@distilled.cloud/stackit 0.0.0-placeholder → 1.0.0-rc.13

package/src/services/alb_waf.ts

@@ -0,0 +1,1347 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-stackit). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  StackitProtocol,
+  type StackitOpError,
+  type StackitOpContext,
+} from "../protocol.ts";
+import { UnknownStackitError } from "../errors.ts";
+import * as Retry from "../retry.ts";
+
+export type { StackitOpError, StackitOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class Conflict
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Conflict>()("Conflict", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withConflictError),
+    [{ status: 409 }],
+  ) {}
+
+export class Forbidden
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withAuthError),
+    [{ status: 403 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+/** The protective stance action. ACTION_DENY forces a 403 status response code. */
+export type Action = "ACTION_DENY" | "ACTION_PASS" | "ACTION_ALLOW";
+export const Action = /*@__PURE__*/ S.String;
+
+export interface Behavior {
+  action: Action | (string & {});
+  /** Determines whether an entry should be generated in the security ledger upon a rule hit. */
+  log?: boolean;
+  /** Custom notification message string mapped to underlying logdata contexts. */
+  logMsg?: string;
+}
+export const Behavior = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    action: Action,
+    log: S.optional(S.Boolean),
+    logMsg: S.optional(S.String),
+  }),
+).annotate({ identifier: "Behavior" }) as any as S.Schema<Behavior>;
+
+/** The operational evaluation type definition macro. */
+export type Operator =
+  | "OPERATOR_BEGINS_WITH"
+  | "OPERATOR_CONTAINS"
+  | "OPERATOR_ENDS_WITH"
+  | "OPERATOR_EQ"
+  | "OPERATOR_GE"
+  | "OPERATOR_GT"
+  | "OPERATOR_IP_MATCH"
+  | "OPERATOR_LE"
+  | "OPERATOR_LT"
+  | "OPERATOR_RX"
+  | "OPERATOR_STREQ"
+  | "OPERATOR_STRMATCH"
+  | "OPERATOR_VALIDATE_SCHEMA"
+  | "OPERATOR_VALIDATE_URL_ENCODING"
+  | "OPERATOR_VALIDATE_UTF8_ENCODING"
+  | "OPERATOR_WITHIN";
+export const Operator = /*@__PURE__*/ S.String;
+
+export interface ConditionOperator {
+  type: Operator | (string & {});
+  /** The text or rule regex pattern arguments applied inside the operator execution loop. */
+  value?: string;
+}
+export const ConditionOperator = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: Operator,
+    value: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ConditionOperator",
+}) as any as S.Schema<ConditionOperator>;
+
+export type Transformation =
+  | "TRANSFORMATION_LENGTH"
+  | "TRANSFORMATION_LOWERCASE"
+  | "TRANSFORMATION_NONE"
+  | "TRANSFORMATION_TRIM"
+  | "TRANSFORMATION_UPPERCASE"
+  | "TRANSFORMATION_UTF8_TO_UNICODE";
+export const Transformation = /*@__PURE__*/ S.String;
+
+/** [HINT] Ordered processing adjustments applied to clean inputs before match checking. */
+export type ConditionTransformationsList = Array<
+  Transformation | (string & {})
+>;
+export const ConditionTransformationsList = /*@__PURE__*/ S.Array(
+  Transformation,
+) as any as S.Schema<ConditionTransformationsList>;
+
+/** The targeted validation engine variable macro. */
+export type Variable =
+  | "VARIABLE_ARGS_GET"
+  | "VARIABLE_ARGS_POST"
+  | "VARIABLE_FULL_REQUEST_LENGTH"
+  | "VARIABLE_MATCHED_VAR"
+  | "VARIABLE_QUERY_STRING"
+  | "VARIABLE_REMOTE_ADDR"
+  | "VARIABLE_REMOTE_PORT"
+  | "VARIABLE_REQUEST_BASENAME"
+  | "VARIABLE_REQUEST_BODY"
+  | "VARIABLE_REQUEST_BODY_LENGTH"
+  | "VARIABLE_REQUEST_COOKIES"
+  | "VARIABLE_REQUEST_HEADERS"
+  | "VARIABLE_REQUEST_HEADERS_NAMES"
+  | "VARIABLE_REQUEST_METHOD"
+  | "VARIABLE_REQUEST_PROTOCOL"
+  | "VARIABLE_REQUEST_URI_RAW"
+  | "VARIABLE_RESPONSE_BODY"
+  | "VARIABLE_RESPONSE_CONTENT_LENGTH"
+  | "VARIABLE_RESPONSE_HEADERS"
+  | "VARIABLE_RESPONSE_HEADERS_NAMES"
+  | "VARIABLE_RESPONSE_PROTOCOL"
+  | "VARIABLE_RESPONSE_STATUS";
+export const Variable = /*@__PURE__*/ S.String;
+
+export interface ConditionVariable {
+  type: Variable | (string & {});
+  /** Optional key element context for map variables (e.g., matching a 'Host' header key). */
+  value?: string;
+}
+export const ConditionVariable = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: Variable,
+    value: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ConditionVariable",
+}) as any as S.Schema<ConditionVariable>;
+
+export interface Condition {
+  operator: ConditionOperator;
+  /** [HINT] Ordered processing adjustments applied to clean inputs before match checking. */
+  transformations?: ConditionTransformationsList;
+  variable: ConditionVariable;
+}
+export const Condition = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    operator: ConditionOperator,
+    transformations: S.optional(ConditionTransformationsList),
+    variable: ConditionVariable,
+  }),
+).annotate({ identifier: "Condition" }) as any as S.Schema<Condition>;
+
+/** [HINT] Order matters! First condition match triggers execution. */
+export type CreateCustomRuleConditionsList = Array<Condition>;
+export const CreateCustomRuleConditionsList = /*@__PURE__*/ S.Array(
+  Condition,
+) as any as S.Schema<CreateCustomRuleConditionsList>;
+
+export interface CreateCustomRule {
+  behavior: Behavior;
+  /** [HINT] Order matters! First condition match triggers execution. */
+  conditions: CreateCustomRuleConditionsList;
+  /** A clear description explaining the threat vector or criteria addressed by this rule. */
