# Zscaler Zero Trust Exchange (oci · docker.io/zscaler/zscaler-mcp-server:latest)

Manage Zscaler Zero Trust Exchange via 280+ tools — ZPA, ZIA, ZDX, ZCC, EASM, and more.

- Trust score: 38/100 (low)
- Change this week: −4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- oci · `docker.io/zscaler/zscaler-mcp-server:latest`: 38/100 (this document), [markdown](https://verifymcp.io/servers/zscaler-zscaler-mcp-server/docker-io-zscaler-zscaler-mcp-server-latest.md), [page](https://verifymcp.io/servers/zscaler-zscaler-mcp-server/docker-io-zscaler-zscaler-mcp-server-latest)
- pypi · `zscaler-mcp`: 10/100, [markdown](https://verifymcp.io/servers/zscaler-zscaler-mcp-server/zscaler-mcp.md), [page](https://verifymcp.io/servers/zscaler-zscaler-mcp-server/zscaler-mcp)

## Channel facts

- Registry: `oci`
- Package: `docker.io/zscaler/zscaler-mcp-server:latest`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 0/100
  - Malware scan not yet available for this package.
  - CVE data not yet available for this package.
  - Install-script risk not yet assessed.
  - Dependency-health data not yet available.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 6 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 15189 tokens (~59/item across 254 items; 254 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 2 categories.** Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add zscaler-zscaler-mcp-server -- docker run --rm -i docker.io/zscaler/zscaler-mcp-server:latest
```

### Codex

```bash
codex mcp add zscaler-zscaler-mcp-server -- docker run --rm -i docker.io/zscaler/zscaler-mcp-server:latest
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zscaler-zscaler-mcp-server": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "docker.io/zscaler/zscaler-mcp-server:latest"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  zscaler-zscaler-mcp-server:
    command: "docker"
    args: ["run", "--rm", "-i", "docker.io/zscaler/zscaler-mcp-server:latest"]
```

### Other

```json
{
  "mcpServers": {
    "zscaler-zscaler-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/zscaler/zscaler-mcp-server:latest"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-07-31 (score 38, −4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 42, +31)

- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 0
- [functional] First check of Schema quality: good

### 2026-07-26 (score 11)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (254)

### `zeasm_list_findings` (~173 tokens)

List EASM findings for an organization.

Read-only. Returns one triage row per finding (id, category, type, status,
risk level/score, impacted asset, first/last seen) rather than the raw SDK
record. Use the returned `id` with `zeasm_get_finding_details`,
\`zeasm_get_finding_evidence`, or `zeasm_get_finding_scan_output`.

Input parameters:

- `org_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zeasm_get_finding_details` (~68 tokens)

Get the full detail for one EASM finding.

Read-only. Adds description, country, CISA/EPSS exploitation-likelihood
signals, and scan provenance on top of the triage fields.

Input parameters:

- `finding_id` (string, required)
- `org_id` (string, required)

### `zeasm_get_finding_evidence` (~85 tokens)

Get the scan evidence attributed to one EASM finding.

Read-only. Returns the evidence `content` (the subset of scan output
attributable to this finding) and its `source_type`. The content can be
large free-form scanner text and is preserved verbatim.

Input parameters:

- `finding_id` (string, required)
- `org_id` (string, required)

### `zeasm_get_finding_scan_output` (~72 tokens)

Get the complete scan output for one EASM finding.

Read-only. Returns the full scan `content` and its `source_type`. The
content can be large free-form scanner text and is preserved verbatim.

Input parameters:

- `finding_id` (string, required)
- `org_id` (string, required)

### `zeasm_list_lookalike_domains` (~170 tokens)

List EASM lookalike domains for an organization.

Read-only. Returns one triage row per detected lookalike/impersonation
domain (the lookalike, the domain it impersonates, risk, registration
state, deception methods). Use the returned `lookalike_raw` with
\`zeasm_get_lookalike_domain` for full detail.

Input parameters:

- `org_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zeasm_get_lookalike_domain` (~98 tokens)

Get full detail for one EASM lookalike domain.

Read-only. Adds description, registrar/registrant + lifecycle dates, and
remediation guidance on top of the triage fields. Look the domain up by its
\`lookalike_raw` name (from `zeasm_list_lookalike_domains`).

Input parameters:

- `lookalike_raw` (string, required)
- `org_id` (string, required)

### `zeasm_list_organizations` (~154 tokens)

List ZEASM organizations.

Read-only. Returns one row per organization configured in the EASM Admin
Portal, carrying just the `id` + `name`. Use the returned `id` as the
\`org_id` argument for `zeasm_list_findings`, `zeasm_list_lookalike_domains`,
and the other EASM tools.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcc_get_device_otp` (~87 tokens)

Get the OTP bundle for a ZCC device (logout / exit / uninstall / disable OTPs).

Read-only (GET, no tenant mutation) but the returned values ARE sensitive
short-lived credentials — treat them like passwords. Requires the device's
\`udid` (from `zcc_list_devices`).

Input parameters:

- `device_id`
- `udid`

### `zcc_list_devices` (~171 tokens)

List ZCC enrolled devices (read-only).

Each row is the full device record — identity, OS, agent version,
registration state, assigned `policy_name`, ownership, hardware,
VPN/tunnel state, and the enrollment / keep-alive timestamps. Use the
returned `udid` with `zcc_get_device_otp`.

Input parameters:

- `os_type`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `username`

### `zcc_list_forwarding_profiles` (~112 tokens)

List ZCC forwarding profiles (by company). Read-only.

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zcc_list_trusted_networks` (~113 tokens)

List ZCC trusted networks (by company). Read-only.

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zcell_list_anomaly_policies` (~172 tokens)

List Zscaler Cellular anomaly policies.

Read-only. Returns one row per policy (id, name, type, enabled state, run
status, applied SIM location groups, violation count) over a `days`
lookback window. Use the returned `id` with the anomaly-policy logs and
violations tools.

Input parameters:

- `days` (integer)
- `page`
- `policy_type`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`

### `zcell_list_anomaly_policy_logs` (~140 tokens)

List the activity log for one Zscaler Cellular anomaly policy.

Read-only. Returns the enable/disable/run history (status + message +
timestamp) for the given `policy_id`.

Input parameters:

- `page`
- `policy_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`

### `zcell_list_anomaly_policy_violations` (~170 tokens)

List the ICCIDs that violated a Zscaler Cellular anomaly policy.

Read-only. Returns the policy rows carrying violation data over a `days`
lookback window. Use `zcell_list_iccid_violations` to drill into the
per-event detail for a specific ICCID.

Input parameters:

- `days` (integer)
- `page`
- `policy_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`

### `zcell_list_iccid_violations` (~157 tokens)

List the anomaly-policy violation events for one ICCID.

Read-only. Returns the individual violation events (event type, zone,
timestamp) attributed to `iccid` under `policy_id`, over a `days` lookback
window.

Input parameters:

- `days` (integer)
- `iccid` (string, required)
- `policy_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_list_audit_customers_search` (~201 tokens)

Search Zscaler Cellular audit-log entries over a lookback window.

Read-only. Returns curated audit rows (who changed what, when, and the
operation) over a `days` window, with optional operation/object/visibility
filters. The before/after data blobs are omitted from the row.

