[ BUG ] Removing the only firewall rule left within a rule group keeps asking for rule id array

[GabrielNBJJ]

Describe the bug
When you have a firewall rule group with only one singular rule in it and you are trying to delete that group, the API response keeps serving back

{'code': 400, 'message': "rule group 'rule_ids' array must be provided"}

I have tried feeding it:

• [] // Empty array
• None
• Delete it entirely

Example syntax
The following syntax should work but does not when there is only one rule in the rule group.

firewall.update_rule_group(rule_ids=[], tracking="TRACKING_ID_HERE", id="RULE_GROUP_ID_HERE", diff_op="remove", diff_path="/rules/0")

[jshcodes]

Hi @GabrielNBJJ -

This bug is confirmed! When provided the necessary payload elements for this operation when there is only one rule in the rule group, the rule_ids keyword is being discarded. This only occurs when rule_ids is an empty list.

Thank you for reporting this issue, we are working on addressing it now. In the interim you can use a raw body payload to accomplish this operation.

from falconpy import FirewallManagement

firewall = FirewallManagement()

payload = {
    "id": "RULE_GROUP_ID",
    "diff_type": "application/json-patch+json",
    "rule_ids": [],
    "rule_versions": [],
    "tracking": "TRACKING ID HERE",
    "diff_operations": [
        {
            "op": "remove",
            "path": "/rules/0"
        }
    ]
}

firewall.update_rule_group(body=payload)