+  description?: string;
+}
+export const CreateCustomRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    behavior: Behavior,
+    conditions: CreateCustomRuleConditionsList,
+    description: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "CreateCustomRule",
+}) as any as S.Schema<CreateCustomRule>;
+
+/** The collection of custom rule group SecLang parameters forming this execution group. */
+export type CreateCustomRuleGroupRequestRulesList = Array<CreateCustomRule>;
+export const CreateCustomRuleGroupRequestRulesList = /*@__PURE__*/ S.Array(
+  CreateCustomRule,
+) as any as S.Schema<CreateCustomRuleGroupRequestRulesList>;
+
+export interface CreateCustomRuleGroupRequest {
+  projectId: string;
+  region: string;
+  /** Custom rule group name. */
+  name: string;
+  /** The collection of custom rule group SecLang parameters forming this execution group. */
+  rules: CreateCustomRuleGroupRequestRulesList;
+}
+export const CreateCustomRuleGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String,
+    rules: CreateCustomRuleGroupRequestRulesList,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/custom-rule-groups",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateCustomRuleGroupRequest",
+}) as any as S.Schema<CreateCustomRuleGroupRequest>;
+
+/** Severity classification metric used by internal analytics graphs. */
+export type Severity =
+  | "SEVERITY_EMERGENCY"
+  | "SEVERITY_ALERT"
+  | "SEVERITY_CRITICAL"
+  | "SEVERITY_ERROR"
+  | "SEVERITY_WARNING"
+  | "SEVERITY_NOTICE"
+  | "SEVERITY_INFO"
+  | "SEVERITY_DEBUG";
+export const Severity = /*@__PURE__*/ S.String;
+
+export interface GetBehavior {
+  action: Action;
+  /** Determines whether an entry should be generated in the security ledger upon a rule hit. */
+  log: boolean;
+  /** Custom notification message string mapped to underlying logdata contexts. */
+  logMsg?: string;
+  severity: Severity;
+}
+export const GetBehavior = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    action: Action,
+    log: S.Boolean,
+    logMsg: S.optional(S.String),
+    severity: Severity,
+  }),
+).annotate({ identifier: "GetBehavior" }) as any as S.Schema<GetBehavior>;
+
+/** [HINT] Order matters! First condition match triggers execution. */
+export type GetCustomRuleConditionsList = Array<Condition>;
+export const GetCustomRuleConditionsList = /*@__PURE__*/ S.Array(
+  Condition,
+) as any as S.Schema<GetCustomRuleConditionsList>;
+
+export interface GetCustomRule {
+  behavior: GetBehavior;
+  /** [HINT] Order matters! First condition match triggers execution. */
+  conditions: GetCustomRuleConditionsList;
+  /** A clear description explaining the threat vector or criteria addressed by this rule. */
+  description?: string;
+  /** Backend auto-allocated unique rule ID within the valid 1-99999 threshold. */
+  id: number;
+}
+export const GetCustomRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    behavior: GetBehavior,
+    conditions: GetCustomRuleConditionsList,
+    description: S.optional(S.String),
+    id: S.Number,
+  }),
+).annotate({ identifier: "GetCustomRule" }) as any as S.Schema<GetCustomRule>;
+
+/** Enriched rules containing auto-generated IDs and computed severity values. */
+export type GetCustomRuleGroupResponseRulesList = Array<GetCustomRule>;
+export const GetCustomRuleGroupResponseRulesList = /*@__PURE__*/ S.Array(
+  GetCustomRule,
+) as any as S.Schema<GetCustomRuleGroupResponseRulesList>;
+
+/** List of individual WAF configuration names that bind this rule group. */
+export type CRGUsageItemsList = Array<string>;
+export const CRGUsageItemsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CRGUsageItemsList>;
+
+/** Tracking metrics for CRG resource utilization */
+export interface CRGUsage {
+  /** Number of WAF configurations actively using this rule group. */
+  count?: number;
+  /** List of individual WAF configuration names that bind this rule group. */
+  items?: CRGUsageItemsList;
+}
+export const CRGUsage = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    count: S.optional(S.Number),
+    items: S.optional(CRGUsageItemsList),
+  }),
+).annotate({ identifier: "CRGUsage" }) as any as S.Schema<CRGUsage>;
+
+/** Response payload delivering the detailed CRG configuration name and it's rule content. */
+export interface GetCustomRuleGroupResponse {
+  /** Custom rule group configuration name. */
+  name: string;
+  /** Enriched rules containing auto-generated IDs and computed severity values. */
+  rules: GetCustomRuleGroupResponseRulesList;
+  usage?: CRGUsage;
+}
+export const GetCustomRuleGroupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String,
+    rules: GetCustomRuleGroupResponseRulesList,
+    usage: S.optional(CRGUsage),
+  }),
+).annotate({
+  identifier: "GetCustomRuleGroupResponse",
+}) as any as S.Schema<GetCustomRuleGroupResponse>;
+
+/** Set the managed rule set type. */
+export type Type = "TYPE_OWASP_CRS";
+export const Type = /*@__PURE__*/ S.String;
+
+export interface CreateManagedRuleSetRequest {
+  projectId: string;
+  region: string;
+  /** Managed rule set configuration name. */
+  name: string;
+  type: Type | (string & {});
+}
+export const CreateManagedRuleSetRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String,
+    type: Type,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/managed-rule-sets",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateManagedRuleSetRequest",
+}) as any as S.Schema<CreateManagedRuleSetRequest>;
+