Input parameters:

- `days` (integer)
- `modified_by_user_id`
- `object_id`
- `object_name`
- `object_type`
- `operation_type`
- `page`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`
- `visibility`

### `zcell_list_audit_metadata` (~120 tokens)

List the Zscaler Cellular audit filter vocabulary.

Read-only. Returns the valid operation types and object types you can pass
to `zcell_list_audit_customers_search`.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_get_customer_data_handling` (~73 tokens)

Get the logged-in Zscaler Cellular customer's profile and SIM totals.

Read-only. Returns the customer record: identity, activation state, platform,
configured regions, SIM counts, current usage, and the linked ZIA/ZPA cloud
and SIM-provider metadata. Scoped by ZCELL_CUSTOMER_ID.

### `zcell_list_regions` (~116 tokens)

List the Zscaler Cellular regions available/configured for the customer.

Read-only. Returns each region and whether it is configured.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `skip_sku_check`

### `zcell_list_region_operational_status` (~139 tokens)

List Zscaler Cellular configured regions with their operational status.

Read-only. Returns each configured region plus the broker-cluster (BC) and
app-connector (AC) status blocks and the MAP A-C / B-C link statuses.

Input parameters:

- `bc_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_list_network_events` (~183 tokens)

Search Zscaler Cellular network/session events over a lookback window.

Read-only. Returns curated event rows (timestamp, event, outcome, SIM/ICCID,
country, carrier, RAT, IP) over a `days` window, with optional `filter_by`
conditions, `sort_by`, and pagination.

Input parameters:

- `days` (integer)
- `exclude_apn_config`
- `filter_by`
- `page`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`
- `sort_by`

### `zcell_list_sim_analytics_map` (~141 tokens)

List Zscaler Cellular SIM map points (dashboard lat/lng summary).

Read-only. Returns SIM location points with their ICCIDs, IMSIs, and tags —
the data that backs the fleet map. Optionally scope to specific ICCIDs.

Input parameters:

- `icc_ids`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_list_sim_analytics_summary` (~115 tokens)

List the Zscaler Cellular SIM status summary (total/used/active/inactive).

Read-only. Returns the SIM-count breakdown for the tenant.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_list_sim_usage_by_country` (~131 tokens)

List Zscaler Cellular data usage grouped by country (top countries).

Read-only. Returns the top countries by data usage over a `days` lookback
window.

Input parameters:

- `days` (integer)
- `limit`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_list_sim_usage_by_day` (~139 tokens)

List Zscaler Cellular data usage per day over the window.

Read-only. Returns one usage bucket per day over a `days` lookback window,
optionally scoped to a single ICCID.

Input parameters:

- `days` (integer)
- `icc_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_list_sim_usage_by_sim` (~132 tokens)

List Zscaler Cellular data usage grouped by SIM (top SIMs).

Read-only. Returns the top SIMs by data usage over a `days` lookback window.

Input parameters:

- `days` (integer)
- `limit`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zcell_get_sim_details` (~76 tokens)

Get the full Zscaler Cellular record for one SIM by ICCID.

Read-only. Returns the identifying, status, and device fields for the SIM
(ICCID, IMSI/IMEI, status, network status, APN, IP, device, tags, usage).

Input parameters:

- `icc_id` (string, required)

### `zcell_list_sims` (~225 tokens)

Search the Zscaler Cellular SIM inventory with filters and pagination.

Read-only (browses the inventory). Returns a page of curated SIM records
plus the aggregate usage/pagination envelope. Filter by ICCID, status,
network status, country, tag, device attributes, or IMEI lock status.

Input parameters:

- `brand_name`
- `device_type`
- `form_factor`
- `iccid`
- `imei_status`
- `ip_address`
- `location_country`
- `marketing_name`
- `model_name`
- `network_status`
- `page`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`
- `status`
- `tag`

### `zcell_list_sim_location_groups` (~152 tokens)

List Zscaler Cellular SIM location groups.

Read-only. Returns one row per group (id, name, tracked ICCIDs). Use the
returned `id` with `zcell_get_sim_location_group` for the geo-fence and
linked-policy detail.

Input parameters:

- `name`
- `page`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`

### `zcell_get_sim_location_group` (~61 tokens)

Get one Zscaler Cellular SIM location group.

Read-only. Adds the geo-fence definition, linked anomaly policies, and the
inside/outside ICCID membership buckets on top of the summary fields.

Input parameters:

- `group_id` (string, required)

### `zcell_list_tags` (~140 tokens)

List the Zscaler Cellular SIM tags defined for the customer.

Read-only. Returns one row per tag (id, name, provenance). Use the returned
tag `id` when assigning tags to SIMs.

Input parameters:

- `name`
- `page`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `size`

### `zdx_list_devices` (~207 tokens)

List active ZDX devices.

Read-only. Returns one identifying row per device (id, hostname, owning
user). Filter by email, user ID, MAC/IP, location/department/geo, and the
\`since` HOURS window. Use a returned device `id` with `zdx_get_device` or the
deep-trace / probe tools.

Input parameters:

- `department_id`
- `emails`
- `geo_id`
- `location_id`
- `mac_address`
- `offset`
- `private_ipv4`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`
- `user_ids`

### `zdx_get_device` (~75 tokens)

Get one active ZDX device.

Read-only. The ZDX SDK returns a single-element list; the device record is
unwrapped and shaped to the identifying fields.

Input parameters:

- `department_id`
- `device_id` (string, required)
- `geo_id`
- `location_id`
- `since`

### `zdx_list_departments` (~139 tokens)

List ZDX departments as curated id/name rows.

Read-only. Use a returned `id` as the `department_id` scope filter on other
ZDX tools. `since` is in HOURS (default 2h).

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `since`

### `zdx_list_locations` (~138 tokens)

List ZDX locations as curated id/name rows.

Read-only. Use a returned `id` as the `location_id` scope filter on other
ZDX tools. `since` is in HOURS (default 2h).

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `since`

### `zdx_get_analysis` (~58 tokens)

Get the status/result of a ZDX score analysis (full record).

Read-only. Returns whether the analysis is still running or its results if
complete. Start one with `zdx_start_analysis`.

Input parameters:

- `analysis_id` (string, required)

Output parameters:

- `analysis_id`: Analysis ID.
- `data` (object): Analysis result payload, if complete.
- `status`: Analysis status (running/complete).

### `zdx_get_deeptrace_cloudpath` (~130 tokens)

Get the cloud-path (hop-by-hop network path) captured during a ZDX deep trace (curated, nested JSON). Read-only.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `trace_id` (string, required)

### `zdx_get_deeptrace_cloudpath_metrics` (~126 tokens)

Get cloud-path metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `trace_id` (string, required)

### `zdx_get_deeptrace_events` (~124 tokens)

Get the events captured during a ZDX deep trace (curated, nested JSON with ISO timestamps). Read-only.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `trace_id` (string, required)

### `zdx_get_deeptrace_health_metrics` (~125 tokens)

Get device health metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `trace_id` (string, required)

### `zdx_list_deeptrace_top_processes` (~140 tokens)

List the top processes captured during a ZDX deep trace (full records).

