Configuring Redirection Policies Using API

This article provides information on managing Zscaler Private Access (ZPA) redirection policy use cases using APIs. All APIs are rate limited. To learn more, see Understanding Rate Limiting.

Prerequisite API Call

To get the policySetId by policy type:

  1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/policyType/{policyType}.
  2. Provide the policyType, the value for differentiating the policy types, in the request endpoint. The supported values are:
  • ACCESS_POLICY or GLOBAL_POLICY
  • TIMEOUT_POLICY or REAUTH_POLICY
  • BYPASS_POLICY or CLIENT_FORWARDING_POLICY
  • INSPECTION_POLICY (i.e., AppProtection policy)
  • ISOLATION_POLICY
  • REDIRECTION_POLICY
  • CAPABILITIES_POLICY
  • CREDENTIAL_POLICY
  • CLIENTLESS_SESSION_PROTECTION_POLICY
  • PROTECTION_POLICY
  • PRIVILEGED_PORTAL_POLICY

To get a redirection policy set ID, provide the REDIRECTION_POLICY policy type in the request endpoint. For example: /mgmtconfig/v1/admin/customers/217246660302995456/policySet/policyType/REDIRECTION_POLICY.

  • {
  "id": "217246660303027250",
  "creationTime": "1683058318",
  "modifiedBy": "72057594038040687",
  "name": "ReDirection_Policy",
  "enabled": true,
  "description": "Re-Direction policies.",
  "policyType": "10",
  "sorted": true
}
    Close

A successful response returns code 200. To learn more, see API Response Codes and Error Messages.

To get the paginated policy rules for the specified policy type:

  1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/rules/policyType/{policyType}?page=1&pagesize=20.
  2. Provide the following in the request endpoint:
  • customerId: The ZPA tenant ID of the customer.
  • policyType: The value for differentiating the policy types. The supported values are:
    • ACCESS_POLICY or GLOBAL_POLICY
    • TIMEOUT_POLICY or REAUTH_POLICY
    • BYPASS_POLICY or CLIENT_FORWARDING_POLICY
    • INSPECTION_POLICY (i.e., AppProtection policy)
    • ISOLATION_POLICY
    • REDIRECTION_POLICY
    • CAPABILITIES_POLICY
    • CREDENTIAL_POLICY
    • CLIENTLESS_SESSION_PROTECTION_POLICY
    • PROTECTION_POLICY
    • PRIVILEGED_PORTAL_POLICY
  • Valid values for page and page size parameters.

For example: /mgmtconfig/v1/admin/customers/72057594037927936/policySet/rules/policyType/REDIRECTION_POLICY?page=1&pagesize=1.