+/** The current mode of the rule. */
+export type Mode = "MODE_ENABLED" | "MODE_DISABLED" | "MODE_LOG_ONLY";
+export const Mode = /*@__PURE__*/ S.String;
+
+/** Rule represents an individual security or validation rule. */
+export interface MRSRule {
+  /** A description of what this rule covers. */
+  description: string;
+  mode: Mode;
+  /** Impact level. */
+  severity: string;
+}
+export const MRSRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    description: S.String,
+    mode: Mode,
+    severity: S.String,
+  }),
+).annotate({ identifier: "MRSRule" }) as any as S.Schema<MRSRule>;
+
+export type MRSRuleGroupRulesMap = { [key: string]: MRSRule | undefined };
+export const MRSRuleGroupRulesMap = /*@__PURE__*/ S.Record(
+  S.String,
+  MRSRule,
+) as any as S.Schema<MRSRuleGroupRulesMap>;
+
+/** RuleGroup represents a collection of rules associated with a specific group. */
+export interface MRSRuleGroup {
+  /** A description of what this group covers. */
+  description: string;
+  /** The name for the rule group. */
+  groupName: string;
+  rules?: MRSRuleGroupRulesMap;
+}
+export const MRSRuleGroup = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    description: S.String,
+    groupName: S.String,
+    rules: S.optional(MRSRuleGroupRulesMap),
+  }),
+).annotate({ identifier: "MRSRuleGroup" }) as any as S.Schema<MRSRuleGroup>;
+
+/** Inventory of all available Managed Rule Set groups and their current configuration. The key is the unique Group ID. */
+export type GetManagedRuleSetResponseGroupsMap = {
+  [key: string]: MRSRuleGroup | undefined;
+};
+export const GetManagedRuleSetResponseGroupsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  MRSRuleGroup,
+) as any as S.Schema<GetManagedRuleSetResponseGroupsMap>;
+
+/** List of WAFs that use this Managed Rule Set. */
+export type MRSUsageItemsList = Array<string>;
+export const MRSUsageItemsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<MRSUsageItemsList>;
+
+export interface MRSUsage {
+  /** Number of WAFs using this Managed Rule Set. */
+  count?: number;
+  /** List of WAFs that use this Managed Rule Set. */
+  items?: MRSUsageItemsList;
+}
+export const MRSUsage = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    count: S.optional(S.Number),
+    items: S.optional(MRSUsageItemsList),
+  }),
+).annotate({ identifier: "MRSUsage" }) as any as S.Schema<MRSUsage>;
+
+/** GetManagedRuleSetResponse returns rule configuration name and it's rules. */
+export interface GetManagedRuleSetResponse {
+  /** Inventory of all available Managed Rule Set groups and their current configuration. The key is the unique Group ID. */
+  groups?: GetManagedRuleSetResponseGroupsMap;
+  /** Managed rule set configuration name. */
+  name: string;
+  type: Type;
+  usage?: MRSUsage;
+  /** Managed rule set version. */
+  version: string;
+}
+export const GetManagedRuleSetResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    groups: S.optional(GetManagedRuleSetResponseGroupsMap),
+    name: S.String,
+    type: Type,
+    usage: S.optional(MRSUsage),
+    version: S.String,
+  }),
+).annotate({
+  identifier: "GetManagedRuleSetResponse",
+}) as any as S.Schema<GetManagedRuleSetResponse>;
+
+/** Labels represent user-defined metadata as key-value pairs. Label count should not exceed 64 per WAF. **Key Formatting Rules:** Length: 1-63 characters. Characters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. Keys starting with 'stackit-' are system-reserved; users MUST NOT manage them. **Value Formatting Rules:** Length: 0-63 characters (empty string explicitly allowed). Characters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. */
+export type CreateWAFRequestLabelsMap = { [key: string]: string | undefined };
+export const CreateWAFRequestLabelsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<CreateWAFRequestLabelsMap>;
+
+export interface CreateWAFRequest {
+  projectId: string;
+  region: string;
+  /** Name of the CRG configuration for that WAF. */
+  customRuleGroupName?: string;
+  /** Labels represent user-defined metadata as key-value pairs. Label count should not exceed 64 per WAF. **Key Formatting Rules:** Length: 1-63 characters. Characters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. Keys starting with 'stackit-' are system-reserved; users MUST NOT manage them. **Value Formatting Rules:** Length: 0-63 characters (empty string explicitly allowed). Characters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. */
+  labels?: CreateWAFRequestLabelsMap;
+  /** Name of the managed rule set configuration for that WAF. */
+  managedRuleSetName?: string;
+  /** WAF name */
+  name: string;
+}
+export const CreateWAFRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    customRuleGroupName: S.optional(S.String),
+    labels: S.optional(CreateWAFRequestLabelsMap),
+    managedRuleSetName: S.optional(S.String),
+    name: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/regions/{region}/wafs",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateWAFRequest",
+}) as any as S.Schema<CreateWAFRequest>;
+
+/** Labels represent user-defined metadata as key-value pairs. Label count should not exceed 64 per WAF. **Key Formatting Rules:** Length: 1-63 characters. Characters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. Keys starting with 'stackit-' are system-reserved; users MUST NOT manage them. **Value Formatting Rules:** Length: 0-63 characters (empty string explicitly allowed). Characters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. */
