fix: complete endpoint coverage and the defects the new tests found

CHANGELOG.md

@@ -19,18 +19,16 @@ FEATURES:
 
 NOTES:
 
-* Endpoint URLs with the credential removed are named `safe_http_url` and
-  `safe_wss_url`, and carry the literal `TOKEN` where the credential belongs
-  rather than having it cut out. The real URL's shape survives, including any
-  path suffix the chain appends after the token, so
-  `replace(..., "TOKEN", token)` reproduces a working address on every chain.
-
-* `quicknode_endpoint` gains `security_options`, which decides what the endpoint
-  enforces, and `ip_custom_header` for endpoints behind a proxy. A toggle left
-  out of the configuration keeps whatever value the endpoint already has.
-* Allowlist entries are imported by value rather than by the id the API
-  assigned, so `terraform import quicknode_endpoint_ip.office 652052/203.0.113.7`
-  needs nothing looked up first.
-* Adding an allowlist entry while its toggle is disabled warns rather than
-  fails. Building an allowlist before enabling enforcement is the safe order for
-  an endpoint already serving traffic.
+* `safe_http_url` and `safe_wss_url` carry the literal `TOKEN` where the credential
+  belongs, so `replace(url, "TOKEN", token)` rebuilds a working address on every chain.
+* `quicknode_endpoint.security_options` decides what the endpoint enforces. A toggle
+  left out of the configuration keeps the value the endpoint already has.
+* `quicknode_endpoint.ip_custom_header` names the header an endpoint behind a proxy
+  reads the caller's IP address from.
+* Allowlist entries are imported by value, as `652052/203.0.113.7`.
+* Adding an allowlist entry while its toggle is disabled warns and succeeds, so an
+  allowlist can be built before enforcement is turned on.
+* `quicknode_endpoint.label` cannot be cleared once set, so removing the attribute
+  leaves the endpoint's label in place.
+* `quicknode_endpoint_jwt` takes `kid` as an input. The Admin API requires it when
+  the signing key is registered.

README.md

@@ -35,8 +35,8 @@ resource "quicknode_endpoint" "payments" {
 ```
 
 Authentication uses a Quicknode [API key](https://www.quicknode.com/docs/admin-api),
-available on paid plans. Set `QUICKNODE_API_KEY` in the environment rather than
-writing it into a configuration file.
+available on paid plans. Set `QUICKNODE_API_KEY` in the environment; do not
+write it into a configuration file.
 
 The provider covers endpoints, the security mechanisms they enforce and who is
 allowed past them, RPC method filtering, and rate limits both endpoint-wide and

api/admin/patches.json

@@ -331,5 +331,24 @@
         }
       }
     }
+  },
+  {
+    "op": "set",
+    "path": "/paths/~1v0~1endpoints~1{id}~1security/get/responses/200/content/application~1json/schema/properties/data/properties/domain_masks",
+    "value": {
+      "description": "An array of domain mask entries; null if none configured",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "domain": {
+            "type": "string"
+          }
+        }
+      }
+    }
   }
 ]

examples/data-sources/quicknode_chains/data-source.tf

@@ -1,7 +1,7 @@
 data "quicknode_chains" "all" {}
 
 # Chain slugs are abbreviations that often differ from the chain's name, so look
-# one up rather than hardcoding it.
+# one up instead of hardcoding it.
 locals {
   ethereum = one([for chain in data.quicknode_chains.all.chains : chain if chain.slug == "eth"])
 }

examples/resources/quicknode_endpoint_ip/resource.tf

@@ -14,7 +14,7 @@ resource "quicknode_endpoint_ip" "office" {
 
 # Entries may be added before the toggle is enabled, which is the safe order for
 # an endpoint already serving traffic. Adding one while security_options.ips is
-# false produces a warning rather than an error.
+# false produces a warning and not an error.
 resource "quicknode_endpoint_ip" "vpn" {
   endpoint_id = quicknode_endpoint.api.id
   ip          = "198.51.100.0/24"

examples/resources/quicknode_endpoint_jwt/resource.tf

@@ -11,11 +11,9 @@ resource "quicknode_endpoint" "api" {
 resource "quicknode_endpoint_jwt" "signer" {
   endpoint_id = quicknode_endpoint.api.id
   name        = "signer"
+  kid         = "signer-2026-01"
   public_key  = file("${path.module}/signer.pub.pem")
 }
 
-# Put the generated kid in the header of the tokens signed with the matching
-# private key.
-output "jwt_kid" {
-  value = quicknode_endpoint_jwt.signer.kid
-}
+# Tokens signed with the matching private key carry the same kid in their
+# header, which is how Quicknode picks the key to verify them with.

examples/resources/quicknode_endpoint_token/import.sh

@@ -1,3 +1,3 @@
-# Tokens are imported by id rather than by value, as "<endpoint id>/<token id>",
-# so the credential stays out of shell history.
+# Tokens are imported by id, as "<endpoint id>/<token id>", which keeps the
+# credential out of shell history.
 terraform import quicknode_endpoint_token.indexer 652052/d3312bd2-c1a2-4d89-865f-11c99fa3863a