List EASM findings for an organization.

Read-only. Returns one triage row per finding (id, category, type, status, risk level/score, impacted asset, first/last seen) rather than the raw SDK record. Use the returned id with zeasm_get_finding_details, zeasm_get_finding_evidence, or zeasm_get_finding_scan_output.

Get the full detail for one EASM finding.

Read-only. Adds description, country, CISA/EPSS exploitation-likelihood signals, and scan provenance on top of the triage fields.

Get the scan evidence attributed to one EASM finding.

Read-only. Returns the evidence content (the subset of scan output attributable to this finding) and its source_type. The content can be large free-form scanner text and is preserved verbatim.

Get the complete scan output for one EASM finding.

Read-only. Returns the full scan content and its source_type. The content can be large free-form scanner text and is preserved verbatim.

List EASM lookalike domains for an organization.

Read-only. Returns one triage row per detected lookalike/impersonation domain (the lookalike, the domain it impersonates, risk, registration state, deception methods). Use the returned lookalike_raw with zeasm_get_lookalike_domain for full detail.

Get full detail for one EASM lookalike domain.

Read-only. Adds description, registrar/registrant + lifecycle dates, and remediation guidance on top of the triage fields. Look the domain up by its lookalike_raw name (from zeasm_list_lookalike_domains).

List ZEASM organizations.

Read-only. Returns one row per organization configured in the EASM Admin Portal, carrying just the id + name. Use the returned id as the org_id argument for zeasm_list_findings, zeasm_list_lookalike_domains, and the other EASM tools.

Get the OTP bundle for a ZCC device (logout / exit / uninstall / disable OTPs).

Read-only (GET, no tenant mutation) but the returned values ARE sensitive short-lived credentials — treat them like passwords. Requires the device's udid (from zcc_list_devices).

List ZCC enrolled devices (read-only).

Each row is the full device record — identity, OS, agent version, registration state, assigned policy_name, ownership, hardware, VPN/tunnel state, and the enrollment / keep-alive timestamps. Use the returned udid with zcc_get_device_otp.

List ZCC forwarding profiles (by company). Read-only.

List ZCC trusted networks (by company). Read-only.

List Zscaler Cellular anomaly policies.

Read-only. Returns one row per policy (id, name, type, enabled state, run status, applied SIM location groups, violation count) over a days lookback window. Use the returned id with the anomaly-policy logs and violations tools.

List the activity log for one Zscaler Cellular anomaly policy.

Read-only. Returns the enable/disable/run history (status + message + timestamp) for the given policy_id.

List the ICCIDs that violated a Zscaler Cellular anomaly policy.

Read-only. Returns the policy rows carrying violation data over a days lookback window. Use zcell_list_iccid_violations to drill into the per-event detail for a specific ICCID.

List the anomaly-policy violation events for one ICCID.

Read-only. Returns the individual violation events (event type, zone, timestamp) attributed to iccid under policy_id, over a days lookback window.

Search Zscaler Cellular audit-log entries over a lookback window.

Read-only. Returns curated audit rows (who changed what, when, and the operation) over a days window, with optional operation/object/visibility filters. The before/after data blobs are omitted from the row.

List the Zscaler Cellular audit filter vocabulary.

Read-only. Returns the valid operation types and object types you can pass to zcell_list_audit_customers_search.

Get the logged-in Zscaler Cellular customer's profile and SIM totals.

Read-only. Returns the customer record: identity, activation state, platform, configured regions, SIM counts, current usage, and the linked ZIA/ZPA cloud and SIM-provider metadata. Scoped by ZCELL_CUSTOMER_ID.

List the Zscaler Cellular regions available/configured for the customer.

Read-only. Returns each region and whether it is configured.

List Zscaler Cellular configured regions with their operational status.

Read-only. Returns each configured region plus the broker-cluster (BC) and app-connector (AC) status blocks and the MAP A-C / B-C link statuses.

Search Zscaler Cellular network/session events over a lookback window.

Read-only. Returns curated event rows (timestamp, event, outcome, SIM/ICCID, country, carrier, RAT, IP) over a days window, with optional filter_by conditions, sort_by, and pagination.

List Zscaler Cellular SIM map points (dashboard lat/lng summary).

Read-only. Returns SIM location points with their ICCIDs, IMSIs, and tags — the data that backs the fleet map. Optionally scope to specific ICCIDs.

