Zscaler MCP Server: manage your Zscaler tenant from Claude, Cursor and VS Code

• Lists the Internet Access ATP malicious-URL denylist

  List the ZIA ATP malicious-URL denylist.

  Try: “List my ZIA ATP malicious-URL denylist”

  Network · zia_list_atp_malicious_urls

• Lists the Internet Access cookie-auth exempt URL list

  List the ZIA cookie-auth exempt URL list.

  Try: “List my ZIA cookie-auth exempt URL list”

  Network · zia_list_auth_exempt_urls

• Lists the available CAC actions for a category (and optional cloud apps)

  List the available CAC actions for a category (and optional cloud apps).

  Try: “List my available CAC actions for a category (and optional cloud apps)”

  Network · zia_list_cloud_app_control_actions

• Lists Internet Access Cloud App Control rules for a category

  List ZIA Cloud App Control rules for a category.

  Try: “List my ZIA Cloud App Control rules for a category”

  Network · zia_list_cloud_app_control_rules

• Lists Internet Access Cloud Firewall DNS rules

  List ZIA Cloud Firewall DNS rules.

  Try: “List my ZIA Cloud Firewall DNS rules”

  Network · zia_list_cloud_firewall_dns_rules

• Lists Internet Access Cloud Firewall IPS rules

  List ZIA Cloud Firewall IPS rules.

  Try: “List my ZIA Cloud Firewall IPS rules”

  Network · zia_list_cloud_firewall_ips_rules

• Lists Internet Access Cloud Firewall rules

  List ZIA Cloud Firewall rules.

  Try: “List my ZIA Cloud Firewall rules”

  Network · zia_list_cloud_firewall_rules

• Lists Internet Access device groups

  List ZIA device groups.

  Try: “List my ZIA device groups”

  Network · zia_list_device_groups

• Lists Internet Access devices

  List ZIA devices.

  Try: “List my ZIA devices”

  Network · zia_list_devices

• Lists Internet Access devices via the lighter endpoint (id/name only)

  List ZIA devices via the lighter endpoint (id/name only).

  Try: “List my ZIA devices via the lighter endpoint (id/name only)”

  Network · zia_list_devices_lite

• Lists Internet Access file-type categories usable in File Type Control rules

  List ZIA file-type categories usable in File Type Control rules.

  Try: “List my ZIA file-type categories usable in File Type Control rules”

  Network · zia_list_file_type_categories

• Lists Internet Access File Type Control rules

  List ZIA File Type Control rules.

  Try: “List my ZIA File Type Control rules”

  Network · zia_list_file_type_control_rules

• Lists available Internet Access GRE internal-IP ranges

  List available ZIA GRE internal-IP ranges.

  Try: “List my available ZIA GRE internal-IP ranges”

  Network · zia_list_gre_ranges

• Lists Internet Access GRE tunnels

  List ZIA GRE tunnels.

  Try: “List my ZIA GRE tunnels”

  Network · zia_list_gre_tunnels

• Lists Internet Access IP destination groups

  List ZIA IP destination groups.

  Try: “List my ZIA IP destination groups”

  Network · zia_list_ip_destination_groups

• Lists Internet Access IP source groups

  List ZIA IP source groups.

  Try: “List my ZIA IP source groups”

  Network · zia_list_ip_source_groups

• Lists Internet Access custom IPS signature rules

  List ZIA custom IPS signature rules.

  Try: “List my ZIA custom IPS signature rules”

  Network · zia_list_ips_signature_rules

• Lists Internet Access location groups

  List ZIA location groups.

  Try: “List my ZIA location groups”

  Network · zia_list_location_groups

• Lists Internet Access locations

  List ZIA locations.

  Try: “List my ZIA locations”

  Network · zia_list_locations

• Lists Internet Access network application groups

  List ZIA network application groups.

  Try: “List my ZIA network application groups”

  Network · zia_list_network_app_groups

• Lists Internet Access network applications (predefined + custom)

  List ZIA network applications (predefined + custom).

  Try: “List my ZIA network applications (predefined + custom)”

  Network · zia_list_network_apps

• Lists Internet Access network services

  List ZIA network services. Use name for case-insensitive find-by-name.

  Try: “List my ZIA network services”

  Network · zia_list_network_services

• Lists Internet Access network service groups

  List ZIA network service groups.

  Try: “List my ZIA network service groups”

  Network · zia_list_network_svc_groups

• Lists Internet Access rule labels

  List ZIA rule labels.

  Try: “List my ZIA rule labels”

  Network · zia_list_rule_labels

• Lists Internet Access Sandbox rules

  List ZIA Sandbox rules.

  Try: “List my ZIA Sandbox rules”

  Network · zia_list_sandbox_rules

• Lists Internet Access Shadow IT custom tags

  List ZIA Shadow IT custom tags.

  Try: “List my ZIA Shadow IT custom tags”

  Network · zia_list_shadow_it_custom_tags

• Lists Internet Access SSL Inspection rules

  List ZIA SSL Inspection rules.

  Try: “List my ZIA SSL Inspection rules”

  Network · zia_list_ssl_inspection_rules

• Lists Internet Access static IPs

  List ZIA static IPs.

  Try: “List my ZIA static IPs”

  Network · zia_list_static_ips

• Lists Internet Access time intervals

  List ZIA time intervals.

  Try: “List my ZIA time intervals”

  Network · zia_list_time_intervals

• Lists Internet Access URL categories

  List ZIA URL categories. Narrow the request, since the full list can be large.

  Try: “List my ZIA URL categories”

  Network · zia_list_url_categories

• Lists Internet Access URL Filtering rules

  List ZIA URL Filtering rules.

  Try: “List my ZIA URL Filtering rules”

  Network · zia_list_url_filtering_rules

• Lists Internet Access VPN credentials (PSK never returned)

  List ZIA VPN credentials (PSK never returned).

  Try: “List my ZIA VPN credentials (PSK never returned)”

  Network · zia_list_vpn_credentials

• Lists Internet Access Web DLP rules

  List ZIA Web DLP rules.

  Try: “List my ZIA Web DLP rules”

  Network · zia_list_web_dlp_rules

• Lists Internet Access Web DLP rules via the lighter SDK endpoint

  List ZIA Web DLP rules via the lighter SDK endpoint.

  Try: “List my ZIA Web DLP rules via the lighter SDK endpoint”

  Network · zia_list_web_dlp_rules_lite

• Lists Internet Access workload groups

  List ZIA workload groups.

  Try: “List my ZIA workload groups”

  Network · zia_list_workload_groups

• Reads Internet Access DLP dictionaries: list all/lite, or fetch one by ID

  Read ZIA DLP dictionaries: list all/lite, or fetch one by ID.

  Network · get_zia_dlp_dictionaries

• Reads Internet Access DLP engines: list all/lite, or fetch one by ID

  Read ZIA DLP engines: list all/lite, or fetch one by ID.

  Network · get_zia_dlp_engines

• Reads Internet Access user departments: list with filters, or fetch one by ID

  Read ZIA user departments: list with filters, or fetch one by ID.

  Network · get_zia_user_departments

• Reads Internet Access user groups: fetch by ID, find by name, or list

  Read ZIA user groups: fetch by ID, find by name, or list.

  Network · get_zia_user_groups

• Reads Internet Access users: list with optional filters, or fetch one by ID

  Read ZIA users: list with optional filters, or fetch one by ID.

  Network · get_zia_users

• Resolves Internet Access geo data by coordinates, by IP, or by city prefix

  Resolve ZIA geo data by coordinates, by IP, or by city prefix.

  Network · zia_geo_search

• Gets the current Internet Access configuration activation status

  Get the current ZIA configuration activation status.

  Network · zia_get_activation_status

• Gets the Internet Access tenant-wide Advanced Settings object

  Get the ZIA tenant-wide Advanced Settings object.

  Network · zia_get_advanced_settings

• Gets the Internet Access malware inspection (traffic-direction toggles)

  Get the ZIA malware inspection (traffic-direction toggles).

  Network · zia_get_atp_malware_inspection

• Gets the Internet Access malware policy (file-handling toggles)

  Get the ZIA malware policy (file-handling toggles).

  Network · zia_get_atp_malware_policy

• Gets the Internet Access malware protocol toggles (HTTP/FTP)

  Get the ZIA malware protocol toggles (HTTP/FTP).

  Network · zia_get_atp_malware_protocols

• Gets the Internet Access ATP security-exception bypass URL allowlist

  Get the ZIA ATP security-exception bypass URL allowlist.

  Network · zia_get_atp_security_exceptions

• Gets the Internet Access tenant-wide ATP policy block

  Get the ZIA tenant-wide ATP policy block.

  Network · zia_get_atp_settings

• Gets a single Internet Access Cloud App Control rule by category + ID

  Get a single ZIA Cloud App Control rule by category + ID.

  Network · zia_get_cloud_app_control_rule

• Gets a single Internet Access Cloud Firewall DNS rule by ID with member references

  Get a single ZIA Cloud Firewall DNS rule by ID with member references.