+export type GetWAFResponseLabelsMap = { [key: string]: string | undefined };
+export const GetWAFResponseLabelsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<GetWAFResponseLabelsMap>;
+
+/** The list of listener names in this Load Balancer, that are using the WAF. */
+export type WAFUsageItemListenerNamesList = Array<string>;
+export const WAFUsageItemListenerNamesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WAFUsageItemListenerNamesList>;
+
+export interface WAFUsageItem {
+  /** The list of listener names in this Load Balancer, that are using the WAF. */
+  listenerNames?: WAFUsageItemListenerNamesList;
+  /** The display name of the Load Balancer. */
+  loadBalancerName: string;
+}
+export const WAFUsageItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    listenerNames: S.optional(WAFUsageItemListenerNamesList),
+    loadBalancerName: S.String,
+  }),
+).annotate({ identifier: "WAFUsageItem" }) as any as S.Schema<WAFUsageItem>;
+
+/** List of Application Load Balancers with their associated listeners that use this WAF configuration. */
+export type WAFUsageItemsList = Array<WAFUsageItem>;
+export const WAFUsageItemsList = /*@__PURE__*/ S.Array(
+  WAFUsageItem,
+) as any as S.Schema<WAFUsageItemsList>;
+
+export interface WAFUsage {
+  /** Number of listeners using this WAF configuration. */
+  count?: number;
+  /** List of Application Load Balancers with their associated listeners that use this WAF configuration. */
+  items?: WAFUsageItemsList;
+}
+export const WAFUsage = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    count: S.optional(S.Number),
+    items: S.optional(WAFUsageItemsList),
+  }),
+).annotate({ identifier: "WAFUsage" }) as any as S.Schema<WAFUsage>;
+
+/** GetWAFResponse returns detailed information about the WAF, which includes the identifying name, references to MRS/CRG and usage. */
+export interface GetWAFResponse {
+  /** Name of the CRG configuration for that WAF. */
+  customRuleGroupName?: string;
+  /** Labels represent user-defined metadata as key-value pairs. Label count should not exceed 64 per WAF. **Key Formatting Rules:** Length: 1-63 characters. Characters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. Keys starting with 'stackit-' are system-reserved; users MUST NOT manage them. **Value Formatting Rules:** Length: 0-63 characters (empty string explicitly allowed). Characters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. */
+  labels?: GetWAFResponseLabelsMap;
+  /** Name of the managed rule set configuration for that WAF. */
+  managedRuleSetName?: string;
+  /** WAF name */
+  name: string;
+  usage?: WAFUsage;
+}
+export const GetWAFResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    customRuleGroupName: S.optional(S.String),
+    labels: S.optional(GetWAFResponseLabelsMap),
+    managedRuleSetName: S.optional(S.String),
+    name: S.String,
+    usage: S.optional(WAFUsage),
+  }),
+).annotate({ identifier: "GetWAFResponse" }) as any as S.Schema<GetWAFResponse>;
+
+export interface DeleteCustomRuleGroupRequest {
+  projectId: string;
+  region: string;
+  name: string;
+}
+export const DeleteCustomRuleGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/custom-rule-groups/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteCustomRuleGroupRequest",
+}) as any as S.Schema<DeleteCustomRuleGroupRequest>;
+
+export type DeleteCustomRuleGroupResponse2 = unknown;
+export const DeleteCustomRuleGroupResponse2 = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "DeleteCustomRuleGroupResponse2",
+}) as any as S.Schema<DeleteCustomRuleGroupResponse2>;
+
+export interface DeleteManagedRuleSetRequest {
+  projectId: string;
+  region: string;
+  name: string;
+}
+export const DeleteManagedRuleSetRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/managed-rule-sets/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteManagedRuleSetRequest",
+}) as any as S.Schema<DeleteManagedRuleSetRequest>;
+
+export type DeleteManagedRuleSetResponse2 = unknown;
+export const DeleteManagedRuleSetResponse2 = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "DeleteManagedRuleSetResponse2",
+}) as any as S.Schema<DeleteManagedRuleSetResponse2>;
+
+export interface DeleteWAFRequest {
+  projectId: string;
+  region: string;
+  name: string;
+}
+export const DeleteWAFRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/regions/{region}/wafs/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteWAFRequest",
+}) as any as S.Schema<DeleteWAFRequest>;
+
+export type DeleteWAFResponse2 = unknown;
+export const DeleteWAFResponse2 = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "DeleteWAFResponse2",
+}) as any as S.Schema<DeleteWAFResponse2>;
+
+export interface GetCustomRuleGroupRequest {
+  projectId: string;
+  region: string;
+  name: string;
+}
+export const GetCustomRuleGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/custom-rule-groups/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetCustomRuleGroupRequest",
+}) as any as S.Schema<GetCustomRuleGroupRequest>;
+
+export interface GetManagedRuleSetRequest {
+  projectId: string;
+  region: string;
+  name: string;
+}
+export const GetManagedRuleSetRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/managed-rule-sets/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetManagedRuleSetRequest",
+}) as any as S.Schema<GetManagedRuleSetRequest>;
+
+export interface GetQuotaRequest {