  • {
  "totalPages": "10",
  "list": [
    {
      "id": "72057594038644505",
      "modifiedTime": "1683038805",
      "modifiedBy": "72057594038606777",
      "name": "New UX test",
      "description": "in safari",
      "ruleOrder": "1",
      "priority": "1",
      "policyType": "10",
      "operator": "AND",
      "conditions": [
        {
          "id": "31470314",
          "modifiedTime": "1683038805",
          "creationTime": "1683038805",
          "modifiedBy": "72057594038606777",
          "operator": "OR",
          "negated": false,
          "operands": [
            {
              "id": "31470315",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "COUNTRY_CODE",
              "lhs": "AE",
              "rhs": "true",
              "name": "AE"
            },
            {
              "id": "31470316",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "COUNTRY_CODE",
              "lhs": "AG",
              "rhs": "true",
              "name": "AG"
            }
          ]
        },
        {
          "id": "31470317",
          "modifiedTime": "1683038805",
          "creationTime": "1683038805",
          "modifiedBy": "72057594038606777",
          "operator": "OR",
          "negated": false,
          "operands": [
            {
              "id": "31470318",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "CLIENT_TYPE",
              "lhs": "id",
              "rhs": "zpn_client_type_machine_tunnel",
              "name": "zpn_client_type_machine_tunnel"
            },
            {
              "id": "31470319",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "CLIENT_TYPE",
              "lhs": "id",
              "rhs": "zpn_client_type_branch_connector",
              "name": "zpn_client_type_branch_connector"
            }
          ]
        },
        {
          "id": "31470320",
          "modifiedTime": "1683038805",
          "creationTime": "1683038805",
          "modifiedBy": "72057594038606777",
          "operator": "OR",
          "negated": false,
          "operands": [
            {
              "id": "31470321",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038603627",
              "rhs": "test 1",
              "name": "http___schemas_xmlsoap_org_ws_2005_05_identity_claims_givenname_Azure_User"
            },
            {
              "id": "31470322",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038603627",
              "rhs": "test 2",
              "name": "http___schemas_xmlsoap_org_ws_2005_05_identity_claims_givenname_Azure_User"
            },
            {
              "id": "31470323",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038603627",
              "rhs": "test 3",
              "name": "http___schemas_xmlsoap_org_ws_2005_05_identity_claims_givenname_Azure_User"
            },
            {
              "id": "31470324",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038042068",
              "rhs": "test 1",
              "name": "dssdd"
            },
            {
              "id": "31470325",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038042068",
              "rhs": "test 2",
              "name": "dssdd"
            },
            {
              "id": "31470326",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038042068",
              "rhs": "test 3",
              "name": "dssdd"
            },
            {
              "id": "31470327",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038620864",
              "rhs": "test 1",
              "name": "department1"
            },
            {
              "id": "31470328",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038620864",
              "rhs": "test 2",
              "name": "department1"
            },
            {
              "id": "31470329",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SAML",
              "lhs": "72057594038620864",
              "rhs": "test 3",
              "name": "department1"
            },
            {
              "id": "31470330",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SCIM",
              "lhs": "72057594037988775",
              "rhs": "bjensen3",
              "name": "userName",
              "idpId": "72057594037961373"
            },
            {
              "id": "31470331",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SCIM_GROUP",
              "lhs": "72057594037961373",
              "rhs": "20470"
            },
            {
              "id": "31470332",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "SCIM_GROUP",
              "lhs": "72057594037961373",
              "rhs": "20524"
            },
            {
              "id": "31470333",
              "creationTime": "1683038805",
              "modifiedBy": "72057594038606777",
              "objectType": "IDP",
              "lhs": "id",
              "rhs": "72057594038072942",
              "name": "Testtest"
            }
          ]
        }
      ],
      "action": "REDIRECT_PREFERRED",
      "serviceEdgeGroups": [
        {
          "id": "72057594038038943",
          "modifiedTime": "1680861999",
          "creationTime": "1622618432",
          "modifiedBy": "72057594037987389",
          "name": "testvr",
          "enabled": false,
          "description": "testvr",
          "versionProfileId": "0",
          "overrideVersionProfile": false,
          "isPublic": "TRUE",
          "location": "India",
          "cityCountry": "Wadgaon, IN",
          "countryCode": "IN",
          "useInDrMode": false,
          "graceDistanceEnabled": false
        },
        {
          "id": "72057594038054625",
          "modifiedTime": "1639642844",
          "creationTime": "1633932755",
          "modifiedBy": "72057594038046699",
          "name": "testserviceedgegrp-1_2",
          "enabled": true,
          "description": "sdsd",
          "versionProfileId": "0",
          "overrideVersionProfile": false,
          "isPublic": "FALSE",
          "location": "Hyderabad, Telangana, India",
          "cityCountry": "Hyderabad, IN",
          "countryCode": "IN",
          "graceDistanceEnabled": false
        }
      ],
      "defaultRule": false,
      "restrictedEntity": false
    }
  ]
}
    Close

A successful response returns code 200. To learn more, see API Response Codes and Error Messages.

Getting Required Details for the Redirection Policy

Before creating a redirection policy rule, you must get the following required client types needed for the policy criteria. To learn more, see Getting Details of All Client Types.

Creating a New Redirection Policy Rule

This API will be deprecated in a future release, and a new API to create a new policy rule is provided. To learn more, see Creating a New Redirection Policy Rule V2.

To create a new redirection policy rule for a given policy set and for a given customer:

  1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule.
  2. Provide the following values in the request endpoint:
  • customerId: The ZPA tenant ID of the customer.
  • policySetId: The ID of the global policy set captured in the Prerequisite API Call section.

For example: /mgmtconfig/v1/admin/customers/72057594037927936/policySet/72057594038644503/rule.