  Network · zia_get_cloud_firewall_dns_rule

• Gets a single Internet Access Cloud Firewall IPS rule by ID with member references

  Get a single ZIA Cloud Firewall IPS rule by ID with member references.

  Network · zia_get_cloud_firewall_ips_rule

• Gets a single Internet Access Cloud Firewall rule by ID with member references

  Get a single ZIA Cloud Firewall rule by ID with member references.

  Network · zia_get_cloud_firewall_rule

• Gets a single Internet Access File Type Control rule by ID with member references

  Get a single ZIA File Type Control rule by ID with member references.

  Network · zia_get_file_type_control_rule

• Gets a single Internet Access GRE tunnel by ID

  Get a single ZIA GRE tunnel by ID.

  Network · zia_get_gre_tunnel

• Gets a single Internet Access IP destination group by ID with full members

  Get a single ZIA IP destination group by ID with full members.

  Network · zia_get_ip_destination_group

• Gets a single Internet Access IP source group by ID with its full member list

  Get a single ZIA IP source group by ID with its full member list.

  Network · zia_get_ip_source_group

• Gets a single Internet Access custom IPS signature rule by ID with its body

  Get a single ZIA custom IPS signature rule by ID with its body.

  Network · zia_get_ips_signature_rule

• Gets a single Internet Access location by ID with its full configuration

  Get a single ZIA location by ID with its full configuration.

  Network · zia_get_location

• Gets a single Internet Access location group by ID

  Get a single ZIA location group by ID.

  Network · zia_get_location_group

• Gets the Internet Access 16-field malware threat-class settings block

  Get the ZIA 16-field malware threat-class settings block.

  Network · zia_get_malware_settings

• Gets the Internet Access Mobile Advanced Threat Settings object

  Get the ZIA Mobile Advanced Threat Settings object.

  Network · zia_get_mobile_advanced_settings

• Gets a single Internet Access network application by ID

  Get a single ZIA network application by ID.

  Network · zia_get_network_app

• Gets a single Internet Access network application group by ID with members

  Get a single ZIA network application group by ID with members.

  Network · zia_get_network_app_group

• Gets a single Internet Access network service by ID with its port definitions

  Get a single ZIA network service by ID with its port definitions.

  Network · zia_get_network_service

• Gets a single Internet Access network service group by ID with members

  Get a single ZIA network service group by ID with members.

  Network · zia_get_network_svc_group

• Gets a single Internet Access rule label by ID

  Get a single ZIA rule label by ID.

  Network · zia_get_rule_label

• Gets the Internet Access Sandbox behavioral-analysis configuration

  Get the ZIA Sandbox behavioral-analysis configuration.

  Network · zia_get_sandbox_behavioral_analysis

• Gets the Internet Access Sandbox custom file-hash blocklist usage/quota

  Get the ZIA Sandbox custom file-hash blocklist usage/quota.

  Network · zia_get_sandbox_file_hash_count

• Gets the Internet Access Sandbox API submission quota

  Get the ZIA Sandbox API submission quota.

  Network · zia_get_sandbox_quota

• Gets the Internet Access Sandbox detonation report for a file MD5 hash

  Get the ZIA Sandbox detonation report for a file MD5 hash. The report includes content from the tested file, which may come from an attacker, next to Zscaler's analysis.

  Network · zia_get_sandbox_report

• Gets a single Internet Access Sandbox rule by ID with member references

  Get a single ZIA Sandbox rule by ID with member references.

  Network · zia_get_sandbox_rule

• Gets a single Internet Access SSL Inspection rule by ID with member references

  Get a single ZIA SSL Inspection rule by ID with member references.

  Network · zia_get_ssl_inspection_rule

• Gets a single Internet Access static IP by ID

  Get a single ZIA static IP by ID.

  Network · zia_get_static_ip

• Gets a single Internet Access time interval by ID

  Get a single ZIA time interval by ID.

  Network · zia_get_time_interval

• Gets a single Internet Access URL category by ID (full detail)

  Get a single ZIA URL category by ID (full detail).

  Network · zia_get_url_category

• Gets a Zscaler-curated predefined URL category by ID or display name

  Get a Zscaler-curated predefined URL category by ID or display name.

  Network · zia_get_url_category_predefined

• Gets a single Internet Access URL Filtering rule by ID with member references

  Get a single ZIA URL Filtering rule by ID with member references.

  Network · zia_get_url_filtering_rule

• Gets a single Internet Access VPN credential by ID

  Get a single ZIA VPN credential by ID.

  Network · zia_get_vpn_credential

• Gets a single Internet Access Web DLP rule by ID with member references

  Get a single ZIA Web DLP rule by ID with member references.

  Network · zia_get_web_dlp_rule

• Gets a single Internet Access workload group by ID

  Get a single ZIA workload group by ID.

  Network · zia_get_workload_group

• Tells you which URL category a web address belongs to

  Looks up which ZIA URL category a web address belongs to.

  Network · zia_url_lookup

• Adds URLs to the Internet Access ATP malicious-URL denylist

  Add URLs to the ZIA ATP malicious-URL denylist. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_add_atp_malicious_urls

• Adds URLs to the Internet Access cookie-auth exempt list

  Add URLs to the ZIA cookie-auth exempt list. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_add_auth_exempt_urls

• Adds URLs to an existing Internet Access URL category

  Incrementally add URLs to an existing ZIA URL category. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_add_urls_to_category

• Creates an Internet Access Cloud App Control rule

  Create a ZIA Cloud App Control rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_cloud_app_control_rule

• Creates an Internet Access Cloud Firewall DNS rule

  Create a ZIA Cloud Firewall DNS rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_cloud_firewall_dns_rule

• Creates an Internet Access Cloud Firewall IPS rule

  Create a ZIA Cloud Firewall IPS rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_cloud_firewall_ips_rule

• Creates an Internet Access Cloud Firewall rule

  Create a ZIA Cloud Firewall rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_cloud_firewall_rule

• Creates an Internet Access File Type Control rule

  Create a ZIA File Type Control rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_file_type_control_rule

• Creates an Internet Access GRE tunnel

  Create a ZIA GRE tunnel. Finds/creates the backing static IP first. It only loads when you turn on write tools and allow it.

  Write · zia_create_gre_tunnel

• Creates an Internet Access IP destination group

  Create a ZIA IP destination group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_ip_destination_group

• Creates an Internet Access IP source group

  Create a ZIA IP source group. Call zia_activate_configuration after. It only loads when you turn on write tools and allow it.

  Write · zia_create_ip_source_group

• Creates an Internet Access custom IPS signature rule

  Create a ZIA custom IPS signature rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_ips_signature_rule

• Creates an Internet Access location

  Create a ZIA location. Needs ipAddresses or vpnCredentials. It only loads when you turn on write tools and allow it.

  Write · zia_create_location

• Creates an Internet Access network application group

  Create a ZIA network application group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_network_app_group

• Creates a custom Internet Access network service

  Create a custom ZIA network service. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_network_service

• Creates an Internet Access network service group

  Create a ZIA network service group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_network_svc_group

• Creates an Internet Access rule label

  Create a ZIA rule label. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_rule_label

• Creates an Internet Access Sandbox rule

  Create a ZIA Sandbox rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_sandbox_rule

• Creates an Internet Access SSL Inspection rule

  Create a ZIA SSL Inspection rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_ssl_inspection_rule

• Creates an Internet Access static IP

  Create a ZIA static IP. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_static_ip

• Creates an Internet Access time interval

  Create a ZIA time interval. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_time_interval

• Creates a new custom Internet Access URL category

  Create a new custom ZIA URL category. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_url_category

• Creates an Internet Access URL Filtering rule

  Create a ZIA URL Filtering rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_url_filtering_rule

• Creates an Internet Access VPN credential

  Create a ZIA VPN credential. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_vpn_credential

• Creates an Internet Access Web DLP rule

  Create a ZIA Web DLP rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_create_web_dlp_rule

• Activates staged Internet Access configuration changes

  Activate staged ZIA configuration changes. Run after any ZIA write. It only loads when you turn on write tools and allow it.

  Write · zia_activate_configuration

• Sets sanction state or custom tags on many Shadow IT apps at once

  Bulk-apply sanction state and/or custom tags to Shadow IT apps. It only loads when you turn on write tools and allow it.

  Write · zia_bulk_update_shadow_it_apps

• Updates Internet Access Advanced Settings

  Update ZIA Advanced Settings. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_advanced_settings

• Updates the Internet Access malware inspection

  Update the ZIA malware inspection. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_atp_malware_inspection

• Updates the Internet Access malware policy

  Update the ZIA malware policy. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_atp_malware_policy

• Updates the Internet Access malware protocol toggles

  Update the ZIA malware protocol toggles. Re-fetches authoritative state. It only loads when you turn on write tools and allow it.