Read-only. Returns the process groups captured during the session — useful
for spotting resource-intensive processes impacting performance.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `trace_id` (string, required)

### `zdx_get_deeptrace_webprobe_metrics` (~127 tokens)

Get web-probe metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `trace_id` (string, required)

### `zdx_list_cloudpath_probes` (~153 tokens)

List cloud-path probes for an app on a ZDX device (full records).

Read-only. Call this BEFORE `zdx_start_deeptrace` to obtain the
\`cloudpath_probe_id` the deep-trace payload needs.

Input parameters:

- `app_id` (string, required)
- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_get_web_probes` (~150 tokens)

List web probes for an app on a ZDX device (full records).

Read-only. Call this BEFORE `zdx_start_deeptrace` to obtain the
\`web_probe_id` the deep-trace payload needs.

Input parameters:

- `app_id` (string, required)
- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_get_application_metric` (~193 tokens)

Get ZDX performance metrics for one application (time-series).

Read-only. Returns one series per metric (Page Fetch Time, DNS Time,
availability), each with its datapoints over the `since` HOURS window
(default 2h). Pass `metric_name` to narrow to a single metric. Use `app_id`
from `zdx_list_applications`.

Input parameters:

- `app_id` (string, required)
- `department_id`
- `geo_id`
- `location_id`
- `metric_name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_get_application` (~102 tokens)

Get the ZDX score for one application, with its most-impacted regions.

Read-only. Returns the headline ZDX score plus the per-region impact
breakdown for the `since` HOURS window (default 2h). Use `app_id` from
\`zdx_list_applications`.

Input parameters:

- `app_id` (string, required)
- `department_id`
- `geo_id`
- `location_id`
- `since`

### `zdx_get_application_score_trend` (~113 tokens)

Get the ZDX score trend (over time) for one application.

Read-only. Returns the score-over-time datapoints for the `since` HOURS
window (default 2h) so the agent can reason about whether an app's
experience is improving or degrading. Use `app_id` from
\`zdx_list_applications`.

Input parameters:

- `app_id` (string, required)
- `department_id`
- `geo_id`
- `location_id`
- `since`

### `zdx_list_application_users` (~204 tokens)

List users/devices that accessed a ZDX application, as curated rows.

Read-only. Returns one triage row per user (id, name, email, ZDX score).
Filter by `score_bucket` (poor/okay/good), location/department/geo, and the
\`since` HOURS window (default 2h). Use a returned `id` with
\`zdx_get_application_user`.

Input parameters:

- `app_id` (string, required)
- `department_id`
- `geo_id`
- `location_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `score_bucket`
- `since`

### `zdx_get_application_user` (~100 tokens)

Get one user's ZDX detail for an application (per-device breakdown).

Read-only. Returns the user's score plus the nested per-device metrics for
the `since` HOURS window (default 2h). Use `app_id` from
\`zdx_list_applications` and `user_id` from `zdx_list_application_users`.

Input parameters:

- `app_id` (string, required)
- `since`
- `user_id` (string, required)

### `zdx_list_alerts` (~195 tokens)

List ongoing ZDX alerts.

Read-only. Returns one triage row per ongoing alert (id, rule, severity,
type, start time, impacted-device count). Filter by location/department/geo
and the `since` HOURS window (max 336h). Use a returned alert `id` with
\`zdx_get_alert` or `zdx_list_alert_affected_devices`.

Input parameters:

- `department_id`
- `geo_id`
- `limit`
- `location_id`
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_get_alert` (~51 tokens)

Get one ZDX alert as a curated, agent-facing detail view.

Read-only. Adds the impacted department / location / geolocation scope to the
summary fields.

Input parameters:

- `alert_id` (string, required)

### `zdx_list_alert_affected_devices` (~172 tokens)

List devices affected by a ZDX alert.

Read-only. Returns one identifying row per affected device. Filter by
location/department/geo, location groups, and the `since` HOURS window.

Input parameters:

- `alert_id` (string, required)
- `department_id`
- `geo_id`
- `limit`
- `location_groups`
- `location_id`
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_list_applications` (~176 tokens)

List active ZDX applications.

Read-only. Returns one row per application (id, name, ZDX score, impact
signals). Filter by location/department/geo and the `since` HOURS window.
Use a returned `id` with `zdx_get_application`, `zdx_get_application_metric`,
or `zdx_list_application_users`.

Input parameters:

- `department_id`
- `geo_id`
- `location_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_list_device_deep_traces` (~156 tokens)

List deep-trace sessions for a ZDX device (full records).

Read-only. Returns one row per trace (id, status, session name, app, ISO
timestamps). Use a returned `trace_id` with the deep-trace metric/event tools
or `zdx_get_device_deep_trace`.

Input parameters:

- `device_id` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zdx_get_device_deep_trace` (~69 tokens)

Get one ZDX deep-trace session.

Read-only. The SDK returns a single-element list; the trace record is
unwrapped, timestamps ISO-normalized, and shaped to the identity fields.

Input parameters:

- `device_id` (string, required)
- `trace_id` (string, required)

### `zdx_list_historical_alerts` (~172 tokens)

List historical (ended) ZDX alerts.

Read-only. Like `zdx_list_alerts` but for alert rules that have an Ended On
date. `since` is in HOURS (default 2h, max 14 days = 336h).

Input parameters:

- `department_id`
- `geo_id`
- `limit`
- `location_id`
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `since`

### `zdx_list_software` (~175 tokens)

List the ZDX software inventory.

Read-only. Returns one row per software title (key, name, vendor, version,
install/user counts). Filter by location/department/geo/user/device. Use a
returned `software_key` with `zdx_get_software_details` to see who has it.

Input parameters:

- `department_id`
- `device_ids`
- `geo_id`
- `location_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `user_ids`

### `zdx_get_software_details` (~165 tokens)

Expand one ZDX software key into its per-user/device install rows.

Read-only. Returns the users and devices that have the given `software_key`
installed. Obtain the key from `zdx_list_software`.

Input parameters:

- `department_id`
- `device_ids`
- `geo_id`
- `location_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `software_key` (string, required)
- `user_ids`

### `zia_get_activation_status` (~20 tokens)

Get the current ZIA configuration activation status.

### `zia_get_advanced_settings` (~22 tokens)

Get the ZIA tenant-wide Advanced Settings object.

### `zia_get_atp_malware_policy` (~28 tokens)

Get the ZIA malware policy (file-handling toggles).

### `zia_get_atp_malware_inspection` (~28 tokens)

Get the ZIA malware inspection (traffic-direction toggles).

### `zia_get_atp_malware_protocols` (~29 tokens)

Get the ZIA malware protocol toggles (HTTP/FTP).

### `zia_get_malware_settings` (~26 tokens)

Get the ZIA 16-field malware threat-class settings block.

### `zia_get_atp_settings` (~22 tokens)

Get the ZIA tenant-wide ATP policy block.

### `zia_get_atp_security_exceptions` (~27 tokens)

Get the ZIA ATP security-exception bypass URL allowlist.

### `zia_list_atp_malicious_urls` (~98 tokens)

List the ZIA ATP malicious-URL denylist.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_list_auth_exempt_urls` (~95 tokens)

List the ZIA cookie-auth exempt URL list.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_list_cloud_app_control_actions` (~113 tokens)

List the available CAC actions for a category (and optional cloud apps).

