Zscaler

Connect your Zscaler tenant by saving OneAPI OAuth2 client credentials (client_id, client_secret, vanity_domain, cloud), after checking they actually work. Create an OAuth2 client in Zidentity Admin Portal > API Clients, granting it the ZIA and/or ZPA scopes you need.

Disconnect a Zscaler tenant: deletes the saved OneAPI credentials. Nothing in Zscaler itself is changed.

List the connected Zscaler tenants.

List ZIA locations -- the sites/offices/roaming-user groups that policies are assigned to.

Read one ZIA location in full.

Create a new ZIA location. Requires activate_zia_changes afterward to take effect.

Update selected fields of an existing ZIA location. Requires activate_zia_changes afterward to take effect.

Permanently delete a ZIA location. Requires activate_zia_changes afterward to take effect. Cannot be undone.

List ZIA URL Filtering rules, in their enforced order.

Read one ZIA URL Filtering rule in full.

Create a new ZIA URL Filtering rule. Requires activate_zia_changes afterward to take effect.

Update selected fields of an existing ZIA URL Filtering rule (name, action, order, state). Requires activate_zia_changes afterward.

Permanently delete a ZIA URL Filtering rule. Requires activate_zia_changes afterward. Cannot be undone.

List ZIA cloud Firewall Filtering rules.

Create a new ZIA Firewall Filtering rule. Requires activate_zia_changes afterward to take effect.

Permanently delete a ZIA Firewall Filtering rule. Requires activate_zia_changes afterward. Cannot be undone.

List ZIA Cloud App Control rules (SaaS application access rules).

List ZIA users -- the identities policies apply to.

Create a new ZIA user.

List ZIA groups, used to assign policies to sets of users.

Check/submit a file hash to Zscaler Sandbox for malware analysis.

Read a previously submitted Zscaler Sandbox report by file hash.

Activate (commit) all pending ZIA configuration changes so they take effect. ZIA batches edits until this is called explicitly -- same reasoning as ZIA's own admin console 'Activate' button.

List ZPA Application Segments -- the private applications users can be granted ZTNA access to without a VPN.

Read one ZPA Application Segment in full.

Create a new ZPA Application Segment -- register a private app (by domain names + ports) so it can be granted ZTNA access policies.

Update selected fields of an existing ZPA Application Segment.

Permanently delete a ZPA Application Segment. Cannot be undone.

List ZPA Access Policy rules -- who is allowed to reach which app segments, and under what conditions.

Create a new ZPA Access Policy rule (ALLOW/DENY) targeting app segments and/or user groups.

Permanently delete a ZPA Access Policy rule.

List ZPA App Connector Groups -- pools of connectors deployed in the customer's private network.

List ZPA App Connectors -- the lightweight VMs/containers the customer runs to broker private access, with live control-channel status.

List ZPA Private/Public Service Edges -- the traffic-forwarding components between users and connectors, with live control-channel status.

Enable or disable several ZIA URL Filtering rules in one call, by explicit rule ids. Continues past per-item failures and reports each outcome, same convention as every other bulk_* tool in the portfolio (e.g. MuleSoft Connector's bulk_stop_cloudhub_applications).

Build one aggregated health report across the connected Zscaler tenant: ZIA location/rule counts, ZPA app-segment counts, and any ZPA connectors reporting a non-healthy control-channel status -- the same 'audit_*' value-add pattern as every other connector in the portfolio (e.g. MuleSoft Connector's audit_cloudhub_environment).