <li class="inner-list-behavior"><code>deny</code></li>
                          <li class="inner-list-behavior"><code>monitor</code></li>
                          <li class="inner-list-behavior"><code>tarpit</code></li>
                          <li class="inner-list-behavior"><code>delay</code></li>
                        </ul>
                      </div>
                      <div class="Flex-item-two">
                        <ul>
                          <li class="inner-list-behavior"><code>slow</code></li>
                          <li class="inner-list-behavior"><code>none</code></li>
                          <li class="inner-list-behavior"><code>custom</code></li>
                        </ul>
                      </div>
                    </div>
                  </li>
                  <li><code>overrideThresholds</code>. Whether to override threshold scores. Used when you want to customize actions on an endpoint.</li>
                </ul>
              </li>
            </ul>
          </li>
        </ul>
      </td>
    </tr>
  </tbody>
</table>

## Attributes

There is no standard output for this resource as changes are reflected in your state file.

The attributes for this resource mirror the arguments with one addition, a `protectedOperationLink`. The value of this is a `GET` endpoint you can use to retrieve information about your protected operations.

# Sibling pages

* [General settings](https://techdocs.akamai.com/terraform/v9.3/docs/apr-rc-general-settings.md)
* [User allow list](https://techdocs.akamai.com/terraform/v9.3/docs/apr-rc-user-allow-list.md)
* [User risk response strategy](https://techdocs.akamai.com/terraform/v9.3/docs/apr-rc-user-risk-response-strategy.md)