Bug: Missing URI scheme in NETBOX_SERVER_URL allows reads but breaks updates silently

[omicron8]

Description

If NETBOX_SERVER_URL is specified without a URI scheme (for example, only the hostname), the provider is still able to:

• Successfully authenticate
• Read data from Netbox
• Produce a correct terraform plan

However, during terraform apply, the update operation does not actually modify the object in Netbox - even though Terraform reports a successful apply.

When the same URL is provided with a scheme (https://), everything works as expected.

Environment

• Provider version: ≥ 5.0.0
• Terraform version: 1.5.7
• NetBox version: 4.4.6
• Authentication: API token
• Configuration method: NETBOX_SERVER_URL environment variable

Configuration

Failing configuration:

export NETBOX_SERVER_URL=netbox.example.com

Working configuration:

export NETBOX_SERVER_URL=https://netbox.example.com

Actual Behavior

• Read operations work without scheme
• terraform plan shows correct changes
• terraform apply reports success.
• Object in Netbox remains unchanged
• Plan continues to show the same drift

This creates a silent configuration drift and false-positive success, which is potentially dangerous.

Example Plan

Terraform will perform the following actions:

  # module.netbox_instance["server1"].netbox_virtual_machine.default[0] will be updated in-place
  ~ resource "netbox_virtual_machine" "default" {
      ~ custom_fields = {
          ~ "managed_by"     = "manual" -> "terraform"
            # (3 unchanged elements hidden)
        }
      ~ description   = "" -> "Very important description"
        id            = "6666"
        name          = "server1"
        # (10 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Debug Output

2026-02-27T13:35:36.170Z [WARN]  Provider "provider[\"registry.terraform.io/e-breuninger/netbox\"]" produced an unexpected new value for module.netbox_instance["server1"].netbox_virtual_machine.default[0], but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .custom_fields: new element "managed_by" has appeared
      - .description: was cty.StringVal("Very important description"), but now cty.StringVal("")

Expected Behavior

One of the following should happen:

1. The provider should normalize the URL and automatically prepend https:// if missing
2. The provider should fail fast with a clear validation error if the URI scheme is missing.

Under no circumstances should terraform apply report success while not performing the update.