+  projectId: string;
+  region: string;
+}
+export const GetQuotaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/quotas",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetQuotaRequest",
+}) as any as S.Schema<GetQuotaRequest>;
+
+/** CRG quotas holds the limit and usage for CRG resources */
+export interface CRGConfigQuota {
+  /** The maximum number of custom rule groups in this project. */
+  limit?: number;
+  /** The number of custom rule groups that are currently existing in this project. */
+  usage?: number;
+}
+export const CRGConfigQuota = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.optional(S.Number),
+    usage: S.optional(S.Number),
+  }),
+).annotate({ identifier: "CRGConfigQuota" }) as any as S.Schema<CRGConfigQuota>;
+
+/** MRS Config quota holds the limit and usage for Managed Rule Set configuration resources */
+export interface MRSConfigQuota {
+  /** The maximum number of Managed Rule Set configurations in this project. */
+  limit?: number;
+  /** The number of Managed Rule Set configurations that are currently existing in this project. */
+  usage?: number;
+}
+export const MRSConfigQuota = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.optional(S.Number),
+    usage: S.optional(S.Number),
+  }),
+).annotate({ identifier: "MRSConfigQuota" }) as any as S.Schema<MRSConfigQuota>;
+
+/** WAF Config quota holds the limit and usage for Web Application Firewall configuration resources */
+export interface WAFConfigQuota {
+  /** The maximum number of Web Application Firewall configurations in this project. */
+  limit?: number;
+  /** The number of Web Application Firewall configurations that are currently existing in this project. */
+  usage?: number;
+}
+export const WAFConfigQuota = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.optional(S.Number),
+    usage: S.optional(S.Number),
+  }),
+).annotate({ identifier: "WAFConfigQuota" }) as any as S.Schema<WAFConfigQuota>;
+
+/** Quotas holds the specific quota elements for different resources */
+export interface Quotas {
+  customRuleGroup: CRGConfigQuota;
+  managedRuleSet: MRSConfigQuota;
+  webApplicationFirewall: WAFConfigQuota;
+}
+export const Quotas = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    customRuleGroup: CRGConfigQuota,
+    managedRuleSet: MRSConfigQuota,
+    webApplicationFirewall: WAFConfigQuota,
+  }),
+).annotate({ identifier: "Quotas" }) as any as S.Schema<Quotas>;
+
+export interface GetQuotaResponse {
+  /** Project identifier */
+  projectId?: string;
+  quotas: Quotas;
+  /** Region */
+  region?: string;
+}
+export const GetQuotaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.optional(S.String),
+    quotas: Quotas,
+    region: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "GetQuotaResponse",
+}) as any as S.Schema<GetQuotaResponse>;
+
+export interface GetWAFRequest {
+  projectId: string;
+  region: string;
+  name: string;
+}
+export const GetWAFRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/wafs/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "GetWAFRequest" }) as any as S.Schema<GetWAFRequest>;
+
+export interface ListCustomRuleGroupRequest {
+  projectId: string;
+  region: string;
+  /** page_size specifies how many rule configurations should be returned on this page. Must be a positive number <= 1000 */
+  pageSize?: string;
+  /** page_id is a page identifier returned by the previous response and is used to request the next page */
+  pageId?: string;
+}
+export const ListCustomRuleGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    pageSize: S.optional(S.String.pipe(T.Query())),
+    pageId: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/custom-rule-groups",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListCustomRuleGroupRequest",
+}) as any as S.Schema<ListCustomRuleGroupRequest>;
+
+export type ListCustomRuleGroupResponseItemsList =
+  Array<GetCustomRuleGroupResponse>;
+export const ListCustomRuleGroupResponseItemsList = /*@__PURE__*/ S.Array(
+  GetCustomRuleGroupResponse,
+) as any as S.Schema<ListCustomRuleGroupResponseItemsList>;
+
+/** ListCustomRuleGroupResponse returns a list of Custom Rule Group responses. */
+export interface ListCustomRuleGroupResponse {
+  items?: ListCustomRuleGroupResponseItemsList;
+  /** Continue token from the ListCustomRuleGroupResponse with Limit option */
+  nextPageId?: string;
+}
+export const ListCustomRuleGroupResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    items: S.optional(ListCustomRuleGroupResponseItemsList),
+    nextPageId: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ListCustomRuleGroupResponse",
+}) as any as S.Schema<ListCustomRuleGroupResponse>;
+
+export interface ListManagedRuleSetsRequest {
+  projectId: string;
+  region: string;
+  /** page_size specifies how many rule configurations should be returned on this page. Must be a positive number <= 1000 */
+  pageSize?: string;
+  /** page_id is a page identifier returned by the previous response and is used to request the next page */
+  pageId?: string;
+}
+export const ListManagedRuleSetsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    pageSize: S.optional(S.String.pipe(T.Query())),
+    pageId: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/managed-rule-sets",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListManagedRuleSetsRequest",
+}) as any as S.Schema<ListManagedRuleSetsRequest>;
+
+export interface GetLimitedManagedRuleSetResponse {
