Terraform apply fails on genesyscloud_security_authenticationprovider with 400 Bad Request

Looking for advice on configuring SAML via Terraform. The apply phase aborts with a 400 error. The provider resource seems valid, yet the API rejects the assertion consumer service URL.

Error: 400 Bad Request
Message: Invalid ACS URL format for SAML provider

Running provider v1.25.0. Environment is us-east-1. The XML metadata parses correctly in Postman. Is there a specific URL constraint for the ACS endpoint in the HCL definition?