Check connectivity to the Zscaler API.

Service-level overview of what is loaded in this session: which Zscaler services are callable, which are present but have zero callable tools because the OneAPI credentials are not entitled to them, and which were excluded by configuration. For tool-level discovery, prefer zscaler_list_toolsets. Treat the result as authoritative.

PRIMARY tool-discovery entry point. Call this FIRST for any user request that needs to find a Zscaler tool. Returns the toolsets this server organises tools into (one per resource family per service, e.g. 'zia_url_filtering', 'zpa_segment_groups'). Each row tells you whether the group is currently loaded, how many tools it contains, and whether it can be enabled in this session. Supports name / description / service substring filters so you can scope the result. Treat 'can_enable: false' as authoritative — the OneAPI credentials cannot access that product, do not retry.

Drill into a specific toolset to see its tools and whether each one can be called right now. Use after zscaler_list_toolsets has identified the relevant toolset. Each result row has 'available' and (when false) 'unavailable_reason'. Treat 'available: false' as authoritative and report the situation to the user instead of attempting to call the tool. Supports name / description substring filters to narrow the result.

Activate a toolset that was registered but not loaded at startup, so its tools become callable for the rest of the session. Refuses with status 'not_entitled' if the toolset belongs to a product the configured OneAPI credentials cannot access — in that case, report the result to the user and do not retry.

List ZPA application segments with optional filtering (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA application segment by ID (read-only)

List ZPA Browser Access (BA) application segments — the BA-specific counterpart of zpa_list_application_segments. Use only when the admin asks about Browser Access. Supports JMESPath client-side filtering via the query parameter (read-only).

Get a specific ZPA Browser Access (BA) application segment by ID, including its common_apps_dto.apps_config block (read-only). Use only when the admin asks about Browser Access.

List ZPA Privileged Remote Access (PRA) application segments — the PRA-specific counterpart of zpa_list_application_segments for RDP/SSH targets brokered through the PRA portal. Use only when the admin asks about Privileged Remote Access (RDP/SSH). Supports JMESPath client-side filtering via the query parameter (read-only).

Get a specific ZPA Privileged Remote Access (PRA) application segment by ID, including its common_apps_dto.apps_config block of RDP/SSH targets (read-only). Use only when the admin asks about Privileged Remote Access.

List ZPA App Connector Groups (read-only). Returns every connector group in the tenant — id, name, location, country, enrollment cert, server-group memberships. Use this to discover existing connector groups before creating server groups (which require an app_connector_group_id) or before onboarding an application. Supports name search and JMESPath client-side filtering via the query parameter.

Get a specific ZPA App Connector Group by ID (read-only). Returns the full record including the enrollmentCertId, server-group memberships, and connector membership.

List ZPA app connectors with status, version, and health information (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA app connector by ID with runtime status and control connection state (read-only)

List ZPA server groups (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA server group by ID (read-only)

List ZPA segment groups (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA segment group by ID (read-only)

List ZPA application servers (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA application server by ID (read-only)

List ZPA service edge groups (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA service edge group by ID (read-only)

List individual ZPA Service Edges (the cloud-hosted broker instances themselves, distinct from their parent service edge groups). Returns runtime status, version, location, enrollment cert, and serviceEdgeGroupId. Use to inventory edges before bulk operations or to verify enrollment after a provisioning key was used. Supports JMESPath client-side filtering via the query parameter (read-only).

Get a specific ZPA Service Edge by ID — full record including control-channel state, runtime status, version, location, enrollment certificate, and parent service edge group membership (read-only).

List ZPA browser access certificates (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA browser access certificate by ID (read-only)

List ZPA access policy rules (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA access policy rule by ID (read-only)

List ZPA forwarding policy rules (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA forwarding policy rule by ID (read-only)

List ZPA timeout policy rules (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA timeout policy rule by ID (read-only)

List ZPA isolation policy rules (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA isolation policy rule by ID (read-only)

List ZPA app protection rules (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA app protection rule by ID (read-only)

List ZPA provisioning keys (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA provisioning key by ID (read-only)

List ZPA PRA portals (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA PRA portal by ID (read-only)

List ZPA PRA credentials (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA PRA credential by ID (read-only)

Manage ZPA App Protection Profiles (Inspection Profiles) (read-only)

Manage ZPA Enrollment Certificates (read-only)

Manage ZPA Cloud Browser Isolation (CBI) profiles (read-only)

Manage ZPA Posture Profiles (read-only)

Manage ZPA SAML Attributes (read-only)

Manage ZPA SCIM Attributes (read-only)

Manage ZPA SCIM Groups (read-only)

Manage ZPA application segments by type (read-only)

Manage ZPA Trusted Networks (read-only)

List ZPA Log Streaming Service (LSS) configurations — each record routes a log feed (User Activity, User Status, Audit, App Connector Status/Metrics, Browser Access, Web Inspection, etc.) from ZPA to a customer-side LSS Connector / SIEM. Read-only configuration; does not return log content. Supports JMESPath client-side filtering via the query parameter.