+  /** Managed rule set configuration name. */
+  name: string;
+  type: Type;
+  usage?: MRSUsage;
+  /** Managed rule set version. */
+  version: string;
+}
+export const GetLimitedManagedRuleSetResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String,
+    type: Type,
+    usage: S.optional(MRSUsage),
+    version: S.String,
+  }),
+).annotate({
+  identifier: "GetLimitedManagedRuleSetResponse",
+}) as any as S.Schema<GetLimitedManagedRuleSetResponse>;
+
+export type ListManagedRuleSetResponseItemsList =
+  Array<GetLimitedManagedRuleSetResponse>;
+export const ListManagedRuleSetResponseItemsList = /*@__PURE__*/ S.Array(
+  GetLimitedManagedRuleSetResponse,
+) as any as S.Schema<ListManagedRuleSetResponseItemsList>;
+
+/** ListManagedRuleSetResponse returns a list of rule configuration responses. */
+export interface ListManagedRuleSetResponse {
+  items?: ListManagedRuleSetResponseItemsList;
+  /** Continue token from the ListManagedRuleSetResponse with Limit option */
+  nextPageId?: string;
+}
+export const ListManagedRuleSetResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    items: S.optional(ListManagedRuleSetResponseItemsList),
+    nextPageId: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ListManagedRuleSetResponse",
+}) as any as S.Schema<ListManagedRuleSetResponse>;
+
+export interface ListWAFRequest {
+  projectId: string;
+  region: string;
+  /** page_size specifies how many WAFs should be returned on this page. Must be a positive number <= 1000 */
+  pageSize?: string;
+  /** page_id is a page identifier returned by the previous response and is used to request the next page */
+  pageId?: string;
+}
+export const ListWAFRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    pageSize: S.optional(S.String.pipe(T.Query())),
+    pageId: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/regions/{region}/wafs",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "ListWAFRequest" }) as any as S.Schema<ListWAFRequest>;
+
+export type ListWAFResponseItemsList = Array<GetWAFResponse>;
+export const ListWAFResponseItemsList = /*@__PURE__*/ S.Array(
+  GetWAFResponse,
+) as any as S.Schema<ListWAFResponseItemsList>;
+
+/** ListWAFResponse returns a list of WAF responses. */
+export interface ListWAFResponse {
+  items?: ListWAFResponseItemsList;
+  /** Continue token from the ListWAFResponse with Limit option */
+  nextPageId?: string;
+}
+export const ListWAFResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    items: S.optional(ListWAFResponseItemsList),
+    nextPageId: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ListWAFResponse",
+}) as any as S.Schema<ListWAFResponse>;
+
+export interface PatchMRSRule {
+  mode?: Mode | (string & {});
+}
+export const PatchMRSRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    mode: S.optional(Mode),
+  }),
+).annotate({ identifier: "PatchMRSRule" }) as any as S.Schema<PatchMRSRule>;
+
+export type PatchMRSRuleGroupRulesMap = {
+  [key: string]: PatchMRSRule | undefined;
+};
+export const PatchMRSRuleGroupRulesMap = /*@__PURE__*/ S.Record(
+  S.String,
+  PatchMRSRule,
+) as any as S.Schema<PatchMRSRuleGroupRulesMap>;
+
+export interface PatchMRSRuleGroup {
+  rules: PatchMRSRuleGroupRulesMap;
+}
+export const PatchMRSRuleGroup = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    rules: PatchMRSRuleGroupRulesMap,
+  }),
+).annotate({
+  identifier: "PatchMRSRuleGroup",
+}) as any as S.Schema<PatchMRSRuleGroup>;
+
+/** Map of Managed Rule Set groups to be patched. The key is the Group ID (e.g., 942 for SQL Injection). Only provided rules within the group will be updated; others remain unchanged. */
+export type PatchManagedRuleSetRequestGroupsMap = {
+  [key: string]: PatchMRSRuleGroup | undefined;
+};
+export const PatchManagedRuleSetRequestGroupsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  PatchMRSRuleGroup,
+) as any as S.Schema<PatchManagedRuleSetRequestGroupsMap>;
+
+export interface PatchManagedRuleSetRequest {
+  projectId: string;
+  region: string;
+  name: string;
+  /** Map of Managed Rule Set groups to be patched. The key is the Group ID (e.g., 942 for SQL Injection). Only provided rules within the group will be updated; others remain unchanged. */
+  groups: PatchManagedRuleSetRequestGroupsMap;
+}
+export const PatchManagedRuleSetRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    groups: PatchManagedRuleSetRequestGroupsMap,
+  }).pipe(
+    T.Http({
+      method: "PATCH",
+      uri: "/v1/projects/{projectId}/regions/{region}/managed-rule-sets/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "PatchManagedRuleSetRequest",
+}) as any as S.Schema<PatchManagedRuleSetRequest>;
+
+/** The collection of custom rule group SecLang parameters forming this execution group. Replaces the existing rules atomically. */
+export type UpdateCustomRuleGroupRequestRulesList = Array<CreateCustomRule>;
+export const UpdateCustomRuleGroupRequestRulesList = /*@__PURE__*/ S.Array(
+  CreateCustomRule,
+) as any as S.Schema<UpdateCustomRuleGroupRequestRulesList>;
+
+export interface UpdateCustomRuleGroupRequest {
+  projectId: string;
+  region: string;
+  name: string;
+  /** The collection of custom rule group SecLang parameters forming this execution group. Replaces the existing rules atomically. */
+  rules: UpdateCustomRuleGroupRequestRulesList;
+}
+export const UpdateCustomRuleGroupRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    rules: UpdateCustomRuleGroupRequestRulesList,