Input parameters:

- `cloud_apps`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `rule_type` (string, required)

### `zia_list_cloud_app_control_rules` (~104 tokens)

List ZIA Cloud App Control rules for a category.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `rule_type` (string, required)

### `zia_get_cloud_app_control_rule` (~43 tokens)

Get a single ZIA Cloud App Control rule by category + ID.

Input parameters:

- `rule_id` (string, required)
- `rule_type` (string, required)

### `zia_list_cloud_app_policy` (~127 tokens)

List the ZIA policy-engine cloud-application catalog (Cloud App Control).

Input parameters:

- `app_class`
- `group_results`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_list_cloud_app_ssl_policy` (~127 tokens)

List the ZIA policy-engine cloud-application catalog (SSL Inspection).

Input parameters:

- `app_class`
- `group_results`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_list_cloud_firewall_dns_rules` (~99 tokens)

List ZIA Cloud Firewall DNS rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_cloud_firewall_dns_rule` (~37 tokens)

Get a single ZIA Cloud Firewall DNS rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_cloud_firewall_ips_rules` (~99 tokens)

List ZIA Cloud Firewall IPS rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_cloud_firewall_ips_rule` (~37 tokens)

Get a single ZIA Cloud Firewall IPS rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_cloud_firewall_rules` (~97 tokens)

List ZIA Cloud Firewall rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_cloud_firewall_rule` (~35 tokens)

Get a single ZIA Cloud Firewall rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_device_groups` (~104 tokens)

List ZIA device groups.

Input parameters:

- `include_device_info`
- `include_pseudo_groups`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_list_devices` (~115 tokens)

List ZIA devices.

Input parameters:

- `include_all`
- `name`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `user_ids`

### `zia_list_devices_lite` (~97 tokens)

List ZIA devices via the lighter endpoint (id/name only).

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_list_file_type_control_rules` (~98 tokens)

List ZIA File Type Control rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_list_file_type_categories` (~110 tokens)

List ZIA file-type categories usable in File Type Control rules.

Input parameters:

- `enums`
- `exclude_custom_file_types`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_get_file_type_control_rule` (~36 tokens)

Get a single ZIA File Type Control rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_geo_search` (~128 tokens)

Resolve ZIA geo data by coordinates, by IP, or by city prefix (read-only).

Input parameters:

- `action` (string, required)
- `ip`
- `latitude`
- `longitude`
- `prefix`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_get_sandbox_quota` (~22 tokens)

Get the ZIA Sandbox API submission quota.

### `zia_get_sandbox_behavioral_analysis` (~23 tokens)

Get the ZIA Sandbox behavioral-analysis configuration.

### `zia_get_sandbox_file_hash_count` (~29 tokens)

Get the ZIA Sandbox custom file-hash blocklist usage/quota.

### `zia_get_sandbox_report` (~42 tokens)

Get the ZIA Sandbox detonation report for a file MD5 hash.

Input parameters:

- `md5_hash` (string, required)
- `report_details`

### `zia_list_gre_ranges` (~111 tokens)

List available ZIA GRE internal-IP ranges.

Input parameters:

- `internal_ip_range`
- `limit`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `static_ip`

### `zia_list_gre_tunnels` (~91 tokens)

List ZIA GRE tunnels.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_get_gre_tunnel` (~31 tokens)

Get a single ZIA GRE tunnel by ID.

Input parameters:

- `tunnel_id` (string, required)

### `zia_list_ip_destination_groups` (~96 tokens)

List ZIA IP destination groups.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_ip_destination_group` (~34 tokens)

Get a single ZIA IP destination group by ID with full members.

Input parameters:

- `group_id` (string, required)

### `zia_list_ip_source_groups` (~96 tokens)

List ZIA IP source groups.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_ip_source_group` (~36 tokens)

Get a single ZIA IP source group by ID with its full member list.

Input parameters:

- `group_id` (string, required)

### `zia_list_ips_signature_rules` (~97 tokens)

List ZIA custom IPS signature rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_ips_signature_rule` (~35 tokens)

Get a single ZIA custom IPS signature rule by ID with its body.

Input parameters:

- `rule_id` (string, required)

### `get_zia_dlp_dictionaries` (~124 tokens)

Read ZIA DLP dictionaries: list all/lite, or fetch one by ID (read-only).

Input parameters:

- `action` (string)
- `dict_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `get_zia_dlp_engines` (~124 tokens)

Read ZIA DLP engines: list all/lite, or fetch one by ID (read-only).

Input parameters:

- `action` (string)
- `engine_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `get_zia_user_departments` (~150 tokens)

Read ZIA user departments: list with filters, or fetch one by ID (read-only).

Input parameters:

- `action` (string)
- `department_id`
- `limit_search`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `sort_by`
- `sort_order`

### `get_zia_user_groups` (~148 tokens)

Read ZIA user groups: fetch by ID, find by name, or list (read-only).

Input parameters:

- `defined_by`
- `group_id`
- `name`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `sort_by`
- `sort_order`

### `get_zia_users` (~133 tokens)

Read ZIA users: list with optional filters, or fetch one by ID (read-only).

Input parameters:

- `dept`
- `group`
- `name`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `user_id`

### `zia_list_locations` (~92 tokens)

List ZIA locations.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_location` (~31 tokens)

Get a single ZIA location by ID with its full configuration.

Input parameters:

- `location_id` (string, required)

### `zia_list_location_groups` (~99 tokens)

List ZIA location groups.

Input parameters:

- `name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_location_group` (~29 tokens)

Get a single ZIA location group by ID.

Input parameters:

- `group_id` (string, required)

### `zia_get_mobile_advanced_settings` (~23 tokens)

Get the ZIA Mobile Advanced Threat Settings object.

### `zia_list_network_app_groups` (~96 tokens)

List ZIA network application groups.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_network_app_group` (~33 tokens)

Get a single ZIA network application group by ID with members.

Input parameters:

- `group_id` (string, required)

### `zia_list_network_apps` (~104 tokens)

List ZIA network applications (predefined + custom).

Input parameters:

- `locale`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_network_app` (~29 tokens)

Get a single ZIA network application by ID.

Input parameters:

- `app_id` (string, required)

### `zia_list_network_services` (~116 tokens)

List ZIA network services. Use `name` for case-insensitive find-by-name.

Input parameters:

- `name`
- `protocol`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_network_service` (~33 tokens)

Get a single ZIA network service by ID with its port definitions.

Input parameters:

- `service_id` (string, required)

### `zia_list_network_svc_groups` (~97 tokens)

List ZIA network service groups.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_network_svc_group` (~34 tokens)

Get a single ZIA network service group by ID with members.

Input parameters:

- `group_id` (string, required)

### `zia_list_rule_labels` (~94 tokens)

List ZIA rule labels.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_rule_label` (~29 tokens)

Get a single ZIA rule label by ID.

Input parameters:

- `label_id` (string, required)

### `zia_list_sandbox_rules` (~95 tokens)

List ZIA Sandbox rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_sandbox_rule` (~33 tokens)

Get a single ZIA Sandbox rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_shadow_it_apps` (~105 tokens)

List ZIA Shadow IT applications (analytics catalog).