List the Zscaler Cellular SIM status summary (total/used/active/inactive).

Read-only. Returns the SIM-count breakdown for the tenant.

List Zscaler Cellular data usage grouped by country (top countries).

Read-only. Returns the top countries by data usage over a days lookback window.

List Zscaler Cellular data usage per day over the window.

Read-only. Returns one usage bucket per day over a days lookback window, optionally scoped to a single ICCID.

List Zscaler Cellular data usage grouped by SIM (top SIMs).

Read-only. Returns the top SIMs by data usage over a days lookback window.

Get the full Zscaler Cellular record for one SIM by ICCID.

Read-only. Returns the identifying, status, and device fields for the SIM (ICCID, IMSI/IMEI, status, network status, APN, IP, device, tags, usage).

Search the Zscaler Cellular SIM inventory with filters and pagination.

Read-only (browses the inventory). Returns a page of curated SIM records plus the aggregate usage/pagination envelope. Filter by ICCID, status, network status, country, tag, device attributes, or IMEI lock status.

List Zscaler Cellular SIM location groups.

Read-only. Returns one row per group (id, name, tracked ICCIDs). Use the returned id with zcell_get_sim_location_group for the geo-fence and linked-policy detail.

Get one Zscaler Cellular SIM location group.

Read-only. Adds the geo-fence definition, linked anomaly policies, and the inside/outside ICCID membership buckets on top of the summary fields.

List the Zscaler Cellular SIM tags defined for the customer.

Read-only. Returns one row per tag (id, name, provenance). Use the returned tag id when assigning tags to SIMs.

List active ZDX devices.

Read-only. Returns one identifying row per device (id, hostname, owning user). Filter by email, user ID, MAC/IP, location/department/geo, and the since HOURS window. Use a returned device id with zdx_get_device or the deep-trace / probe tools.

Get one active ZDX device.

Read-only. The ZDX SDK returns a single-element list; the device record is unwrapped and shaped to the identifying fields.

List ZDX departments as curated id/name rows.

Read-only. Use a returned id as the department_id scope filter on other ZDX tools. since is in HOURS (default 2h).

List ZDX locations as curated id/name rows.

Read-only. Use a returned id as the location_id scope filter on other ZDX tools. since is in HOURS (default 2h).

Get the status/result of a ZDX score analysis (full record).

Read-only. Returns whether the analysis is still running or its results if complete. Start one with zdx_start_analysis.

Get the cloud-path (hop-by-hop network path) captured during a ZDX deep trace (curated, nested JSON). Read-only.

Get cloud-path metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.

Get the events captured during a ZDX deep trace (curated, nested JSON with ISO timestamps). Read-only.

Get device health metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.

List the top processes captured during a ZDX deep trace (full records).

Read-only. Returns the process groups captured during the session — useful for spotting resource-intensive processes impacting performance.

Get web-probe metrics captured during a ZDX deep trace (curated, nested time-series JSON). Read-only.

List cloud-path probes for an app on a ZDX device (full records).

Read-only. Call this BEFORE zdx_start_deeptrace to obtain the cloudpath_probe_id the deep-trace payload needs.

List web probes for an app on a ZDX device (full records).

Read-only. Call this BEFORE zdx_start_deeptrace to obtain the web_probe_id the deep-trace payload needs.

Get ZDX performance metrics for one application (time-series).

Read-only. Returns one series per metric (Page Fetch Time, DNS Time, availability), each with its datapoints over the since HOURS window (default 2h). Pass metric_name to narrow to a single metric. Use app_id from zdx_list_applications.

Get the ZDX score for one application, with its most-impacted regions.

Read-only. Returns the headline ZDX score plus the per-region impact breakdown for the since HOURS window (default 2h). Use app_id from zdx_list_applications.

Get the ZDX score trend (over time) for one application.

Read-only. Returns the score-over-time datapoints for the since HOURS window (default 2h) so the agent can reason about whether an app's experience is improving or degrading. Use app_id from zdx_list_applications.

List users/devices that accessed a ZDX application, as curated rows.

Read-only. Returns one triage row per user (id, name, email, ZDX score). Filter by score_bucket (poor/okay/good), location/department/geo, and the since HOURS window (default 2h). Use a returned id with zdx_get_application_user.