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/regions/{region}/custom-rule-groups/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateCustomRuleGroupRequest",
+}) as any as S.Schema<UpdateCustomRuleGroupRequest>;
+
+/** Labels represent user-defined metadata as key-value pairs. Label count should not exceed 64 per WAF. **Key Formatting Rules:** Length: 1-63 characters. Characters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. Keys starting with 'stackit-' are system-reserved; users MUST NOT manage them. **Value Formatting Rules:** Length: 0-63 characters (empty string explicitly allowed). Characters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. */
+export type UpdateWAFRequestLabelsMap = { [key: string]: string | undefined };
+export const UpdateWAFRequestLabelsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<UpdateWAFRequestLabelsMap>;
+
+export interface UpdateWAFRequest {
+  projectId: string;
+  region: string;
+  name: string;
+  /** Name of the CRG configuration for that WAF. */
+  customRuleGroupName?: string;
+  /** Labels represent user-defined metadata as key-value pairs. Label count should not exceed 64 per WAF. **Key Formatting Rules:** Length: 1-63 characters. Characters: Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. Keys starting with 'stackit-' are system-reserved; users MUST NOT manage them. **Value Formatting Rules:** Length: 0-63 characters (empty string explicitly allowed). Characters (for non-empty values): Must begin and end with [a-zA-Z0-9]. May contain dashes (-), underscores (_), dots (.), and alphanumerics in between. */
+  labels?: UpdateWAFRequestLabelsMap;
+  /** Name of the managed rule set configuration for that WAF. */
+  managedRuleSetName?: string;
+}
+export const UpdateWAFRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    region: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    customRuleGroupName: S.optional(S.String),
+    labels: S.optional(UpdateWAFRequestLabelsMap),
+    managedRuleSetName: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/regions/{region}/wafs/{name}",
+      code: 200,
+      baseUrl: "https://alb-waf.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "UpdateWAFRequest",
+}) as any as S.Schema<UpdateWAFRequest>;
+
+export type CreateCustomRuleGroupError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** Create a CRG configuration Creates a structured rule configuration using the abstract CRG. It can be referenced by any number of WAF configurations in the same project. */
+export const createCustomRuleGroup: API.OperationMethod<
+  CreateCustomRuleGroupRequest,
+  GetCustomRuleGroupResponse,
+  CreateCustomRuleGroupError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateCustomRuleGroupRequest,
+  output: GetCustomRuleGroupResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateManagedRuleSetError = BadRequest | Forbidden | StackitOpError;
+/** Create a MRS configuration With this endpoint a managed rule set (MRS) configuration is created and stored in this project. Currently it is only possible to enable it. This rule configuration is supposed to be referenced by a WAF configuration. It can be referenced by any number of WAF configurations in the same project. */
+export const createManagedRuleSet: API.OperationMethod<
+  CreateManagedRuleSetRequest,
+  GetManagedRuleSetResponse,
+  CreateManagedRuleSetError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateManagedRuleSetRequest,
+  output: GetManagedRuleSetResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateWAFError = BadRequest | Forbidden | StackitOpError;
+/** Create a WAF configuration This endpoint will create and store a WAF configuration in a project. The name of this WAF configuration is supposed to be used in the listener of an Application Load Balancer, which will activate this configuration and in addition it is possible to enable the managed rule set. This WAF configuration can be used by any number of Application Load Balancers in the same project. The configuration has a reference to a rule configuration. This rule configuration has to exist when trying to create a WAF configuration. Later other configuration references will be added to this object. */
+export const createWAF: API.OperationMethod<
+  CreateWAFRequest,
+  GetWAFResponse,
+  CreateWAFError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateWAFRequest,
+  output: GetWAFResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteCustomRuleGroupError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** Delete a CRG configuration To delete a custom rule group configuration this endpoint is used, but it is only possible to delete it if no WAF configuration is referencing it. */
+export const deleteCustomRuleGroup: API.OperationMethod<
+  DeleteCustomRuleGroupRequest,
+  DeleteCustomRuleGroupResponse2,
+  DeleteCustomRuleGroupError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteCustomRuleGroupRequest,
+  output: DeleteCustomRuleGroupResponse2,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteManagedRuleSetError = BadRequest | Forbidden | StackitOpError;
+/** Delete a MRS configuration To delete a managed rule set (MRS) configuration this endpoint is used, but it is only possible to delete it if no WAF configuration is referencing it. */
+export const deleteManagedRuleSet: API.OperationMethod<
+  DeleteManagedRuleSetRequest,
+  DeleteManagedRuleSetResponse2,
+  DeleteManagedRuleSetError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteManagedRuleSetRequest,
