feature(resource/http): add when attribute with destroy-time execution

- Introduce optional when attribute for http resource: apply (default) or destroy
- Execute HTTP request on Create/Update when when = "apply"
- Execute HTTP request only on Delete when when = "destroy"
- Do not send HTTP requests on Read; preserve state on Update when when = "destroy"
- Ensure all computed fields are set to known values when skipping requests (id, headers, body, body_base64, status_code)
- Add tests for apply, destroy, and default behaviors
- Update docs and examples to cover when semantics

Author: Prajwal-Shah

docs/resources/http.md

@@ -23,6 +23,7 @@ The `http` resource makes an HTTP request to the given URL and exports informati
 ## Example Usage
 
 ```terraform
+# Basic usage - request sent during apply (default behavior)
 resource "http" "example" {
   url = "https://checkpoint-api.hashicorp.com/v1/check/terraform"
 
@@ -38,6 +39,15 @@ resource "http" "example" {
   # method       = "POST"
   # request_body = "request body"
 }
+
+# Request sent only during resource destruction
+resource "http" "cleanup" {
+  url = "https://api.example.com/cleanup"
+  method = "DELETE"
+  
+  # Request is only sent when the resource is destroyed
+  when = "destroy"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -58,6 +68,7 @@ resource "http" "example" {
 - `request_headers` (Map of String) A map of request header field names and values.
 - `request_timeout_ms` (Number) The request timeout in milliseconds.
 - `retry` (Block, Optional) Retry request configuration. (attempts, min_delay_ms, max_delay_ms)
+- `when` (String) When to send the HTTP request. Valid values are `apply` (default) and `destroy`. When set to `apply`, the request is sent during resource creation and updates. When set to `destroy`, the request is only sent during resource destruction.
 
 ### Read-Only
 

examples/resources/http/when_attribute.tf

@@ -0,0 +1,47 @@
+# Example 1: HTTP request on apply (default behavior)
+resource "http" "example_apply" {
+  url = "https://httpbin.org/get"
+  
+  request_headers = {
+    Accept = "application/json"
+  }
+  
+  # This is the default behavior - request is sent during apply
+  when = "apply"
+}
+
+# Example 2: HTTP request only on destroy
+resource "http" "example_destroy" {
+  url = "https://httpbin.org/delete"
+  method = "DELETE"
+  
+  request_headers = {
+    Accept = "application/json"
+  }
+  
+  # Request is only sent during resource destruction
+  when = "destroy"
+}
+
+# Example 3: Default behavior (no when attribute specified)
+resource "http" "example_default" {
+  url = "https://httpbin.org/get"
+  
+  request_headers = {
+    Accept = "application/json"
+  }
+  
+  # No "when" attribute specified - defaults to "apply"
+}
+
+output "example_apply_status_code" {
+  value = http.example_apply.status_code
+}
+
+output "example_destroy_status_code" {
+  value = http.example_destroy.status_code
+}
+
+output "example_default_status_code" {
+  value = http.example_default.status_code
+}

internal/provider/data_source_http.go

@@ -160,6 +160,20 @@ a 5xx-range (except 501) status code is received. For further details see
 				Optional:    true,
 			},
 
+			"when": schema.StringAttribute{
+				Description: "When to send the HTTP request. Valid values are `apply` (default) and `destroy`. " +
+					"When set to `apply`, the request is sent during resource creation and updates. " +
+					"When set to `destroy`, the request is only sent during resource destruction. " +
+					"This attribute is only applicable to the http resource, not the data source.",
+				Optional: true,
+				Validators: []validator.String{
+					stringvalidator.OneOf([]string{
+						"apply",
+						"destroy",
+					}...),
+				},
+			},
+
 			"response_headers": schema.MapAttribute{
 				Description: `A map of response header field names and values.` +
 					` Duplicate headers are concatenated according to [RFC2616](https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2).`,
@@ -428,6 +442,7 @@ type modelV0 struct {
 	RequestBody        types.String `tfsdk:"request_body"`
 	RequestTimeout     types.Int64  `tfsdk:"request_timeout_ms"`
 	Retry              types.Object `tfsdk:"retry"`
+	When               types.String `tfsdk:"when"`
 	ResponseHeaders    types.Map    `tfsdk:"response_headers"`
 	CaCertificate      types.String `tfsdk:"ca_cert_pem"`
 	ClientCert         types.String `tfsdk:"client_cert_pem"`

internal/provider/resource_http.go

@@ -20,6 +20,7 @@ import (
 	"github.com/hashicorp/go-retryablehttp"
 	"github.com/hashicorp/terraform-plugin-framework-validators/int64validator"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
@@ -157,6 +158,19 @@ func (r *httpResource) Schema(ctx context.Context, req resource.SchemaRequest, r
 				Optional:    true,
 			},
 
+			"when": rs.StringAttribute{
+				Description: "When to send the HTTP request. Valid values are `apply` (default) and `destroy`. " +