  Write · zia_update_atp_malware_protocols

• Replaces the Internet Access ATP security-exception allowlist

  Replace the ZIA ATP security-exception allowlist. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_atp_security_exceptions

• Updates Internet Access ATP settings

  Update ZIA ATP settings. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_atp_settings

• Updates an Internet Access Cloud App Control rule

  Update a ZIA Cloud App Control rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_cloud_app_control_rule

• Updates an Internet Access Cloud Firewall DNS rule

  Update a ZIA Cloud Firewall DNS rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_cloud_firewall_dns_rule

• Updates an Internet Access Cloud Firewall IPS rule

  Update a ZIA Cloud Firewall IPS rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_cloud_firewall_ips_rule

• Updates an Internet Access Cloud Firewall rule

  Update a ZIA Cloud Firewall rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_cloud_firewall_rule

• Updates an Internet Access File Type Control rule

  Update a ZIA File Type Control rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_file_type_control_rule

• Updates an Internet Access IP destination group

  Update a ZIA IP destination group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_ip_destination_group

• Updates an Internet Access IP source group

  Update a ZIA IP source group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_ip_source_group

• Updates an Internet Access custom IPS signature rule (PUT-replace; backfills

  Update a ZIA custom IPS signature rule (PUT-replace; backfills name/rule_text). Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_ips_signature_rule

• Updates an Internet Access location

  Update a ZIA location. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_location

• Updates the Internet Access malware threat-class settings

  Update the ZIA malware threat-class settings. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_malware_settings

• Updates Internet Access Mobile Advanced Threat Settings

  Update ZIA Mobile Advanced Threat Settings. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_mobile_advanced_settings

• Updates an Internet Access network application group

  Update a ZIA network application group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_network_app_group

• Updates an Internet Access network service

  Update a ZIA network service. Ports, if given, replace existing. It only loads when you turn on write tools and allow it.

  Write · zia_update_network_service

• Updates an Internet Access network service group

  Update a ZIA network service group. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_network_svc_group

• Updates an Internet Access rule label

  Update a ZIA rule label. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_rule_label

• Updates an Internet Access Sandbox rule

  Update a ZIA Sandbox rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_sandbox_rule

• Updates an Internet Access SSL Inspection rule

  Update a ZIA SSL Inspection rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_ssl_inspection_rule

• Updates an Internet Access static IP

  Update a ZIA static IP. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_static_ip

• Updates an Internet Access time interval (PUT-replace; backfills omitted fields)

  Update a ZIA time interval (PUT-replace; backfills omitted fields). Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_time_interval

• Updates a custom Internet Access URL category (full PUT-replace)

  Update a custom ZIA URL category (full PUT-replace). Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_url_category

• Updates a Zscaler-curated predefined URL category (full PUT)

  Update a Zscaler-curated predefined URL category (full PUT). Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_url_category_predefined

• Updates an Internet Access URL Filtering rule

  Update a ZIA URL Filtering rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_url_filtering_rule

• Updates an Internet Access VPN credential

  Update a ZIA VPN credential. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_vpn_credential

• Updates an Internet Access Web DLP rule

  Update a ZIA Web DLP rule. Activate after. It only loads when you turn on write tools and allow it.

  Write · zia_update_web_dlp_rule

• Removes URLs from the Internet Access ATP malicious-URL denylist

  Remove URLs from the ZIA ATP malicious-URL denylist. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_atp_malicious_urls

• Removes URLs from the Internet Access cookie-auth exempt list

  Remove URLs from the ZIA cookie-auth exempt list. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_auth_exempt_urls

• Deletes an Internet Access Cloud App Control rule

  Delete a ZIA Cloud App Control rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_cloud_app_control_rule

• Deletes an Internet Access Cloud Firewall DNS rule

  Delete a ZIA Cloud Firewall DNS rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_cloud_firewall_dns_rule

• Deletes an Internet Access Cloud Firewall IPS rule

  Delete a ZIA Cloud Firewall IPS rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_cloud_firewall_ips_rule

• Deletes an Internet Access Cloud Firewall rule

  Delete a ZIA Cloud Firewall rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_cloud_firewall_rule

• Deletes an Internet Access File Type Control rule

  Delete a ZIA File Type Control rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_file_type_control_rule

• Deletes an Internet Access GRE tunnel and its backing static IP

  Delete a ZIA GRE tunnel and its backing static IP. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_gre_tunnel

• Deletes an Internet Access IP destination group

  Delete a ZIA IP destination group. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_ip_destination_group

• Deletes an Internet Access IP source group

  Delete a ZIA IP source group. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_ip_source_group

• Deletes an Internet Access custom IPS signature rule

  Delete a ZIA custom IPS signature rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_ips_signature_rule

• Deletes an Internet Access location

  Delete a ZIA location. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_location

• Deletes an Internet Access network application group

  Delete a ZIA network application group. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_network_app_group

• Deletes an Internet Access network service

  Delete a ZIA network service. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_network_service

• Deletes an Internet Access network service group

  Delete a ZIA network service group. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_network_svc_group

• Deletes an Internet Access rule label

  Delete a ZIA rule label. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_rule_label

• Deletes an Internet Access Sandbox rule

  Delete a ZIA Sandbox rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_sandbox_rule

• Deletes an Internet Access SSL Inspection rule

  Delete a ZIA SSL Inspection rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_ssl_inspection_rule

• Deletes an Internet Access static IP

  Delete a ZIA static IP. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_static_ip

• Deletes an Internet Access time interval

  Delete a ZIA time interval. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_time_interval

• Deletes a custom Internet Access URL category

  Delete a custom ZIA URL category. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_url_category

• Deletes an Internet Access URL Filtering rule

  Delete a ZIA URL Filtering rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_url_filtering_rule

• Deletes an Internet Access VPN credential

  Delete a ZIA VPN credential. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_vpn_credential

• Deletes an Internet Access Web DLP rule

  Delete a ZIA Web DLP rule. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_delete_web_dlp_rule

• Removes URLs from an existing Internet Access URL category

  Incrementally remove URLs from an existing ZIA URL category. Activate after. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zia_remove_urls_from_category

• Lists Private Access access policy rules

  List ZPA access policy rules.

  Try: “List my ZPA access policy rules”

  Network · zpa_list_access_policy_rules

• Lists Private Access app connector groups

  List ZPA app connector groups.

  Try: “List my ZPA app connector groups”

  Network · zpa_list_app_connector_groups

• Lists Private Access app connectors with health/status

  List ZPA app connectors with health/status.

  Try: “List my ZPA app connectors with health/status”

  Network · zpa_list_app_connectors

• Lists Private Access app-protection (inspection) policy rules

  List ZPA app-protection (inspection) policy rules.

  Try: “List my ZPA app-protection (inspection) policy rules”

  Network · zpa_list_app_protection_rules

• Lists Private Access application segments

  List ZPA application segments. Each row is the full segment record with normalized highlights on top (ids, member domains/server groups, ports, and behavior toggles).

  Try: “List my ZPA application segments”

  Network · zpa_list_application_segments

• Lists Private Access browser-access (clientless) application segments

  List ZPA browser-access (clientless) application segments.

  Try: “List my ZPA browser-access (clientless) application segments”

  Network · zpa_list_application_segments_ba

• Lists Private Access privileged-remote-access application segments

  List ZPA privileged-remote-access application segments.

  Try: “List my ZPA privileged-remote-access application segments”

  Network · zpa_list_application_segments_pra

• Lists Private Access application servers

  List ZPA application servers.

  Try: “List my ZPA application servers”

  Network · zpa_list_application_servers

• Lists Private Access Browser Access certificates

  List ZPA Browser Access certificates.

  Try: “List my ZPA Browser Access certificates”

  Network · zpa_list_ba_certificates

• Lists Private Access client forwarding policy rules

  List ZPA client forwarding policy rules.

  Try: “List my ZPA client forwarding policy rules”

  Network · zpa_list_forwarding_policy_rules

• Lists Private Access isolation policy rules

  List ZPA isolation policy rules.

  Try: “List my ZPA isolation policy rules”

  Network · zpa_list_isolation_policy_rules

• Lists Private Access LSS configurations, showing which log feed goes where

  List ZPA LSS configurations, showing which log feed goes where.

  Try: “List my ZPA LSS configurations, showing which log feed goes where”

  Network · zpa_list_lss_configs

• Lists Private Access PRA credentials

  List ZPA PRA credentials. Secrets are never returned.

  Try: “List my ZPA PRA credentials”

  Network · zpa_list_pra_credentials

• Lists Private Access PRA portals

  List ZPA PRA portals.

  Try: “List my ZPA PRA portals”

  Network · zpa_list_pra_portals

• Lists Private Access provisioning keys of a given type

  List ZPA provisioning keys of a given type.

  Try: “List my ZPA provisioning keys of a given type”

  Network · zpa_list_provisioning_keys

• Lists Private Access segment groups

  List ZPA segment groups. Each row is the full segment-group record with normalized highlights (ids, enabled state, application-segment counts/ids, timestamps) on top.

  Try: “List my ZPA segment groups”

  Network · zpa_list_segment_groups

• Lists Private Access server groups

  List ZPA server groups.

  Try: “List my ZPA server groups”

  Network · zpa_list_server_groups

• Lists Private Access service edge groups

  List ZPA service edge groups.