+  output: DeleteManagedRuleSetResponse2,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteWAFError = BadRequest | Forbidden | StackitOpError;
+/** Delete a WAF configuration This will delete the specified WAF configuration, but only if it is not used by any Application Load Balancer in the project. */
+export const deleteWAF: API.OperationMethod<
+  DeleteWAFRequest,
+  DeleteWAFResponse2,
+  DeleteWAFError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteWAFRequest,
+  output: DeleteWAFResponse2,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetCustomRuleGroupError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | StackitOpError;
+/** Retrieve a CRG configuration Retrieves the specified SecLang custom rule configuration (CRG) structure. */
+export const getCustomRuleGroup: API.OperationMethod<
+  GetCustomRuleGroupRequest,
+  GetCustomRuleGroupResponse,
+  GetCustomRuleGroupError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetCustomRuleGroupRequest,
+  output: GetCustomRuleGroupResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetManagedRuleSetError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | StackitOpError;
+/** Retrieve a MRS configuration To retrieve an existing managed rule set (MRS) configuration this endpoint can be used. */
+export const getManagedRuleSet: API.OperationMethod<
+  GetManagedRuleSetRequest,
+  GetManagedRuleSetResponse,
+  GetManagedRuleSetError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetManagedRuleSetRequest,
+  output: GetManagedRuleSetResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetQuotaError = BadRequest | Forbidden | StackitOpError;
+/** Get the quota for WAF resources in a project. Retrieves the configured WAF resource quotas for the project. Limit can be changed via service request. */
+export const getQuota: API.OperationMethod<
+  GetQuotaRequest,
+  GetQuotaResponse,
+  GetQuotaError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetQuotaRequest,
+  output: GetQuotaResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetWAFError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Retrieve a WAF configuration This endpoint will return the specified WAF configuration. */
+export const getWAF: API.OperationMethod<
+  GetWAFRequest,
+  GetWAFResponse,
+  GetWAFError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetWAFRequest,
+  output: GetWAFResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListCustomRuleGroupError = BadRequest | Forbidden | StackitOpError;
+/** List of CRG configurations List all existing Custom Rule Groups that are stored in the project. */
+export const listCustomRuleGroup: API.OperationMethod<
+  ListCustomRuleGroupRequest,
+  ListCustomRuleGroupResponse,
+  ListCustomRuleGroupError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListCustomRuleGroupRequest,
+  output: ListCustomRuleGroupResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListManagedRuleSetsError = BadRequest | Forbidden | StackitOpError;
+/** List of MRS configurations List all existing managed rule set (MRS) configurations that are stored in the project. */
+export const listManagedRuleSets: API.OperationMethod<
+  ListManagedRuleSetsRequest,
+  ListManagedRuleSetResponse,
+  ListManagedRuleSetsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListManagedRuleSetsRequest,
+  output: ListManagedRuleSetResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListWAFError = BadRequest | Forbidden | StackitOpError;
+/** List of WAF configurations To list all WAF configurations stored in a project, use this endpoint. */
+export const listWAF: API.OperationMethod<
+  ListWAFRequest,
+  ListWAFResponse,
+  ListWAFError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListWAFRequest,
+  output: ListWAFResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PatchManagedRuleSetError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | StackitOpError;
+/** Granularly update a MRS configuration Accepts the same structure as the GET response. Only fields provided with values will be updated. */
+export const patchManagedRuleSet: API.OperationMethod<
+  PatchManagedRuleSetRequest,
+  GetManagedRuleSetResponse,
+  PatchManagedRuleSetError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PatchManagedRuleSetRequest,
+  output: GetManagedRuleSetResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateCustomRuleGroupError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** Update a CRG configuration Replaces the rules array of an existing CRG. The CRG name is immutable and used as the resource key. Send the complete desired rule set; per-rule partial merge is not supported. */
+export const updateCustomRuleGroup: API.OperationMethod<
+  UpdateCustomRuleGroupRequest,
+  GetCustomRuleGroupResponse,
+  UpdateCustomRuleGroupError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateCustomRuleGroupRequest,
+  output: GetCustomRuleGroupResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateWAFError = BadRequest | Forbidden | Conflict | StackitOpError;
+/** Update a WAF configuration The update endpoint will update a stored WAF configuration in project and also for all the Load Balancers that have it referenced. */
+export const updateWAF: API.OperationMethod<
+  UpdateWAFRequest,
+  GetWAFResponse,
+  UpdateWAFError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateWAFRequest,
+  output: GetWAFResponse,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));