Input parameters:

- `limit`
- `page_number`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_list_shadow_it_custom_tags` (~93 tokens)

List ZIA Shadow IT custom tags.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_list_ssl_inspection_rules` (~92 tokens)

List ZIA SSL Inspection rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_get_ssl_inspection_rule` (~35 tokens)

Get a single ZIA SSL Inspection rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_static_ips` (~95 tokens)

List ZIA static IPs.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_static_ip` (~30 tokens)

Get a single ZIA static IP by ID.

Input parameters:

- `static_ip_id` (string, required)

### `zia_list_time_intervals` (~106 tokens)

List ZIA time intervals.

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_time_interval` (~29 tokens)

Get a single ZIA time interval by ID.

Input parameters:

- `interval_id` (string, required)

### `zia_list_url_categories` (~100 tokens)

List ZIA URL categories.

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_url_lookup` (~103 tokens)

Look up the URL category classifications for a list of URLs/domains.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `urls` (array, required)

### `zia_get_url_category` (~32 tokens)

Get a single ZIA URL category by ID (full detail).

Input parameters:

- `category_id` (string, required)

### `zia_get_url_category_predefined` (~39 tokens)

Get a Zscaler-curated **predefined** URL category by ID or display name.

Input parameters:

- `name` (string, required)

### `zia_list_url_filtering_rules` (~97 tokens)

List ZIA URL Filtering rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_url_filtering_rule` (~35 tokens)

Get a single ZIA URL Filtering rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_vpn_credentials` (~100 tokens)

List ZIA VPN credentials (PSK never returned).

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_vpn_credential` (~31 tokens)

Get a single ZIA VPN credential by ID.

Input parameters:

- `credential_id` (string, required)

### `zia_list_web_dlp_rules` (~98 tokens)

List ZIA Web DLP rules.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_list_web_dlp_rules_lite` (~105 tokens)

List ZIA Web DLP rules via the lighter SDK endpoint.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zia_get_web_dlp_rule` (~36 tokens)

Get a single ZIA Web DLP rule by ID with member references.

Input parameters:

- `rule_id` (string, required)

### `zia_list_workload_groups` (~101 tokens)

List ZIA workload groups.

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zia_get_workload_group` (~30 tokens)

Get a single ZIA workload group by ID.

Input parameters:

- `group_id` (string, required)

### `zid_list_groups` (~152 tokens)

List ZIdentity groups.

Read-only. Returns lean group summaries (id, name, description, dynamic
flag, source IdP) rather than the full SDK group record. Pass `name` for a
case-insensitive partial-name filter.

Input parameters:

- `exclude_dynamic_groups`
- `limit`
- `name`
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zid_get_group` (~28 tokens)

Get one ZIdentity group by ID. Read-only.

Input parameters:

- `group_id` (string, required)

### `zid_search_groups` (~141 tokens)

Search ZIdentity groups by name (case-insensitive partial match). Read-only.

Returns curated group summaries. An empty result means no group name
contains this string — do not retry with split keywords or no filter.

Input parameters:

- `limit`
- `name` (string, required)
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zid_get_group_users` (~141 tokens)

List the users that belong to a ZIdentity group, by group ID. Read-only.

Returns lean user summaries (id, login name, display name, primary email)
for each member of the group.

Input parameters:

- `group_id` (string, required)
- `limit`
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zid_get_group_users_by_name` (~143 tokens)

List the users in a ZIdentity group resolved by group name. Read-only.

Resolves the group by case-insensitive partial name first, then returns the
lean user summaries for the first matching group's members.

Input parameters:

- `limit`
- `name` (string, required)
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zid_list_users` (~174 tokens)

List ZIdentity users. Read-only.

Returns lean user summaries (id, login name, display name, primary email)
rather than the full SDK user record. Pass any of the `*_name` / email
filters for a case-insensitive partial match.

Input parameters:

- `display_name`
- `domain_name`
- `idp_name`
- `limit`
- `login_name`
- `offset`
- `primary_email`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zid_get_user` (~28 tokens)

Get one ZIdentity user by ID. Read-only.

Input parameters:

- `user_id` (string, required)

### `zid_search_users` (~155 tokens)

Search ZIdentity users by name, login name, or email. Read-only.

Case-insensitive partial match. Values containing '@' match email;
otherwise login name then display name are tried. An empty result means no
user matches — do not retry with split keywords or no filter.

Input parameters:

- `limit`
- `name` (string, required)
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zid_get_user_groups` (~144 tokens)

List the groups a ZIdentity user belongs to, by user ID. Read-only.

Returns lean group summaries (id, name, description, dynamic flag, source
IdP) for each of the user's group memberships.

Input parameters:

- `limit`
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `user_id` (string, required)

### `zid_get_user_groups_by_name` (~158 tokens)

List a ZIdentity user's group memberships, resolving the user by name.

Read-only. Resolves the user by case-insensitive partial match (email when
'@' present, else login then display name), then returns the lean group
summaries for the first matching user's memberships.

Input parameters:

- `limit`
- `name` (string, required)
- `offset`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zins_get_cyber_incidents` (~193 tokens)

Get cyber-security incidents grouped by category. Read-only analytics.

Groups incidents by one or more dimensions (default THREAT_CATEGORY_ID);
multi-dimension groupings surface their breakdown under nested `entries`.
An empty result means no incidents were detected. Window must be a 7- or
14-day historical interval.

Input parameters:

- `categorize_by`
- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_cyber_incidents_by_location` (~194 tokens)

Get cyber-security incidents grouped by location (or app/user/department). Read-only analytics.

One id/name/total row per location (or the chosen id-bearing dimension),
useful for ranking which sites carry the most incidents. Window must be a
7- or 14-day historical interval.

Input parameters:

- `categorize_by` (string)
- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_cyber_incidents_daily` (~175 tokens)

Get the daily cyber-security incident trend over time. Read-only analytics.

Groups incidents by day (categorize_by=TIME) so you can spot spikes across
the window. Window must be a 7- or 14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_cyber_incidents_by_threat_and_app` (~200 tokens)

Get cyber-security incidents correlated by threat category and application. Read-only analytics.

Groups by THREAT_CATEGORY_ID × APP_ID so each top-level threat-category
bucket carries its per-application breakdown under nested `entries` —
useful for finding the most-targeted apps. Window must be a 7- or 14-day
historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_firewall_by_action` (~172 tokens)

Get Zero Trust Firewall traffic grouped by action (allow/block). Read-only analytics.

One row per action with its aggregated total — the allowed-vs-blocked
split. Window must be a 7- or 14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_firewall_by_location` (~172 tokens)

Get Zero Trust Firewall traffic grouped by location. Read-only analytics.

One id/name/total row per location, for ranking which sites drive the most
firewall traffic. Window must be a 7- or 14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_firewall_network_services` (~167 tokens)

Get Zero Trust Firewall traffic grouped by network service. Read-only analytics.

One row per network service (protocol/port) with its aggregated total.
Window must be a 7- or 14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_iot_device_stats` (~93 tokens)

Get IoT device statistics and classifications. Read-only analytics.