  Try: “List my ZPA service edge groups”

  Network · zpa_list_service_edge_groups

• Lists individual Private Access Service Edges with health/status

  List individual ZPA Service Edges with health/status. Distinct from zpa_list_service_edge_groups (the parent group resource).

  Try: “List my individual ZPA Service Edges with health/status”

  Network · zpa_list_service_edges

• Lists Private Access timeout policy rules

  List ZPA timeout policy rules.

  Try: “List my ZPA timeout policy rules”

  Network · zpa_list_timeout_policy_rules

• Lists Private Access App Protection (inspection) profiles, or filter by name

  List ZPA App Protection (inspection) profiles, or filter by name.

  Try: “List my ZPA App Protection (inspection) profiles, or filter by name”

  Network · get_zpa_app_protection_profile

• Retrieves Private Access application segments filtered by application type

  Retrieve ZPA application segments filtered by application type. application_type must be BROWSER_ACCESS, INSPECT, or SECURE_REMOTE_ACCESS.

  Network · get_zpa_app_segments_by_type

• Reads Private Access enrollment certificates: list all, or look one up by name or ID

  Read ZPA enrollment certificates: list all, or look one up by name or ID.

  Network · get_zpa_enrollment_certificate

• Lists Private Access Cloud Browser Isolation (CBI) profiles, or filter by exact name

  List ZPA Cloud Browser Isolation (CBI) profiles, or filter by exact name.

  Try: “List my ZPA Cloud Browser Isolation (CBI) profiles, or filter by exact name”

  Network · get_zpa_isolation_profile

• Lists Private Access posture profiles, or look one up by ID or name

  List ZPA posture profiles, or look one up by ID or name.

  Try: “List my ZPA posture profiles, or look one up by ID or name”

  Network · get_zpa_posture_profile

• Lists Private Access SAML attributes, optionally scoped to a named IdP

  List ZPA SAML attributes, optionally scoped to a named IdP.

  Try: “List my ZPA SAML attributes, optionally scoped to a named IdP”

  Network · get_zpa_saml_attribute

• Lists Private Access SCIM attributes for a named IdP, or fetch one by ID

  List ZPA SCIM attributes for a named IdP, or fetch one by ID.

  Try: “List my ZPA SCIM attributes for a named IdP, or fetch one by ID”

  Network · get_zpa_scim_attribute

• Fetches one Private Access SCIM group by ID, or list all groups under a named IdP

  Fetch one ZPA SCIM group by ID, or list all groups under a named IdP.

  Network · get_zpa_scim_group

• Lists Private Access trusted networks, or look one up by ID or name

  List ZPA trusted networks, or look one up by ID or name.

  Try: “List my ZPA trusted networks, or look one up by ID or name”

  Network · get_zpa_trusted_network

• Gets one Private Access access policy rule

  Get one ZPA access policy rule.

  Network · zpa_get_access_policy_rule

• Gets one Private Access app connector by ID

  Get one ZPA app connector by ID.

  Network · zpa_get_app_connector

• Gets one Private Access app connector group

  Get one ZPA app connector group.

  Network · zpa_get_app_connector_group

• Gets one Private Access app-protection (inspection) policy rule

  Get one ZPA app-protection (inspection) policy rule.

  Network · zpa_get_app_protection_rule

• Gets one Private Access application segment

  Get one ZPA application segment.

  Network · zpa_get_application_segment

• Gets one Private Access browser-access application segment

  Get one ZPA browser-access application segment.

  Network · zpa_get_application_segment_ba

• Gets one Private Access privileged-remote-access application segment

  Get one ZPA privileged-remote-access application segment.

  Network · zpa_get_application_segment_pra

• Gets one Private Access application server

  Get one ZPA application server.

  Network · zpa_get_application_server

• Gets one Private Access Browser Access certificate by ID

  Get one ZPA Browser Access certificate by ID.

  Network · zpa_get_ba_certificate

• Gets one Private Access client forwarding policy rule

  Get one ZPA client forwarding policy rule.

  Network · zpa_get_forwarding_policy_rule

• Gets one Private Access isolation policy rule

  Get one ZPA isolation policy rule.

  Network · zpa_get_isolation_policy_rule

• Gets one Private Access LSS configuration by ID

  Get one ZPA LSS configuration by ID.

  Network · zpa_get_lss_config

• Gets the pre-built LSS log-format templates (csv/json/tsv) for a log type

  Get the pre-built LSS log-format templates (csv/json/tsv) for a log type.

  Network · zpa_get_lss_log_format

• Gets one Private Access PRA credential by ID

  Get one ZPA PRA credential by ID. Secrets are never returned.

  Network · zpa_get_pra_credential

• Gets one Private Access PRA portal by ID

  Get one ZPA PRA portal by ID.

  Network · zpa_get_pra_portal

• Gets one Private Access provisioning key by ID and type

  Get one ZPA provisioning key by ID and type.

  Network · zpa_get_provisioning_key

• Gets one Private Access segment group

  Get one ZPA segment group.

  Network · zpa_get_segment_group

• Gets one Private Access server group

  Get one ZPA server group.

  Network · zpa_get_server_group

• Gets one Private Access Service Edge by ID

  Get one ZPA Service Edge by ID.

  Network · zpa_get_service_edge

• Gets one Private Access service edge group

  Get one ZPA service edge group.

  Network · zpa_get_service_edge_group

• Gets one Private Access timeout policy rule

  Get one ZPA timeout policy rule.

  Network · zpa_get_timeout_policy_rule

• Creates a Private Access access policy rule

  Create a ZPA access policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_create_access_policy_rule

• Creates a Private Access app connector group

  Create a ZPA app connector group. It only loads when you turn on write tools and allow it.

  Write · zpa_create_app_connector_group

• Creates a Private Access app-protection (inspection) policy rule

  Create a ZPA app-protection (inspection) policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_create_app_protection_rule

• Creates a Private Access application segment

  Create a ZPA application segment. Requires name + segment_group_id and at least one port range (TCP or UDP, via tcp_port_ranges/udp_port_ranges or advanced). It only loads when you turn on write tools and allow it.

  Write · zpa_create_application_segment

• Creates a Private Access browser-access application segment

  Create a ZPA browser-access application segment. It only loads when you turn on write tools and allow it.

  Write · zpa_create_application_segment_ba

• Creates a Private Access privileged-remote-access application segment

  Create a ZPA privileged-remote-access application segment. It only loads when you turn on write tools and allow it.

  Write · zpa_create_application_segment_pra

• Creates a Private Access application server

  Create a ZPA application server. It only loads when you turn on write tools and allow it.

  Write · zpa_create_application_server

• Creates a Private Access Browser Access certificate from a PEM blob

  Create a ZPA Browser Access certificate from a PEM blob. It only loads when you turn on write tools and allow it.

  Write · zpa_create_ba_certificate

• Creates a Private Access client forwarding policy rule

  Create a ZPA client forwarding policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_create_forwarding_policy_rule

• Creates a Private Access isolation policy rule

  Create a ZPA isolation policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_create_isolation_policy_rule

• Creates a Private Access PRA credential

  Create a ZPA PRA credential. It only loads when you turn on write tools and allow it.

  Write · zpa_create_pra_credential

• Creates a Private Access PRA portal

  Create a ZPA PRA portal. It only loads when you turn on write tools and allow it.

  Write · zpa_create_pra_portal

• Creates a Private Access provisioning key

  Create a ZPA provisioning key. It only loads when you turn on write tools and allow it.

  Write · zpa_create_provisioning_key

• Creates a Private Access segment group and return the full record

  Create a ZPA segment group and return the full record. It only loads when you turn on write tools and allow it.

  Write · zpa_create_segment_group

• Creates a Private Access server group

  Create a ZPA server group. Needs at least one App Connector Group. It only loads when you turn on write tools and allow it.

  Write · zpa_create_server_group

• Creates a Private Access service edge group

  Create a ZPA service edge group. Needs a name, latitude, longitude and location. It only loads when you turn on write tools and allow it.

  Write · zpa_create_service_edge_group

• Creates a Private Access timeout policy rule

  Create a ZPA timeout policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_create_timeout_policy_rule

• Updates a Private Access access policy rule

  Update a ZPA access policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_update_access_policy_rule

• Updates a Private Access app connector (enable/disable, rename)

  Update a ZPA app connector (enable/disable, rename). It only loads when you turn on write tools and allow it.

  Write · zpa_update_app_connector

• Updates a Private Access app connector group

  Update a ZPA app connector group. It only loads when you turn on write tools and allow it.

  Write · zpa_update_app_connector_group

• Updates a Private Access app-protection (inspection) policy rule

  Update a ZPA app-protection (inspection) policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_update_app_protection_rule

• Updates a Private Access application segment

  Update a ZPA application segment. Only provided fields are sent. It only loads when you turn on write tools and allow it.

  Write · zpa_update_application_segment

• Updates a Private Access browser-access application segment

  Update a ZPA browser-access application segment. Only provided fields are sent. It only loads when you turn on write tools and allow it.

  Write · zpa_update_application_segment_ba

• Updates a Private Access privileged-remote-access application segment

  Update a ZPA privileged-remote-access application segment. Only provided fields are sent. It only loads when you turn on write tools and allow it.