Get a specific ZPA LSS configuration by ID, including source log type, log format template, destination host/port, TLS setting, associated App Connector Groups, policy-rule scope, and filter status codes (read-only).

List the human-readable LSS source log types supported by ZPA (e.g. user_activity, user_status, audit_logs, app_connector_status, app_connector_metrics, browser_access, web_inspection, private_svc_edge_status). Use these values when authoring an LSS config or when verifying baseline log-feed coverage (read-only).

Get the pre-configured LSS log format templates (csv / json / tsv) for a given source log type. Useful for confirming exactly which fields ZPA serializes into the SIEM stream (read-only).

List ZPA LSS session status codes used in LSS config filters. Returns code → metadata (including which log types each code applies to). Use when authoring a status-code filter or when interpreting a streamed event (read-only).

List ZPA LSS client types for the current customer (e.g. web_browser, client_connector, machine_tunnel, zpa_lss). Returns the human-readable name → internal identifier mapping used in LSS policy-rule conditions (read-only).

List ZDX devices with optional filtering (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZDX device by ID (read-only)

List ZDX departments (read-only) Supports JMESPath client-side filtering via the query parameter.

List ZDX locations (read-only) Supports JMESPath client-side filtering via the query parameter.

Get ZDX metrics for a specified application (read-only)

Get ZDX application details (read-only)

Get ZDX application score trend (read-only)

List users for a ZDX application (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZDX application user (read-only)

List ZDX alerts (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZDX alert by ID (read-only)

List devices affected by a ZDX alert (read-only) Supports JMESPath client-side filtering via the query parameter.

List ZDX applications (read-only) Supports JMESPath client-side filtering via the query parameter.

List ZDX deep traces for a device (read-only) Supports JMESPath client-side filtering via the query parameter.

Get a specific ZDX deep trace by ID (read-only)

Get top processes from a ZDX deep trace session (read-only) Supports JMESPath client-side filtering via the query parameter.

Get web probe metrics from a ZDX deep trace session (read-only)

Get cloud path metrics from a ZDX deep trace session (read-only)

Get cloud path topology from a ZDX deep trace session (read-only)

Get health metrics from a ZDX deep trace session (read-only)

Get events from a ZDX deep trace session (read-only)

Get status of a ZDX score analysis (read-only)

Get web probes for an app on a device - returns web_probe_id needed for zdx_start_deeptrace (read-only)

List cloud path probes for an app on a device - returns cloudpath_probe_id needed for zdx_start_deeptrace (read-only) Supports JMESPath client-side filtering via the query parameter.

List ZDX historical alerts (read-only) Supports JMESPath client-side filtering via the query parameter.

List ZDX software inventory (read-only) Supports JMESPath client-side filtering via the query parameter.

Get details for specific ZDX software (read-only)

Provides web traffic analytics grouped by location, including traffic volume, bandwidth usage, and office traffic comparisons.

Provides total web traffic volume metrics without grouping, including aggregate bandwidth and overall web usage statistics.

Provides web protocol distribution analytics (HTTP, HTTPS, SSL), including protocol usage and HTTPS adoption metrics.

Provides threat super-category analytics including malware, phishing, spyware, and other threat types detected across the tenant.

Provides detailed threat classification analytics including virus, trojan, ransomware, and other malware type breakdowns.

Provides cybersecurity incidents grouped by category, including security events, cyber attacks, and incident breakdowns.

Provides cybersecurity incidents grouped by location, showing incident distribution across offices and sites.

Provides daily cybersecurity incident trends, showing incident patterns and security statistics over time.

Provides cybersecurity incidents correlated by threat type and application, showing which apps are targeted and threat-application relationships.

Provides Zero Trust Firewall traffic analytics by action (allow/block), including blocked traffic volume and firewall policy effectiveness.

Provides Zero Trust Firewall traffic analytics grouped by location, including firewall activity by office and branch.

Provides firewall network service usage analytics, including port usage, protocol activity, and service breakdowns.

Provides CASB SaaS application usage analytics, including cloud app usage and cloud service adoption metrics.

Provides discovered shadow IT applications with risk scores, including unsanctioned and unauthorized application detection.

Provides shadow IT summary statistics, including total shadow apps, app categories, and risk distribution overview.