A single current-state object: total/IoT/user/server/unclassified device
counts plus a per-classification breakdown under `entries`. No time window —
this reflects the present network state. An empty/zeroed result means no IoT
devices were detected or IoT Device Visibility is not enabled.

Input parameters:

- `limit` (integer)

### `zins_get_casb_app_report` (~184 tokens)

Get the CASB (Cloud Access Security Broker) SaaS-application usage report. Read-only analytics.

One row per SaaS application with its aggregated usage total, for seeing
which cloud apps are being accessed. Window must be a 7- or 14-day
historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_shadow_it_apps` (~190 tokens)

Get discovered Shadow IT applications with risk and usage detail. Read-only analytics.

One row per unsanctioned/discovered app: category, risk index, sanctioned
state, data volume, and user count. An empty result means no shadow apps
were detected. Window must be a 7- or 14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`

### `zins_get_shadow_it_summary` (~97 tokens)

Get the aggregate Shadow IT summary dashboard. Read-only analytics.

A single object with org-wide totals (apps, bytes, upload/download) plus
breakdowns grouped by category and by risk index. Window must be a 7- or
14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `start_days_ago` (integer)
- `start_time`

### `zins_get_web_traffic_by_location` (~210 tokens)

Get web traffic aggregated per location. Read-only analytics.

Each row is a location with its total transactions or bytes; pass
\`include_trend=True` for the per-location time-series under `trend`. Window
must be a 7- or 14-day historical interval (see the time-window inputs).

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `include_trend` (boolean)
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`
- `traffic_unit` (string)
- `trend_interval`

### `zins_get_web_traffic_no_grouping` (~219 tokens)

Get overall web traffic volume with no grouping. Read-only analytics.

Returns total organization traffic, optionally filtered by DLP engine or
action (ALLOW/BLOCK), and optionally with an overall time-series `trend`.
Window must be a 7- or 14-day historical interval.

Input parameters:

- `action_filter`
- `dlp_engine_filter`
- `end_days_ago` (integer)
- `end_time`
- `include_trend` (boolean)
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`
- `traffic_unit` (string)
- `trend_interval`

### `zins_get_web_protocols` (~174 tokens)

Get web traffic broken down by protocol (HTTP, HTTPS, SSL, …). Read-only analytics.

One row per protocol with its aggregated total. Window must be a 7- or
14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`
- `traffic_unit` (string)

### `zins_get_threat_super_categories` (~193 tokens)

Get threat super-categories (malware, phishing, spyware, …) from web traffic. Read-only analytics.

One row per threat super-category with its aggregated total. An empty
result means no threats were detected in the window. Window must be a 7- or
14-day historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`
- `traffic_unit` (string)

### `zins_get_threat_class` (~188 tokens)

Get threat-class distribution (Virus/Spyware, Advanced, Behavioral). Read-only analytics.

One row per threat class with its aggregated total. An empty result means
no threats of these classes were detected. Window must be a 7- or 14-day
historical interval.

Input parameters:

- `end_days_ago` (integer)
- `end_time`
- `limit` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `start_days_ago` (integer)
- `start_time`
- `traffic_unit` (string)

### `zms_list_agent_groups` (~158 tokens)

List ZMS agent groups.

Read-only. Returns one row per group (eyez_id, name, type, cloud provider,
agent count, policy/tamper status). Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `page` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `sort`
- `sort_dir`

### `zms_get_agent_group_totp_secrets` (~77 tokens)

Get the TOTP secrets for a ZMS agent group (full record).

Read-only API call, but the returned values ARE sensitive enrollment
credentials — treat them like secrets. Keyed by `eyez_id`. Requires
ZSCALER_CUSTOMER_ID.

Input parameters:

- `eyez_id` (string, required)

Output parameters:

- `data` (object): TOTP secret bundle (treat as sensitive credentials).
- `eyez_id`: Agent group eyez_id (echoed).

### `zms_list_agents` (~171 tokens)

List ZMS microsegmentation agents.

Read-only. Returns one row per agent (eyez_id, name, connection status,
version, OS, IP). Requires ZSCALER_CUSTOMER_ID. Use a returned `eyez_id` with
the agent-group / nonce tools.

Input parameters:

- `page` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `sort`
- `sort_dir`

### `zms_get_agent_connection_status_statistics` (~55 tokens)

Get ZMS agent connection-status statistics (curated aggregate view).

Read-only. Returns connected vs disconnected counts / percentages for fleet
health. Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `search`

### `zms_get_agent_version_statistics` (~59 tokens)

Get ZMS agent version statistics (curated aggregate view).

Read-only. Returns the distribution of agent software versions across the
fleet — useful for spotting outdated agents. Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `search`

### `zms_list_app_catalog` (~179 tokens)

List the ZMS application catalog.

Read-only. Returns one row per discovered application (id, name, category)
plus its nested port/protocol/process specs — useful for policy planning.
Filter by name/category, sort by name/category/time. Requires
ZSCALER_CUSTOMER_ID.

Input parameters:

- `category`
- `name`
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `sort_by`
- `sort_order`

### `zms_list_app_zones` (~146 tokens)

List ZMS app zones.

Read-only. Returns one row per app zone (id, name, description, resource
count). Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `name`
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `sort_order`

### `zms_list_nonces` (~149 tokens)

List ZMS enrollment nonces.

Read-only. Returns one row per nonce (eyez_id, name, status, expiry).
Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `page` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `sort`
- `sort_dir`

### `zms_get_nonce` (~57 tokens)

Get one ZMS nonce.

Read-only. Keyed by `eyez_id`. The payload may carry sensitive enrollment
data — handle accordingly. Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `eyez_id` (string, required)

Output parameters:

- `data` (object): Full nonce payload.
- `eyez_id`: Nonce eyez_id (echoed).

### `zms_list_policy_rules` (~171 tokens)

List ZMS microsegmentation policy rules.

Read-only. Returns one row per rule (id, name, action, priority, enabled).
Filter by name/action. `fetch_all` bypasses pagination — use sparingly.
Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `action`
- `fetch_all` (boolean)
- `name`
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zms_list_default_policy_rules` (~131 tokens)

List ZMS default policy rules.

Read-only. The built-in default rules evaluated when no custom rule matches.
Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zms_list_resource_groups` (~160 tokens)

List ZMS resource groups.

Read-only. Returns one row per group (id, name, managed/unmanaged type,
origin, member count, and CIDRs/FQDNs for unmanaged groups). Requires
ZSCALER_CUSTOMER_ID.

Input parameters:

- `name`
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `resource_hostname`

### `zms_get_resource_group_members` (~151 tokens)

List the members of a ZMS resource group.

Read-only. Returns one row per member workload. Obtain `group_id` from
\`zms_list_resource_groups`. Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `group_id` (string, required)
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zms_get_resource_group_protection_status` (~65 tokens)

Get the ZMS resource-group protection-status summary (aggregate view).

Read-only. Returns protected vs unprotected group counts and percentage.
Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `page_num` (integer)
- `page_size` (integer)

Output parameters:

- `data` (object): Aggregate payload (counts/percentages).

### `zms_list_resources` (~202 tokens)

List ZMS resources (workloads).