+					"When set to `apply`, the request is sent during resource creation and updates. " +
+					"When set to `destroy`, the request is only sent during resource destruction.",
+				Optional: true,
+				Validators: []validator.String{
+					stringvalidator.OneOf([]string{
+						"apply",
+						"destroy",
+					}...),
+				},
+			},
+
 			"response_headers": rs.MapAttribute{
 				Description: `A map of response header field names and values.` +
 					` Duplicate headers are concatenated according to [RFC2616](https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2).`,
@@ -214,9 +228,31 @@ func (r *httpResource) Create(ctx context.Context, req resource.CreateRequest, r
 	if resp.Diagnostics.HasError() {
 		return
 	}
-	if err := r.performRequest(ctx, &model, &resp.Diagnostics); err != nil {
-		return
+
+	// Only perform request if "when" is set to "apply" (default behavior when not specified)
+	whenValue := "apply"
+	if !model.When.IsNull() && !model.When.IsUnknown() {
+		whenValue = model.When.ValueString()
+	}
+
+	if whenValue == "apply" {
+		if err := r.performRequest(ctx, &model, &resp.Diagnostics); err != nil {
+			return
+		}
+	} else {
+		// Set default values for computed fields when not making request
+		model.ID = types.StringValue(model.URL.ValueString())
+
+		// Create an empty map for response headers
+		emptyHeaders := make(map[string]attr.Value)
+		model.ResponseHeaders = types.MapValueMust(types.StringType, emptyHeaders)
+
+		model.ResponseBody = types.StringValue("")
+		model.Body = types.StringValue("")
+		model.ResponseBodyBase64 = types.StringValue("")
+		model.StatusCode = types.Int64Value(0)
 	}
+
 	diags = resp.State.Set(ctx, model)
 	resp.Diagnostics.Append(diags...)
 }
@@ -228,26 +264,96 @@ func (r *httpResource) Read(ctx context.Context, req resource.ReadRequest, resp
 	if resp.Diagnostics.HasError() {
 		return
 	}
+	// No HTTP request is performed during read operations
+	// Ensure computed fields are properly set if they're null/unknown
+	if model.ID.IsNull() || model.ID.IsUnknown() {
+		model.ID = types.StringValue(model.URL.ValueString())
+	}
+	if model.ResponseHeaders.IsNull() || model.ResponseHeaders.IsUnknown() {
+		emptyHeaders := make(map[string]attr.Value)
+		model.ResponseHeaders = types.MapValueMust(types.StringType, emptyHeaders)
+	}
+	if model.ResponseBody.IsNull() || model.ResponseBody.IsUnknown() {
+		model.ResponseBody = types.StringValue("")
+	}
+	if model.Body.IsNull() || model.Body.IsUnknown() {
+		model.Body = types.StringValue("")
+	}
+	if model.ResponseBodyBase64.IsNull() || model.ResponseBodyBase64.IsUnknown() {
+		model.ResponseBodyBase64 = types.StringValue("")
+	}
+	if model.StatusCode.IsNull() || model.StatusCode.IsUnknown() {
+		model.StatusCode = types.Int64Value(0)
+	}
+
 	diags = resp.State.Set(ctx, model)
 	resp.Diagnostics.Append(diags...)
 }
 
 func (r *httpResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
-	var model modelV0
-	diags := req.Plan.Get(ctx, &model)
-	resp.Diagnostics.Append(diags...)
+	// Preserve computed fields across updates; reflect config changes and optionally perform request
+	var plan, state modelV0
+	var diags diag.Diagnostics
+
+	// Read desired configuration from plan
+	d := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(d...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
-	if err := r.performRequest(ctx, &model, &resp.Diagnostics); err != nil {
+
+	// Read prior state to retain computed fields when needed
+	d = req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(d...)
+	if resp.Diagnostics.HasError() {
 		return
 	}
+
+	whenValue := "apply"
+	if !plan.When.IsNull() && !plan.When.IsUnknown() {
+		whenValue = plan.When.ValueString()
+	}
+
+	// Begin with desired config (plan)
+	model := plan
+
+	if whenValue == "apply" {
+		if err := r.performRequest(ctx, &model, &resp.Diagnostics); err != nil {
+			return
+		}
+	} else {
+		// Keep previous computed fields when not issuing a request
+		model.ID = state.ID
+		model.ResponseHeaders = state.ResponseHeaders
+		model.ResponseBody = state.ResponseBody
+		model.Body = state.Body
+		model.ResponseBodyBase64 = state.ResponseBodyBase64
+		model.StatusCode = state.StatusCode
+	}
+
 	diags = resp.State.Set(ctx, model)
 	resp.Diagnostics.Append(diags...)
 }
 
 func (r *httpResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
-	// No remote deletion; removing from state is sufficient.
+	var model modelV0
+	diags := req.State.Get(ctx, &model)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Only perform request if "when" is set to "destroy"
+	whenValue := "apply"
+	if !model.When.IsNull() && !model.When.IsUnknown() {
+		whenValue = model.When.ValueString()
+	}
+
+	if whenValue == "destroy" {
+		if err := r.performRequest(ctx, &model, &resp.Diagnostics); err != nil {
+			return
+		}
+	}
 }
 
 func (r *httpResource) performRequest(ctx context.Context, model *modelV0, diags *diag.Diagnostics) error {