---
layout: "fastly"
page_title: "Fastly: fastly_api_security_operation"
sidebar_current: "docs-fastly-resource-api-security-operation"
description: |-
  Manages an API Security operation for a Fastly service.
---

# fastly_api_security_operation

Manages an API Security operation for a Fastly service. Operations represent API endpoints (method + domain + path) and can optionally be associated with operation tags.

## Example Usage

Basic usage:

```terraform
resource "fastly_service_vcl" "svc1" {
  name          = "test-svc-1-example"
  force_destroy = true

  backend {
    address = "example.com"
    name    = "tf-test-backend-1"
  }
}

resource "fastly_api_security_operation" "example" {
  service_id  = fastly_service_vcl.svc1.id
  method      = "GET"
  domain      = "api.example.com"
  path        = "/v1/things"
  description = "Retrieve things"
}
```

With tags:

```terraform
resource "fastly_service_vcl" "svc1" {
  name          = "test-svc-1-example"
  force_destroy = true

  backend {
    address = "example.com"
    name    = "tf-test-backend-1"
  }
}

resource "fastly_api_security_operation_tag" "tag" {
  service_id  = fastly_service_vcl.svc1.id
  name        = "production"
  description = "Production endpoints"
}

resource "fastly_api_security_operation" "example" {
  service_id  = fastly_service_vcl.svc1.id
  method      = "GET"
  domain      = "api.example.com"
  path        = "/v1/things"
  description = "Retrieve things"
  tag_ids     = [fastly_api_security_operation_tag.tag.tag_id]
}
```

## Import

API Security operations can be imported using a composite ID of the form `<service_id>/<operation_id>`, e.g.

```sh
terraform import fastly_api_security_operation.example <service_id>/<operation_id>
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `domain` (String) Domain for the operation (exact match). Can be created, but not updated.
- `method` (String) HTTP method for the operation (e.g. GET, POST). Can be created, but not updated.
- `path` (String) Path for the operation (exact match). Can be created, but not updated.
- `service_id` (String) Service ID the operation belongs to. To import, use: <service_id>/<operation_id>.

### Optional

- `description` (String) A description of the operation.
- `tag_ids` (Set of String) Associated operation tag IDs.

### Read-Only

- `created_at` (String) Created timestamp (when present).
- `id` (String) The ID of this resource.
- `last_seen_at` (String) Last seen timestamp (when present).
- `operation_id` (String) The operation ID.
- `rps` (Number) Observed requests per second (when present).
- `status` (String) Discovery status (when present).
- `updated_at` (String) Updated timestamp (when present).