Read-only. Returns one row per workload (id, name, type, status, cloud
provider/region, OS, IPs). Filter by name/status/type/provider/region/OS.
Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `cloud_provider`
- `cloud_region`
- `include_deleted` (boolean)
- `name`
- `page_num` (integer)
- `page_size` (integer)
- `platform_os`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `resource_type`
- `sort_order`
- `status`

### `zms_get_resource_protection_status` (~75 tokens)

Get the ZMS resource protection-status summary (curated aggregate view).

Read-only. Returns protected vs unprotected counts and protection
percentage — microsegmentation coverage at a glance. Requires
ZSCALER_CUSTOMER_ID.

Input parameters:

- `page_num` (integer)
- `page_size` (integer)

Output parameters:

- `data` (object): Aggregate payload (counts/percentages).

### `zms_get_metadata` (~45 tokens)

Get ZMS resource event metadata (full record).

Read-only. Returns metadata about the resource-level events available in the
deployment. Requires ZSCALER_CUSTOMER_ID.

Output parameters:

- `data` (object): Aggregate payload (counts/percentages).

### `zms_list_tag_namespaces` (~162 tokens)

List ZMS tag namespaces.

Read-only. Top of the tag hierarchy (namespace -> key -> value). Returns one
row per namespace (id, name, origin, key count). Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `name`
- `origin`
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `sort_order`

### `zms_list_tag_keys` (~174 tokens)

List ZMS tag keys within a namespace.

Read-only. Middle of the tag hierarchy. Returns one row per key (id,
key_name, value count). Obtain `namespace_id` from `zms_list_tag_namespaces`.
Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `key_name`
- `namespace_id` (string, required)
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `sort_order`

### `zms_list_tag_values` (~194 tokens)

List ZMS tag values for a key.

Read-only. Bottom of the tag hierarchy. Returns one row per value (id, name).
Needs the `tag_id` (from `zms_list_tag_keys`) and the `namespace_origin`
(CUSTOM / EXTERNAL / ML / UNKNOWN). Requires ZSCALER_CUSTOMER_ID.

Input parameters:

- `name`
- `namespace_origin` (string, required)
- `page_num` (integer)
- `page_size` (integer)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `sort_order`
- `tag_id` (string, required)

### `zpa_list_app_protection_rules` (~107 tokens)

List ZPA app-protection (inspection) policy rules (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zpa_get_app_protection_rule` (~44 tokens)

Get one ZPA app-protection (inspection) policy rule (read-only).

Input parameters:

- `microtenant_id`
- `rule_id` (string, required)

### `zpa_list_forwarding_policy_rules` (~103 tokens)

List ZPA client forwarding policy rules (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zpa_get_forwarding_policy_rule` (~40 tokens)

Get one ZPA client forwarding policy rule (read-only).

Input parameters:

- `microtenant_id`
- `rule_id` (string, required)

### `zpa_list_isolation_policy_rules` (~102 tokens)

List ZPA isolation policy rules (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zpa_get_isolation_policy_rule` (~39 tokens)

Get one ZPA isolation policy rule (read-only).

Input parameters:

- `microtenant_id`
- `rule_id` (string, required)

### `zpa_list_access_policy_rules` (~101 tokens)

List ZPA access policy rules (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zpa_get_access_policy_rule` (~38 tokens)

Get one ZPA access policy rule (read-only).

Input parameters:

- `microtenant_id`
- `rule_id` (string, required)

### `zpa_list_timeout_policy_rules` (~101 tokens)

List ZPA timeout policy rules (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zpa_get_timeout_policy_rule` (~38 tokens)

Get one ZPA timeout policy rule (read-only).

Input parameters:

- `microtenant_id`
- `rule_id` (string, required)

### `zpa_list_app_connector_groups` (~117 tokens)

List ZPA app connector groups (read-only).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_app_connector_group` (~38 tokens)

Get one ZPA app connector group (read-only).

Input parameters:

- `group_id` (string, required)
- `microtenant_id`

### `zpa_list_app_connectors` (~119 tokens)

List ZPA app connectors with health/status (read-only).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_app_connector` (~38 tokens)

Get one ZPA app connector by ID (read-only).

Input parameters:

- `connector_id` (string, required)
- `microtenant_id`

### `zpa_list_application_segments` (~139 tokens)

List ZPA application segments.

Each row is the full segment record with normalized highlights on top
(ids, member domains/server groups, ports, and behavior toggles).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_application_segment` (~33 tokens)

Get one ZPA application segment.

Input parameters:

- `microtenant_id`
- `segment_id` (string, required)

### `zpa_list_application_segments_ba` (~120 tokens)

List ZPA browser-access (clientless) application segments.

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_application_segment_ba` (~37 tokens)

Get one ZPA browser-access application segment.

Input parameters:

- `microtenant_id`
- `segment_id` (string, required)

### `zpa_list_application_segments_pra` (~118 tokens)

List ZPA privileged-remote-access application segments.

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_application_segment_pra` (~39 tokens)

Get one ZPA privileged-remote-access application segment.

Input parameters:

- `microtenant_id`
- `segment_id` (string, required)

### `zpa_list_application_servers` (~115 tokens)

List ZPA application servers (read-only).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_application_server` (~36 tokens)

Get one ZPA application server (read-only).

Input parameters:

- `microtenant_id`
- `server_id` (string, required)

### `zpa_list_ba_certificates` (~107 tokens)

List ZPA Browser Access certificates (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_ba_certificate` (~40 tokens)

Get one ZPA Browser Access certificate by ID (read-only).

Input parameters:

- `certificate_id` (string, required)
- `microtenant_id`

### `get_zpa_app_protection_profile` (~108 tokens)

List ZPA App Protection (inspection) profiles, or filter by name (read-only).

Input parameters:

- `name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `get_zpa_enrollment_certificate` (~121 tokens)

Read ZPA enrollment certificates: list all, or look one up by name or ID (read-only).

Input parameters:

- `certificate_id`
- `name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `get_zpa_isolation_profile` (~110 tokens)

List ZPA Cloud Browser Isolation (CBI) profiles, or filter by exact name (read-only).

Input parameters:

- `name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `get_zpa_posture_profile` (~113 tokens)

List ZPA posture profiles, or look one up by ID or name (read-only).

Input parameters:

- `name`
- `profile_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `get_zpa_saml_attribute` (~114 tokens)

List ZPA SAML attributes, optionally scoped to a named IdP (read-only).

Input parameters:

- `idp_name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `get_zpa_scim_attribute` (~125 tokens)

List ZPA SCIM attributes for a named IdP, or fetch one by ID (read-only).

Input parameters:

- `attribute_id`
- `idp_name` (string, required)
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `get_zpa_scim_group` (~127 tokens)

Fetch one ZPA SCIM group by ID, or list all groups under a named IdP (read-only).

Input parameters:

- `idp_name`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `scim_group_id`
- `search`

### `get_zpa_app_segments_by_type` (~151 tokens)

Retrieve ZPA application segments filtered by application type (read-only).

\`application_type` must be BROWSER_ACCESS, INSPECT, or SECURE_REMOTE_ACCESS.

Input parameters:

- `application_type` (string, required)
- `expand_all` (boolean)
- `microtenant_id`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `get_zpa_trusted_network` (~113 tokens)

List ZPA trusted networks, or look one up by ID or name (read-only).