  Write · zpa_update_application_segment_pra

• Updates a Private Access application server

  Update a ZPA application server. It only loads when you turn on write tools and allow it.

  Write · zpa_update_application_server

• Updates a Private Access client forwarding policy rule

  Update a ZPA client forwarding policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_update_forwarding_policy_rule

• Updates a Private Access isolation policy rule

  Update a ZPA isolation policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_update_isolation_policy_rule

• Updates a Private Access PRA credential

  Update a ZPA PRA credential. credential_type cannot change. It only loads when you turn on write tools and allow it.

  Write · zpa_update_pra_credential

• Updates a Private Access PRA portal

  Update a ZPA PRA portal. It only loads when you turn on write tools and allow it.

  Write · zpa_update_pra_portal

• Updates a Private Access provisioning key

  Update a ZPA provisioning key. It only loads when you turn on write tools and allow it.

  Write · zpa_update_provisioning_key

• Updates a Private Access segment group and return the full record

  Update a ZPA segment group and return the full record. It only loads when you turn on write tools and allow it.

  Write · zpa_update_segment_group

• Updates a Private Access server group

  Update a ZPA server group. Partial update. It only loads when you turn on write tools and allow it.

  Write · zpa_update_server_group

• Updates a Private Access Service Edge (enable/disable, rename)

  Update a ZPA Service Edge (enable/disable, rename). It only loads when you turn on write tools and allow it.

  Write · zpa_update_service_edge

• Updates a Private Access service edge group

  Update a ZPA service edge group. It only loads when you turn on write tools and allow it.

  Write · zpa_update_service_edge_group

• Updates a Private Access timeout policy rule

  Update a ZPA timeout policy rule. It only loads when you turn on write tools and allow it.

  Write · zpa_update_timeout_policy_rule

• Deletes many Private Access app connectors at once

  Bulk-delete ZPA app connectors. Each must be re-provisioned to reconnect. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_bulk_delete_app_connectors

• Deletes many Private Access Service Edges at once

  Bulk-delete ZPA Service Edges. Each must be re-provisioned to reconnect. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_bulk_delete_service_edges

• Deletes a Private Access access policy rule

  Delete a ZPA access policy rule. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_access_policy_rule

• Deletes a Private Access app connector

  Delete a ZPA app connector. Must be re-provisioned to reconnect. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_app_connector

• Deletes a Private Access app connector group

  Delete a ZPA app connector group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_app_connector_group

• Deletes a Private Access app-protection (inspection) policy rule

  Delete a ZPA app-protection (inspection) policy rule. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_app_protection_rule

• Deletes a Private Access application segment

  Delete a ZPA application segment. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_application_segment

• Deletes a Private Access browser-access application segment

  Delete a ZPA browser-access application segment. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_application_segment_ba

• Deletes a Private Access privileged-remote-access application segment

  Delete a ZPA privileged-remote-access application segment. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_application_segment_pra

• Deletes a Private Access application server

  Delete a ZPA application server. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_application_server

• Deletes a Private Access Browser Access certificate

  Delete a ZPA Browser Access certificate. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_ba_certificate

• Deletes a Private Access client forwarding policy rule

  Delete a ZPA client forwarding policy rule. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_forwarding_policy_rule

• Deletes a Private Access isolation policy rule

  Delete a ZPA isolation policy rule. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_isolation_policy_rule

• Deletes a Private Access PRA credential

  Delete a ZPA PRA credential. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_pra_credential

• Deletes a Private Access PRA portal

  Delete a ZPA PRA portal. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_pra_portal

• Deletes a Private Access provisioning key

  Delete a ZPA provisioning key. If the key was already removed (e.g. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_provisioning_key

• Deletes a Private Access segment group

  Delete a ZPA segment group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_segment_group

• Deletes a Private Access server group

  Delete a ZPA server group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_server_group

• Deletes a single Private Access Service Edge

  Delete a single ZPA Service Edge. Must be re-provisioned to reconnect. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_service_edge

• Deletes a Private Access service edge group

  Delete a ZPA service edge group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_service_edge_group

• Deletes a Private Access timeout policy rule

  Delete a ZPA timeout policy rule. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zpa_delete_timeout_policy_rule

• Lists devices affected by a Digital Experience alert

  List devices affected by a ZDX alert. Returns one identifying row per affected device.

  Try: “List my devices affected by a ZDX alert”

  Network · zdx_list_alert_affected_devices

• Lists ongoing Digital Experience alerts

  List ongoing ZDX alerts. Returns one triage row per ongoing alert (id, rule, severity, type, start time, impacted-device count).

  Try: “List my ongoing ZDX alerts”

  Network · zdx_list_alerts

• Lists users/devices that accessed a Digital Experience application, as curated rows

  List users/devices that accessed a ZDX application, as curated rows. Returns one triage row per user (id, name, email, ZDX score).

  Try: “List my users/devices that accessed a ZDX application, as curated rows”

  Network · zdx_list_application_users

• Lists active Digital Experience applications

  List active ZDX applications. Returns one row per application (id, name, ZDX score, impact signals).

  Try: “List my active ZDX applications”

  Network · zdx_list_applications

• Lists cloud-path probes for an app on a Digital Experience device (full records)

  List cloud-path probes for an app on a ZDX device (full records). Call this BEFORE zdx_start_deeptrace to obtain the cloudpath_probe_id the deep-trace payload needs.

  Try: “List my cloud-path probes for an app on a ZDX device (full records)”

  Network · zdx_list_cloudpath_probes

• Lists the top processes captured during a Digital Experience deep trace (full records)

  List the top processes captured during a ZDX deep trace (full records). Returns the process groups captured during the session, useful for spotting resource-intensive processes impacting performance.

  Try: “List my top processes captured during a ZDX deep trace (full records)”

  Network · zdx_list_deeptrace_top_processes

• Lists Digital Experience departments

  List ZDX departments. Use a returned id as the department_id scope filter on other ZDX tools.

  Try: “List my ZDX departments”

  Network · zdx_list_departments

• Lists deep-trace sessions for a Digital Experience device (full records)

  List deep-trace sessions for a ZDX device (full records). Returns one row per trace (id, status, session name, app, ISO timestamps).

  Try: “List my deep-trace sessions for a ZDX device (full records)”

  Network · zdx_list_device_deep_traces

• Lists active Digital Experience devices

  List active ZDX devices. Returns one identifying row per device (id, hostname, owning user).

  Try: “List my active ZDX devices”

  Network · zdx_list_devices

• Lists historical (ended) Digital Experience alerts

  List historical (ended) ZDX alerts. Like zdx_list_alerts but for alert rules that have an Ended On date.

  Try: “List my historical (ended) ZDX alerts”

  Network · zdx_list_historical_alerts

• Lists Digital Experience locations

  List ZDX locations. Use a returned id as the location_id scope filter on other ZDX tools.

  Try: “List my ZDX locations”

  Network · zdx_list_locations

• Lists the Digital Experience software inventory

  List the ZDX software inventory. Returns one row per software title (key, name, vendor, version, install/user counts).

  Try: “List my ZDX software inventory”

  Network · zdx_list_software

• Gets one Digital Experience alert as a curated, agent-facing detail view

  Get one ZDX alert as a curated, agent-facing detail view. Adds the impacted department / location / geolocation scope to the summary fields.

  Network · zdx_get_alert

• Gets the status/result of a Digital Experience score analysis

  Get the status/result of a ZDX score analysis. Returns whether the analysis is still running or its results if complete.

  Network · zdx_get_analysis

• Gets the Digital Experience score for one application, with its most-impacted regions

  Get the ZDX score for one application, with its most-impacted regions. Returns the headline ZDX score plus the per-region impact breakdown for the since HOURS window (default 2h).

  Network · zdx_get_application

• Gets Digital Experience performance metrics for one application (time-series)

  Get ZDX performance metrics for one application (time-series). Returns one series per metric (Page Fetch Time, DNS Time, availability), each with its datapoints over the since HOURS window (default 2h).

  Network · zdx_get_application_metric

• Gets the Digital Experience score trend (over time) for one application

  Get the ZDX score trend (over time) for one application. Returns the score-over-time datapoints for the since HOURS window (default 2h) so the agent can reason about whether an app's experience is improving or degrading.

  Network · zdx_get_application_score_trend

• Gets one user's Digital Experience detail for an application (per-device breakdown)

  Get one user's ZDX detail for an application (per-device breakdown). Returns the user's score plus the nested per-device metrics for the since HOURS window (default 2h).

  Network · zdx_get_application_user

• Gets the cloud-path (hop-by-hop network path) captured during a Digital Experience deep

  Get the cloud-path (hop-by-hop network path) captured during a ZDX deep trace.

  Network · zdx_get_deeptrace_cloudpath

• Gets cloud-path metrics captured during a Digital Experience deep trace

  Get cloud-path metrics captured during a ZDX deep trace.

  Network · zdx_get_deeptrace_cloudpath_metrics

• Gets the events captured during a Digital Experience deep trace

  Get the events captured during a ZDX deep trace.

