List Secure Access API keys in the organization. Requires Key Admin credentials (SECURE_ACCESS_KEY_ADMIN_KEY/SECRET).

Get a single Secure Access API key by id (Key Admin credentials).

Create a Secure Access API key. The secret value is returned ONCE; store it immediately. Requires Key Admin credentials.

Refresh a Secure Access API key (rotates its secret). The new secret is returned ONCE; store it immediately. Requires Key Admin credentials.

Delete a Secure Access API key. Requires Key Admin credentials.

List the alert rules configured for the organization.

Get a single alert rule by id.

Create an alert rule. definition is a free-form JSON object whose exact schema depends on the alert type — see the Cisco Alerting API reference for the supported triggers and notification channels.

Delete an alert rule by id.

List the tenants visible to the authenticated parent / provider organization. Use the returned id as SECURE_ACCESS_ORG_ID to scope subsequent calls to a child tenant via X-Umbrella-OrgId.

List the Network Tunnel Groups in the organization.

Get a single Network Tunnel Group by id.

Create a Network Tunnel Group. Specify the Cisco Secure Access region name (use deploy_list_regions to enumerate).

Delete a Network Tunnel Group by id.

List Cisco Secure Access regions available for Network Tunnel Group placement.

List the Sites in the organization.

Get a single Site by id.

Create a Site.

Delete a Site by id.

List Networks in the organization.

Get a single Network by id.

Create a Network identified by a CIDR. Both ip_address and prefix_length (or alternatively a cidr string) are validated as syntactically correct before being sent to Cisco.

Delete a Network by id.

List Roaming Computers in the organization, optionally filtered by device name or DNS-layer / SWG status.

Get a single Roaming Computer by id.

Delete a Roaming Computer (removes the device from Secure Access; the user will need to re-enroll if they reconnect).

List Destination Lists in the organization.

Get a single Destination List by id.

Create a Destination List. The list access (allow/block) and destination_type are recorded at creation; entries are added separately via policy_add_destinations or in the same call by passing initial_destinations.

Delete a Destination List by id.

List the destinations (entries) in a Destination List.

Add one or more destinations to a Destination List. Each entry is a dict with at least destination and optional comment.

Remove one or more destinations (by their ids) from a Destination List.

List Access Rules in the organization (paginated).

Get a single Access Rule by id.

Create an Access Rule. The definition dict is sent as-is to the Cisco API — see the Access Rules reference for the supported keys (identities, destinations, applications, profiles, schedule, etc.).

Update an Access Rule by id with a partial set of fields. Only the keys supplied in patch are sent to Cisco.

Delete an Access Rule by id.

List Application Lists in the organization.

Get a single Application List by id.

Create an Application List. application_ids are Cisco-published internet application identifiers — discover them with policy_list_application_categories (v1.1) or via the Cisco UI.

Delete an Application List by id.