Input parameters:

- `name`
- `network_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `zpa_list_lss_configs` (~116 tokens)

List ZPA LSS configurations — what log feed streams where (read-only).

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_lss_config` (~35 tokens)

Get one ZPA LSS configuration by ID (read-only).

Input parameters:

- `lss_config_id` (string, required)

### `zpa_list_lss_log_types` (~30 tokens)

List the human-readable LSS source log types ZPA supports (read-only catalog).

Output parameters:

- `items`: The catalog payload as returned by ZPA.
- `kind` (string): Catalog kind (e.g. log_types, log_format, status_codes).

### `zpa_get_lss_log_format` (~45 tokens)

Get the pre-built LSS log-format templates (csv/json/tsv) for a log type (read-only).

Input parameters:

- `log_type` (string, required)

Output parameters:

- `items`: The catalog payload as returned by ZPA.
- `kind` (string): Catalog kind (e.g. log_types, log_format, status_codes).

### `zpa_list_lss_status_codes` (~36 tokens)

List ZPA LSS session status codes used in config filters (read-only catalog).

Input parameters:

- `log_type`

Output parameters:

- `items`: The catalog payload as returned by ZPA.
- `kind` (string): Catalog kind (e.g. log_types, log_format, status_codes).

### `zpa_list_lss_client_types` (~29 tokens)

List ZPA LSS client types for the current customer (read-only catalog).

Output parameters:

- `items`: The catalog payload as returned by ZPA.
- `kind` (string): Catalog kind (e.g. log_types, log_format, status_codes).

### `zpa_list_pra_credentials` (~110 tokens)

List ZPA PRA credentials (read-only). Secrets are never returned.

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_pra_credential` (~45 tokens)

Get one ZPA PRA credential by ID (read-only). Secrets are never returned.

Input parameters:

- `credential_id` (string, required)
- `microtenant_id`

### `zpa_list_pra_portals` (~106 tokens)

List ZPA PRA portals (read-only).

Input parameters:

- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_pra_portal` (~40 tokens)

Get one ZPA PRA portal by ID (read-only).

Input parameters:

- `microtenant_id`
- `portal_id` (string, required)

### `zpa_list_provisioning_keys` (~118 tokens)

List ZPA provisioning keys of a given type (read-only).

Input parameters:

- `key_type` (string, required)
- `microtenant_id`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_provisioning_key` (~43 tokens)

Get one ZPA provisioning key by ID and type (read-only).

Input parameters:

- `key_id` (string, required)
- `key_type` (string, required)

### `zpa_list_segment_groups` (~141 tokens)

List ZPA segment groups.

Each row is the full segment-group record with normalized highlights
(ids, enabled state, application-segment counts/ids, timestamps) on top.

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_segment_group` (~33 tokens)

Get one ZPA segment group.

Input parameters:

- `group_id` (string, required)
- `microtenant_id`

### `zpa_list_server_groups` (~115 tokens)

List ZPA server groups (read-only).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_server_group` (~36 tokens)

Get one ZPA server group (read-only).

Input parameters:

- `group_id` (string, required)
- `microtenant_id`

### `zpa_list_service_edge_groups` (~117 tokens)

List ZPA service edge groups (read-only).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_service_edge_group` (~38 tokens)

Get one ZPA service edge group (read-only).

Input parameters:

- `group_id` (string, required)
- `microtenant_id`

### `zpa_list_service_edges` (~136 tokens)

List individual ZPA Service Edges with health/status (read-only).

Distinct from `zpa_list_service_edge_groups` (the parent group resource).

Input parameters:

- `microtenant_id`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `zpa_get_service_edge` (~39 tokens)

Get one ZPA Service Edge by ID (read-only).

Input parameters:

- `microtenant_id`
- `service_edge_id` (string, required)

### `ztw_list_public_account_details` (~106 tokens)

List ZTW public-cloud account details (read-only).

Input parameters:

- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `ztw_get_discovery_settings` (~37 tokens)

Get ZTW workload-discovery settings (read-only singleton).

Returns the decision-bearing knobs plus the full payload in `settings`.

Output parameters:

- `discovery_role`: Discovery IAM role, if set.
- `external_id`: External ID, if set.
- `settings` (object): Full discovery-settings payload (curated container).

### `ztw_list_ip_destination_groups` (~121 tokens)

List ZTW IP destination groups.

Use `exclude_type` to omit a group type (e.g. exclude DSTN_FQDN). Read-only.

Input parameters:

- `exclude_type`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `ztw_list_ip_destination_groups_lite` (~123 tokens)

List ZTW IP destination groups via the lighter SDK endpoint (read-only).

Same records as `ztw_list_ip_destination_groups`; uses the lite endpoint.

Input parameters:

- `exclude_type`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…

### `ztw_list_ip_groups` (~111 tokens)

List ZTW IP groups.

\`search` is a server-side substring match on the group name. Read-only.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `ztw_list_ip_groups_lite` (~119 tokens)

List ZTW IP groups via the lighter SDK endpoint (read-only).

Same records as `ztw_list_ip_groups`; uses the lite endpoint.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `ztw_list_ip_source_groups` (~113 tokens)

List ZTW IP source groups.

\`search` is a server-side substring match on the group name. Read-only.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `ztw_list_ip_source_groups_lite` (~122 tokens)

List ZTW IP source groups via the lighter SDK endpoint (read-only).

Same records as `ztw_list_ip_source_groups`; uses the lite endpoint.

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `ztw_list_admins` (~136 tokens)

List ZTW admin users (read-only).

Input parameters:

- `include_admin_users`
- `include_api_roles`
- `include_auditor_users`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`
- `version`

### `ztw_list_roles` (~125 tokens)

List ZTW admin roles (read-only).

Input parameters:

- `include_api_roles`
- `include_auditor_role`
- `include_partner_role`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `role_ids`
- `search`

### `ztw_list_network_service_groups` (~99 tokens)

List ZTW network service groups (read-only).

Input parameters:

- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `ztw_list_network_services` (~118 tokens)

List ZTW network services.

Optionally filter by `protocol` or `search`. Read-only.

Input parameters:

- `locale`
- `protocol`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

### `ztw_list_public_cloud_info` (~117 tokens)

List ZTW public-cloud account info (read-only).

Input parameters:

- `cloud_type`
- `page`
- `page_size`
- `query`: Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]",…
- `search`

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/zscaler-zscaler-mcp-server/docker-io-zscaler-zscaler-mcp-server-latest#diagnostics

## Score history

- 2026-08-03: 38
- 2026-08-02: 38
- 2026-08-01: 38
- 2026-07-31: 38
- 2026-07-30: 42
- 2026-07-29: 42
- 2026-07-28: 42
- 2026-07-27: 42
- 2026-07-26: 11

## Links

- Repository: https://github.com/zscaler/zscaler-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/zscaler-zscaler-mcp-server/docker-io-zscaler-zscaler-mcp-server-latest/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/zscaler-zscaler-mcp-server/docker-io-zscaler-zscaler-mcp-server-latest/changelog.json
- HTML version of this page: https://verifymcp.io/servers/zscaler-zscaler-mcp-server/docker-io-zscaler-zscaler-mcp-server-latest