  Network · zdx_get_deeptrace_events

• Gets device health metrics captured during a Digital Experience deep trace

  Get device health metrics captured during a ZDX deep trace.

  Network · zdx_get_deeptrace_health_metrics

• Gets web-probe metrics captured during a Digital Experience deep trace

  Get web-probe metrics captured during a ZDX deep trace.

  Network · zdx_get_deeptrace_webprobe_metrics

• Gets one active Digital Experience device

  Get one active ZDX device. The ZDX SDK returns a single-element list; the device record is unwrapped and shaped to the identifying fields.

  Network · zdx_get_device

• Gets one Digital Experience deep-trace session

  Get one ZDX deep-trace session. The SDK returns a single-element list; the trace record is unwrapped, timestamps ISO-normalized, and shaped to the identity fields.

  Network · zdx_get_device_deep_trace

• Expands one Digital Experience software key into its per-user/device install rows

  Expand one ZDX software key into its per-user/device install rows. Returns the users and devices that have the given software_key installed.

  Network · zdx_get_software_details

• Lists web probes for an app on a Digital Experience device (full records)

  List web probes for an app on a ZDX device (full records). Call this BEFORE zdx_start_deeptrace to obtain the web_probe_id the deep-trace payload needs.

  Try: “List my web probes for an app on a ZDX device (full records)”

  Network · zdx_get_web_probes

• Starts a Digital Experience score analysis on a device/app

  Start a ZDX score analysis on a device/app. Evaluates connectivity and performance metrics over the optional t0/t1 epoch range. It only loads when you turn on write tools and allow it.

  Write · zdx_start_analysis

• Starts a Digital Experience deep-trace session

  Start a ZDX deep-trace session. Captures network path, web-probe, health, and event data for troubleshooting. It only loads when you turn on write tools and allow it.

  Write · zdx_start_deeptrace

• Stops or deletes a running Digital Experience score analysis

  Stop/delete a running ZDX score analysis. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zdx_delete_analysis

• Deletes a Digital Experience deep-trace session

  Delete a ZDX deep-trace session. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · zdx_delete_deeptrace

• Lists Client Connector enrolled devices

  List ZCC enrolled devices. Each row is the full device record, including identity, OS, agent version, registration state, assigned policy, ownership, hardware, VPN state and enrollment and keep-alive times.

  Try: “List my ZCC enrolled devices”

  Network · zcc_list_devices

• Lists Client Connector forwarding profiles (by company)

  List ZCC forwarding profiles (by company).

  Try: “List my ZCC forwarding profiles (by company)”

  Network · zcc_list_forwarding_profiles

• Lists Client Connector trusted networks (by company)

  List ZCC trusted networks (by company).

  Try: “List my ZCC trusted networks (by company)”

  Network · zcc_list_trusted_networks

• Gets the OTP bundle for a Client Connector device (logout / exit / uninstall / disable

  Get the OTP bundle for a ZCC device (logout / exit / uninstall / disable OTPs). Requires the device's udid (from zcc_list_devices).

  Network · zcc_get_device_otp

• Lists Workload Segmentation admin users

  List ZTW admin users.

  Try: “List my ZTW admin users”

  Network · ztw_list_admins

• Lists Workload Segmentation IP destination groups

  List ZTW IP destination groups. Use exclude_type to omit a group type (e.g.

  Try: “List my ZTW IP destination groups”

  Network · ztw_list_ip_destination_groups

• Lists Workload Segmentation IP destination groups via the lighter SDK endpoint

  List ZTW IP destination groups via the lighter SDK endpoint. Same records as ztw_list_ip_destination_groups; uses the lite endpoint.

  Try: “List my ZTW IP destination groups via the lighter SDK endpoint”

  Network · ztw_list_ip_destination_groups_lite

• Lists Workload Segmentation IP groups

  List ZTW IP groups. search is a server-side substring match on the group name.

  Try: “List my ZTW IP groups”

  Network · ztw_list_ip_groups

• Lists Workload Segmentation IP groups via the lighter SDK endpoint

  List ZTW IP groups via the lighter SDK endpoint. Same records as ztw_list_ip_groups; uses the lite endpoint.

  Try: “List my ZTW IP groups via the lighter SDK endpoint”

  Network · ztw_list_ip_groups_lite

• Lists Workload Segmentation IP source groups

  List ZTW IP source groups. search is a server-side substring match on the group name.

  Try: “List my ZTW IP source groups”

  Network · ztw_list_ip_source_groups

• Lists Workload Segmentation IP source groups via the lighter SDK endpoint

  List ZTW IP source groups via the lighter SDK endpoint. Same records as ztw_list_ip_source_groups; uses the lite endpoint.

  Try: “List my ZTW IP source groups via the lighter SDK endpoint”

  Network · ztw_list_ip_source_groups_lite

• Lists Workload Segmentation network service groups

  List ZTW network service groups.

  Try: “List my ZTW network service groups”

  Network · ztw_list_network_service_groups

• Lists Workload Segmentation network services

  List ZTW network services. Optionally filter by protocol or search.

  Try: “List my ZTW network services”

  Network · ztw_list_network_services

• Lists Workload Segmentation public-cloud account details

  List ZTW public-cloud account details.

  Try: “List my ZTW public-cloud account details”

  Network · ztw_list_public_account_details

• Lists Workload Segmentation public-cloud account info

  List ZTW public-cloud account info.

  Try: “List my ZTW public-cloud account info”

  Network · ztw_list_public_cloud_info

• Lists Workload Segmentation admin roles

  List ZTW admin roles.

  Try: “List my ZTW admin roles”

  Network · ztw_list_roles

• Gets Workload Segmentation workload-discovery settings

  Get ZTW workload-discovery settings. Returns the decision-bearing knobs plus the full payload in settings.

  Network · ztw_get_discovery_settings

• Creates a Workload Segmentation IP destination group

  Create a ZTW IP destination group. Country names/codes are converted to COUNTRY_XX and are only valid for DSTN_OTHER groups. It only loads when you turn on write tools and allow it.

  Write · ztw_create_ip_destination_group

• Creates a Workload Segmentation IP group

  Create a ZTW IP group. It only loads when you turn on write tools and allow it.

  Write · ztw_create_ip_group

• Creates a Workload Segmentation IP source group

  Create a ZTW IP source group. It only loads when you turn on write tools and allow it.

  Write · ztw_create_ip_source_group

• Deletes a Workload Segmentation IP destination group

  Delete a ZTW IP destination group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · ztw_delete_ip_destination_group

• Deletes a Workload Segmentation IP group

  Delete a ZTW IP group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · ztw_delete_ip_group

• Deletes a Workload Segmentation IP source group

  Delete a ZTW IP source group. Cannot be undone. It only loads when you turn on write tools and allow it. It asks for your confirmation before it runs.

  Delete · ztw_delete_ip_source_group

• Lists ZIdentity groups

  List ZIdentity groups. Returns lean group summaries (id, name, description, dynamic flag, source IdP) rather than the full SDK group record.

  Try: “List my ZIdentity groups”

  Network · zid_list_groups

• Lists ZIdentity users

  List ZIdentity users. Returns lean user summaries (id, login name, display name, primary email) rather than the full SDK user record.

  Try: “List my ZIdentity users”

  Network · zid_list_users

• Gets one ZIdentity group by ID

  Get one ZIdentity group by ID.

  Network · zid_get_group

• Lists the users that belong to a ZIdentity group, by group ID

  List the users that belong to a ZIdentity group, by group ID. Returns lean user summaries (id, login name, display name, primary email) for each member of the group.

  Try: “List my users that belong to a ZIdentity group, by group ID”

  Network · zid_get_group_users

• Lists the users in a ZIdentity group resolved by group name

  List the users in a ZIdentity group resolved by group name. Resolves the group by case-insensitive partial name first, then returns the lean user summaries for the first matching group's members.

  Try: “List my users in a ZIdentity group resolved by group name”

  Network · zid_get_group_users_by_name

• Gets one ZIdentity user by ID

  Get one ZIdentity user by ID.

  Network · zid_get_user

• Lists the groups a ZIdentity user belongs to, by user ID

  List the groups a ZIdentity user belongs to, by user ID. Returns lean group summaries (id, name, description, dynamic flag, source IdP) for each of the user's group memberships.

  Try: “List my groups a ZIdentity user belongs to, by user ID”

  Network · zid_get_user_groups

• Lists a ZIdentity user's group memberships, resolving the user by name

  List a ZIdentity user's group memberships, resolving the user by name. Resolves the user by case-insensitive partial match (email when '@' present, else login then display name), then returns the lean group summaries for the first matching user's memberships.

  Try: “List my a ZIdentity user's group memberships, resolving the user by name”

  Network · zid_get_user_groups_by_name

• Searches ZIdentity groups by name (case-insensitive partial match)

  Search ZIdentity groups by name (case-insensitive partial match). Returns curated group summaries.

  Network · zid_search_groups

• Searches ZIdentity users by name, login name, or email

  Search ZIdentity users by name, login name, or email. Case-insensitive partial match.

