We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to whitelist all the APIs and static resources of an application. Although from the security perspective it is good, I have to deal with the development team every day for opening new paths for them. It is kind of frustrating and needs a new changes to all environment every day. I was thinking maybe it is not the best approach for using a WAF. Do you now any best practice for this issue?
Not sure there is a 'best practice' as every organisation is different, however a very common practice in large enterprises is to use a combination of white and black-listing.
For Dev environments you may just want to blacklist, because changes are very frequent.
For Prod environments whitelist and lock down as much as you can. And blacklist known bad sites.
Where you have different applications in different DMZ's you can work on a risk-based and change-based mechanism and have some combination of the above, so that every firewall has a setup based on the profile needed.