Get one user's ZDX detail for an application (per-device breakdown).

Read-only. Returns the user's score plus the nested per-device metrics for the since HOURS window (default 2h). Use app_id from zdx_list_applications and user_id from zdx_list_application_users.

List ongoing ZDX alerts.

Read-only. Returns one triage row per ongoing alert (id, rule, severity, type, start time, impacted-device count). Filter by location/department/geo and the since HOURS window (max 336h). Use a returned alert id with zdx_get_alert or zdx_list_alert_affected_devices.

Get one ZDX alert as a curated, agent-facing detail view.

Read-only. Adds the impacted department / location / geolocation scope to the summary fields.

List devices affected by a ZDX alert.

Read-only. Returns one identifying row per affected device. Filter by location/department/geo, location groups, and the since HOURS window.

List active ZDX applications.

Read-only. Returns one row per application (id, name, ZDX score, impact signals). Filter by location/department/geo and the since HOURS window. Use a returned id with zdx_get_application, zdx_get_application_metric, or zdx_list_application_users.

List deep-trace sessions for a ZDX device (full records).

Read-only. Returns one row per trace (id, status, session name, app, ISO timestamps). Use a returned trace_id with the deep-trace metric/event tools or zdx_get_device_deep_trace.

Get one ZDX deep-trace session.

Read-only. The SDK returns a single-element list; the trace record is unwrapped, timestamps ISO-normalized, and shaped to the identity fields.

List historical (ended) ZDX alerts.

Read-only. Like zdx_list_alerts but for alert rules that have an Ended On date. since is in HOURS (default 2h, max 14 days = 336h).

List the ZDX software inventory.

Read-only. Returns one row per software title (key, name, vendor, version, install/user counts). Filter by location/department/geo/user/device. Use a returned software_key with zdx_get_software_details to see who has it.

Expand one ZDX software key into its per-user/device install rows.

Read-only. Returns the users and devices that have the given software_key installed. Obtain the key from zdx_list_software.

Get the current ZIA configuration activation status.

Get the ZIA tenant-wide Advanced Settings object.

Get the ZIA malware policy (file-handling toggles).

Get the ZIA malware inspection (traffic-direction toggles).

Get the ZIA malware protocol toggles (HTTP/FTP).

Get the ZIA 16-field malware threat-class settings block.

Get the ZIA tenant-wide ATP policy block.

Get the ZIA ATP security-exception bypass URL allowlist.

List the ZIA ATP malicious-URL denylist.

List the ZIA cookie-auth exempt URL list.

List the available CAC actions for a category (and optional cloud apps).

List ZIA Cloud App Control rules for a category.

Get a single ZIA Cloud App Control rule by category + ID.

List the ZIA policy-engine cloud-application catalog (Cloud App Control).

List the ZIA policy-engine cloud-application catalog (SSL Inspection).

List ZIA Cloud Firewall DNS rules.

Get a single ZIA Cloud Firewall DNS rule by ID with member references.

List ZIA Cloud Firewall IPS rules.

Get a single ZIA Cloud Firewall IPS rule by ID with member references.

List ZIA Cloud Firewall rules.

Get a single ZIA Cloud Firewall rule by ID with member references.

List ZIA device groups.

List ZIA devices.

List ZIA devices via the lighter endpoint (id/name only).

List ZIA File Type Control rules.

List ZIA file-type categories usable in File Type Control rules.

Get a single ZIA File Type Control rule by ID with member references.

Resolve ZIA geo data by coordinates, by IP, or by city prefix (read-only).

Get the ZIA Sandbox API submission quota.

Get the ZIA Sandbox behavioral-analysis configuration.

Get the ZIA Sandbox custom file-hash blocklist usage/quota.

Get the ZIA Sandbox detonation report for a file MD5 hash.

List available ZIA GRE internal-IP ranges.

List ZIA GRE tunnels.

Get a single ZIA GRE tunnel by ID.

List ZIA IP destination groups.

Get a single ZIA IP destination group by ID with full members.

List ZIA IP source groups.

Get a single ZIA IP source group by ID with its full member list.

List ZIA custom IPS signature rules.

Get a single ZIA custom IPS signature rule by ID with its body.

Read ZIA DLP dictionaries: list all/lite, or fetch one by ID (read-only).