  Network · zid_search_users

• Lists attack surface findings for an organization

  List EASM findings for an organization. Returns one triage row per finding (id, category, type, status, risk level/score, impacted asset, first/last seen) rather than the raw SDK record.

  Try: “List my EASM findings for an organization”

  Network · zeasm_list_findings

• Lists attack surface lookalike domains for an organization

  List EASM lookalike domains for an organization. Returns one triage row per detected lookalike/impersonation domain (the lookalike, the domain it impersonates, risk, registration state, deception methods).

  Try: “List my EASM lookalike domains for an organization”

  Network · zeasm_list_lookalike_domains

• Lists ZEASM organizations

  List ZEASM organizations. Returns one row per organization configured in the EASM Admin Portal, carrying just the id + name.

  Try: “List my ZEASM organizations”

  Network · zeasm_list_organizations

• Gets the full detail for one attack surface finding

  Get the full detail for one EASM finding. Adds description, country, CISA/EPSS exploitation-likelihood signals, and scan provenance on top of the triage fields.

  Network · zeasm_get_finding_details

• Gets the scan evidence attributed to one attack surface finding

  Get the scan evidence attributed to one EASM finding. Returns the evidence content (the subset of scan output attributable to this finding) and its source_type.

  Network · zeasm_get_finding_evidence

• Gets the complete scan output for one attack surface finding

  Get the complete scan output for one EASM finding. Returns the full scan content and its source_type.

  Network · zeasm_get_finding_scan_output

• Gets full detail for one attack surface lookalike domain

  Get full detail for one EASM lookalike domain. Adds description, registrar/registrant + lifecycle dates, and remediation guidance on top of the triage fields.

  Network · zeasm_get_lookalike_domain

• Gets the CASB (Cloud Access Security Broker) SaaS-application usage report

  Get the CASB (Cloud Access Security Broker) SaaS-application usage report. One row per SaaS application with its aggregated usage total, for seeing which cloud apps are being accessed.

  Network · zins_get_casb_app_report

• Gets cyber-security incidents grouped by category

  Get cyber-security incidents grouped by category. Groups incidents by one or more dimensions (default THREAT_CATEGORY_ID); multi-dimension groupings surface their breakdown under nested entries.

  Network · zins_get_cyber_incidents

• Gets cyber-security incidents grouped by location (or app/user/department)

  Get cyber-security incidents grouped by location (or app/user/department). One id/name/total row per location (or the chosen id-bearing dimension), useful for ranking which sites carry the most incidents.

  Network · zins_get_cyber_incidents_by_location

• Gets cyber-security incidents correlated by threat category and application

  Get cyber-security incidents grouped by threat category and application. Each threat category comes with a breakdown by app, useful for finding the most-targeted apps.

  Network · zins_get_cyber_incidents_by_threat_and_app

• Gets the daily cyber-security incident trend over time

  Get the daily cyber-security incident trend over time. Groups incidents by day (categorize_by=TIME) so you can spot spikes across the window.

  Network · zins_get_cyber_incidents_daily

• Gets Zero Trust Firewall traffic grouped by action (allow/block)

  Get Zero Trust Firewall traffic grouped by action (allow/block). One row per action with its aggregated total for the allowed-vs-blocked split.

  Network · zins_get_firewall_by_action

• Gets Zero Trust Firewall traffic grouped by location

  Get Zero Trust Firewall traffic grouped by location. One id/name/total row per location, for ranking which sites drive the most firewall traffic.

  Network · zins_get_firewall_by_location

• Gets Zero Trust Firewall traffic grouped by network service

  Get Zero Trust Firewall traffic grouped by network service. One row per network service (protocol/port) with its aggregated total.

  Network · zins_get_firewall_network_services

• Gets IoT device statistics and classifications

  Get IoT device statistics and classifications. A single current-state object: total/IoT/user/server/unclassified device counts plus a per-classification breakdown under entries.

  Network · zins_get_iot_device_stats

• Gets discovered Shadow IT applications with risk and usage detail

  Get discovered Shadow IT applications with risk and usage detail. One row per unsanctioned/discovered app: category, risk index, sanctioned state, data volume, and user count.

  Network · zins_get_shadow_it_apps

• Gets the aggregate Shadow IT summary dashboard

  Get the aggregate Shadow IT summary dashboard. A single object with org-wide totals (apps, bytes, upload/download) plus breakdowns grouped by category and by risk index.

  Network · zins_get_shadow_it_summary

• Gets threat-class distribution (Virus/Spyware, Advanced, Behavioral)

  Get threat-class distribution (Virus/Spyware, Advanced, Behavioral). One row per threat class with its aggregated total.

  Network · zins_get_threat_class

• Gets threat super-categories (malware, phishing, spyware, …) from web traffic

  Get threat super-categories (malware, phishing, spyware, …) from web traffic. One row per threat super-category with its aggregated total.

  Network · zins_get_threat_super_categories

• Gets web traffic broken down by protocol (HTTP, HTTPS, SSL, …)

  Get web traffic broken down by protocol (HTTP, HTTPS, SSL, …). One row per protocol with its aggregated total.

  Network · zins_get_web_protocols

• Gets web traffic aggregated per location

  Get web traffic aggregated per location. Each row is a location with its total transactions or bytes; pass include_trend=True for the per-location time-series under trend.

  Network · zins_get_web_traffic_by_location

• Gets overall web traffic volume with no grouping

  Get overall web traffic volume with no grouping. Returns total organization traffic, optionally filtered by DLP engine or action (ALLOW/BLOCK), and optionally with an overall time-series trend.

  Network · zins_get_web_traffic_no_grouping

• Lists Microsegmentation agent groups

  List ZMS agent groups. Returns one row per group (eyez_id, name, type, cloud provider, agent count, policy/tamper status).

  Try: “List my ZMS agent groups”

  Network · zms_list_agent_groups

• Lists Microsegmentation microsegmentation agents

  List ZMS microsegmentation agents. Returns one row per agent (eyez_id, name, connection status, version, OS, IP).

  Try: “List my ZMS microsegmentation agents”

  Network · zms_list_agents

• Lists Microsegmentation app zones

  List ZMS app zones. Returns one row per app zone (id, name, description, resource count).

  Try: “List my ZMS app zones”

  Network · zms_list_app_zones

• Lists Microsegmentation default policy rules

  List ZMS default policy rules. The built-in default rules evaluated when no custom rule matches.

  Try: “List my ZMS default policy rules”

  Network · zms_list_default_policy_rules

• Lists Microsegmentation enrollment nonces

  List ZMS enrollment nonces. Returns one row per nonce (eyez_id, name, status, expiry).

  Try: “List my ZMS enrollment nonces”

  Network · zms_list_nonces

• Lists Microsegmentation microsegmentation policy rules

  List ZMS microsegmentation policy rules. Returns one row per rule (id, name, action, priority, enabled).

  Try: “List my ZMS microsegmentation policy rules”

  Network · zms_list_policy_rules

• Lists Microsegmentation resource groups

  List ZMS resource groups. Returns one row per group (id, name, managed/unmanaged type, origin, member count, and CIDRs/FQDNs for unmanaged groups).

  Try: “List my ZMS resource groups”

  Network · zms_list_resource_groups

• Lists Microsegmentation resources (workloads)

  List ZMS resources (workloads). Returns one row per workload (id, name, type, status, cloud provider/region, OS, IPs).

  Try: “List my ZMS resources (workloads)”

  Network · zms_list_resources

• Lists Microsegmentation tag keys within a namespace

  List ZMS tag keys within a namespace. Middle of the tag hierarchy.

  Try: “List my ZMS tag keys within a namespace”

  Network · zms_list_tag_keys

• Lists Microsegmentation tag namespaces

  List ZMS tag namespaces. Top of the tag hierarchy (namespace -> key -> value).

  Try: “List my ZMS tag namespaces”

  Network · zms_list_tag_namespaces

• Lists Microsegmentation tag values for a key

  List ZMS tag values for a key. Bottom of the tag hierarchy.

  Try: “List my ZMS tag values for a key”

  Network · zms_list_tag_values

• Gets Microsegmentation agent connection-status statistics

  Get ZMS agent connection-status statistics. Returns connected vs disconnected counts / percentages for fleet health.

  Network · zms_get_agent_connection_status_statistics

• Gets the TOTP secrets for a Microsegmentation agent group

  Get the TOTP secrets for a ZMS agent group. Keyed by eyez_id.

  Network · zms_get_agent_group_totp_secrets

• Gets Microsegmentation agent version statistics

  Get ZMS agent version statistics. Returns the distribution of agent software versions across the fleet, useful for spotting outdated agents.

  Network · zms_get_agent_version_statistics

• Gets Microsegmentation resource event metadata

  Get ZMS resource event metadata. Returns metadata about the resource-level events available in the deployment.

  Network · zms_get_metadata

• Gets one Microsegmentation nonce

  Get one ZMS nonce. Keyed by eyez_id.

  Network · zms_get_nonce

• Lists the members of a Microsegmentation resource group

  List the members of a ZMS resource group. Returns one row per member workload.

  Try: “List my members of a ZMS resource group”

  Network · zms_get_resource_group_members

• Gets the Microsegmentation resource-group protection-status summary

  Get the ZMS resource-group protection-status summary. Returns protected vs unprotected group counts and percentage.

  Network · zms_get_resource_group_protection_status

• Gets the Microsegmentation resource protection-status summary

  Get the ZMS resource protection-status summary. Returns protected vs unprotected counts and protection percentage, showing microsegmentation coverage at a glance.

  Network · zms_get_resource_protection_status

• Lists Zscaler Cellular anomaly policies

  List Zscaler Cellular anomaly policies. Returns one row per policy (id, name, type, enabled state, run status, applied SIM location groups, violation count) over a days lookback window.

  Try: “List my Zscaler Cellular anomaly policies”

  Network · zcell_list_anomaly_policies

• Lists the activity log for one Zscaler Cellular anomaly policy

  List the activity log for one Zscaler Cellular anomaly policy. Returns the enable/disable/run history (status + message + timestamp) for the given policy_id.

  Try: “List my activity log for one Zscaler Cellular anomaly policy”

  Network · zcell_list_anomaly_policy_logs

• Lists the ICCIDs that violated a Zscaler Cellular anomaly policy

  List the ICCIDs that violated a Zscaler Cellular anomaly policy. Returns the policy rows carrying violation data over a days lookback window.

  Try: “List my ICCIDs that violated a Zscaler Cellular anomaly policy”

  Network · zcell_list_anomaly_policy_violations

• Searches Zscaler Cellular audit-log entries over a lookback window

  Search Zscaler Cellular audit-log entries over a lookback window. Returns curated audit rows (who changed what, when, and the operation) over a days window, with optional operation/object/visibility filters.

  Network · zcell_list_audit_customers_search

• Lists the Zscaler Cellular audit filter vocabulary

  List the Zscaler Cellular audit filter vocabulary. Returns the valid operation types and object types you can pass to zcell_list_audit_customers_search.

  Try: “List my Zscaler Cellular audit filter vocabulary”

  Network · zcell_list_audit_metadata

• Lists the anomaly-policy violation events for one ICCID

  List the anomaly-policy violation events for one ICCID. Returns the individual violation events (event type, zone, timestamp) attributed to iccid under policy_id, over a days lookback window.

  Try: “List my anomaly-policy violation events for one ICCID”

  Network · zcell_list_iccid_violations

• Searches Zscaler Cellular network/session events over a lookback window

  Search Zscaler Cellular network/session events over a lookback window. Returns curated event rows (timestamp, event, outcome, SIM/ICCID, country, carrier, RAT, IP) over a days window, with optional filter_by conditions, sort_by, and pagination.

  Network · zcell_list_network_events

• Lists Zscaler Cellular configured regions with their operational status

  List Zscaler Cellular configured regions with their operational status. Returns each configured region plus the broker-cluster (BC) and app-connector (AC) status blocks and the MAP A-C / B-C link statuses.

  Try: “List my Zscaler Cellular configured regions with their operational status”

  Network · zcell_list_region_operational_status

• Lists the Zscaler Cellular regions available/configured for the customer

  List the Zscaler Cellular regions available/configured for the customer. Returns each region and whether it is configured.

  Try: “List my Zscaler Cellular regions available/configured for the customer”

  Network · zcell_list_regions

• Lists Zscaler Cellular SIM map points (dashboard lat/lng summary)

  List Zscaler Cellular SIM map points (dashboard lat/lng summary). Returns SIM location points with their ICCIDs, IMSIs, and tags, the data behind the fleet map.

  Try: “List my Zscaler Cellular SIM map points (dashboard lat/lng summary)”

  Network · zcell_list_sim_analytics_map

• Lists the Zscaler Cellular SIM status summary (total/used/active/inactive)

  List the Zscaler Cellular SIM status summary (total/used/active/inactive). Returns the SIM-count breakdown for the tenant.

  Try: “List my Zscaler Cellular SIM status summary (total/used/active/inactive)”

  Network · zcell_list_sim_analytics_summary

• Lists Zscaler Cellular SIM location groups

  List Zscaler Cellular SIM location groups. Returns one row per group (id, name, tracked ICCIDs).

  Try: “List my Zscaler Cellular SIM location groups”

  Network · zcell_list_sim_location_groups

• Lists Zscaler Cellular data usage grouped by country (top countries)

  List Zscaler Cellular data usage grouped by country (top countries). Returns the top countries by data usage over a days lookback window.

  Try: “List my Zscaler Cellular data usage grouped by country (top countries)”

  Network · zcell_list_sim_usage_by_country

• Lists Zscaler Cellular data usage per day over the window

  List Zscaler Cellular data usage per day over the window. Returns one usage bucket per day over a days lookback window, optionally scoped to a single ICCID.

  Try: “List my Zscaler Cellular data usage per day over the window”

  Network · zcell_list_sim_usage_by_day

• Lists Zscaler Cellular data usage grouped by SIM (top SIMs)

  List Zscaler Cellular data usage grouped by SIM (top SIMs). Returns the top SIMs by data usage over a days lookback window.

  Try: “List my Zscaler Cellular data usage grouped by SIM (top SIMs)”

  Network · zcell_list_sim_usage_by_sim

• Searches the Zscaler Cellular SIM inventory with filters and pagination

  Search the Zscaler Cellular SIM inventory with filters and pagination. Returns a page of curated SIM records plus the aggregate usage/pagination envelope.

  Network · zcell_list_sims

• Lists the Zscaler Cellular SIM tags defined for the customer

  List the Zscaler Cellular SIM tags defined for the customer. Returns one row per tag (id, name, provenance).

  Try: “List my Zscaler Cellular SIM tags defined for the customer”

  Network · zcell_list_tags

• Gets the logged-in Zscaler Cellular customer's profile and SIM totals

  Get the logged-in Zscaler Cellular customer's profile and SIM totals. Returns the customer record: identity, activation state, platform, configured regions, SIM counts, current usage, and the linked ZIA/ZPA cloud and SIM-provider metadata.

  Network · zcell_get_customer_data_handling

• Gets the full Zscaler Cellular record for one SIM by ICCID

  Get the full Zscaler Cellular record for one SIM by ICCID. Returns the identifying, status, and device fields for the SIM (ICCID, IMSI/IMEI, status, network status, APN, IP, device, tags, usage).

  Network · zcell_get_sim_details

• Gets one Zscaler Cellular SIM location group

  Get one Zscaler Cellular SIM location group. Adds the geo-fence definition, linked anomaly policies, and the inside/outside ICCID membership buckets on top of the summary fields.

  Network · zcell_get_sim_location_group

• Used by the assistant behind the scenes

  Lists the Internet Access policy-engine cloud-application catalog (Cloud App Control)

  List the ZIA policy-engine cloud-application catalog (Cloud App Control).

  Network · zia_list_cloud_app_policy

• Lists the Internet Access policy-engine cloud-application catalog (SSL Inspection)

  List the ZIA policy-engine cloud-application catalog (SSL Inspection).

  Network · zia_list_cloud_app_ssl_policy

• Lists Internet Access Shadow IT applications (analytics catalog)

  List ZIA Shadow IT applications (analytics catalog).

  Network · zia_list_shadow_it_apps

• Lists Private Access LSS client types for the current customer

  List ZPA LSS client types for the current customer.

  Network · zpa_list_lss_client_types

• Lists the human-readable LSS source log types Private Access supports

  List the human-readable LSS source log types ZPA supports.

  Network · zpa_list_lss_log_types

• Lists Private Access LSS session status codes used in config filters

  List ZPA LSS session status codes used in config filters.

  Network · zpa_list_lss_status_codes

• Lists the Microsegmentation application catalog

  List the ZMS application catalog. Returns one row per discovered application (id, name, category) plus its nested port/protocol/process specs, useful for policy planning.

  Network · zms_list_app_catalog

• Loads another tool group while you work

  Turns on another named tool group during the session.

  Read · zscaler_enable_toolset

• Shows which tools are in a tool group

  Shows the tools inside one named tool group.

  Read · zscaler_get_toolset_tools

• Lists the tool groups you can load

  Lists the named tool groups the server offers, so the assistant can load only what it needs.

  Read · zscaler_list_toolsets

Watch out for

• With writes on, it can change live security policy

  Allowed write tools can create, change or delete firewall, URL filtering, DLP and private access rules and activate configuration. Allow only the exact actions you need. github.com

• Rule conditions can be silently dropped

  Open reports say private access policy rules can be saved without the conditions you gave. Check every rule in the Zscaler console after a change. github.com

• Still a public preview

  Zscaler asks you not to use it in production before version 1.0. Try it on a test tenant first. github.com

• Your API keys sit in a local file

  The server reads your Zscaler keys from a .env file. Keep it out of source control and use an API client limited to the products you need. github.com

• Deletes always ask for confirmation

  A delete never runs on the first call. Claude Desktop and Cursor ask you directly; other apps use a one-time code that expires in 5 minutes. github.com

Security advisories