  1. Include the request headers to specify the following parameters about the request context:
  • Content-Type: application/json
  • Authorization: Bearer <access_token>
  1. Use the following JSON payload and provide the policy criteria you want for creating a redirection rule.
  • {
    "conditions": [{
        "operands": [{
            "objectType": "CLIENT_TYPE",
            "lhs": "id",
            "rhs": "zpn_client_type_zapp"
        }],
        "operator": "OR"
    }, {
        "operands": [{
            "objectType": "COUNTRY_CODE",
            "entryValues":[
                  {
                     "lhs":"<CountryCode>",
                     "rhs":true
                  }
               ]
            }
        }]
    }],
    "name": "PolicyName",
    "description": "Description",
    "action": "REDIRECT_ALWAYS",
    "customMsg": "MsgString"
}
    Close
  • {
   "policySetId":"72057594038644503",
   "conditions":[
      {
         "operands":[
            {
               "objectType":"COUNTRY_CODE",
               "entryValues":[
                  {
                     "lhs":"US",
                     "rhs":true
                  }
               ]
            }
         ],
         "operator":"OR"
      },
      {
         "operands":[
            {
               "objectType":"CLIENT_TYPE",
               "values":[
                  "zpn_client_type_machine_tunnel",
                  "zpn_client_type_edge_connector",
                  "zpn_client_type_zapp_partner",
                  "zpn_client_type_zapp",
                  "zpn_client_type_branch_connector"
               ]
      }
   ],
   "name":"Example Redirection Policy",
   "description":"Example description",
   "action":"REDIRECT_ALWAYS",
   "serviceEdgeGroups":[
      {
         "id":"72057594038665671",
         "modifiedTime":"1689071571",
         "creationTime":"1689071571",
         "modifiedBy":"72057594038642792",
         "name":"test_abc",
         "MicrotenantName":"Default",
         "enabled":true,
         "versionProfileId":"72057594038660432",
         "overrideVersionProfile":false,
         "versionProfileName":"test_aglawe07",
         "versionProfileVisibilityScope":"ALL",
         "upgradeTimeInSecs":"66600",
         "upgradeDay":"SUNDAY",
         "isPublic":"FALSE",
         "location":"Nagpur, Maharashtra, India",
         "latitude":"21.1458004",
         "longitude":"79.0881546",
         "cityCountry":"Nagpur, IN",
         "countryCode":"IN",
         "useInDrMode":false,
         "graceDistanceEnabled":true,
         "graceDistanceValue":"2500.0",
         "graceDistanceValueUnit":"MILES",
         "restrictedEntity":false,
         "level":2,
         "parent":"Nagpur, Maharashtra, India",
         "isLeaf":true
      }
   ]
}
    Close
  • {
   "policySetId":"72057594038644503",
   "conditions":[
      {
         "operands":[
            {
               "objectType":"COUNTRY_CODE",
               "entryValues":[
                  {
                     "lhs":"US",
                     "rhs":true
                  }
               ]
            }
         ],
         "operator":"OR"
      },
      {
         "operands":[
            {
               "objectType":"CLIENT_TYPE",
               "values":[
                  "zpn_client_type_machine_tunnel",
                  "zpn_client_type_edge_connector",
                  "zpn_client_type_zapp_partner",
                  "zpn_client_type_zapp",
                  "zpn_client_type_branch_connector"

               ]
            }
         ],
      }
   ],
   "name":"Example Redirection Policy",
   "description":"Example description",
   "action":"REDIRECT_ALWAYS",
   "serviceEdgeGroups":[
      {
         "id":"72057594038056014",
         "modifiedTime":"1678798195",
         "creationTime":"1634589741",
         "modifiedBy":"72057594038606777",
         "name":"test_abc",
         "MicrotenantName":"Default",
         "enabled":true,
         "description":"Private broker group",
         "versionProfileId":"72057594038644936",
         "overrideVersionProfile":false,
         "versionProfileName":"hshinde-vp",
         "versionProfileVisibilityScope":"ALL",
         "upgradeTimeInSecs":"25200",
         "upgradeDay":"MONDAY",
         "isPublic":"FALSE",
         "location":"California, USA",
         "latitude":"36.778261",
         "longitude":"-119.4179324",
         "cityCountry":"Sanger, US",
         "countryCode":"US",
         "useInDrMode":false,
         "graceDistanceEnabled":true,
         "graceDistanceValue":"2500.0",
         "graceDistanceValueUnit":"MILES",
         "restrictedEntity":false,
         "level":2,
         "parent":"California, USA",
         "isLeaf":true
      }
   ]
}
    Close

A successful response returns code 200. To learn more, see API Response Codes and Error Messages.

You choose the policy criteria you want to include in the JSON payload. Refer to Adding Field Descriptions for the supported values.

Creating a New Redirection Policy Rule V2

To create a new redirection policy rule for a given policy set and for a given customer:

  1. Send a POST request to the following endpoint: /mgmtconfig/v2/admin/customers/{customerId}/policySet/{policySetId}/rule.

  2. Provide the following values in the request endpoint:

    1. customerId: The ZPA tenant ID of the customer.
    2. policySetId: The ID of the global policy set captured in the prerequisite API call.

    For example: /mgmtconfig/v2/admin/customers/72057594037927936/policySet/72057594038644503/rule.

  3. Include the request headers to specify the following parameters about the request context:
    1. Content-Type: application/json
    2. Authorization: Bearer <access_token>
  4. Use the following JSON payload and provide the policy criteria you want for creating a redirection policy rule.

  • {
    "policySetId": "<policySetId>",
    "id": "<ruleId>",
    "conditions": [
        {
            "operands": [
                {
                    "objectType": "CLIENT_TYPE",
                    "values": [
                        "zpn_client_type_zappl",
                        "zpn_client_type_edge_connector",
                        "zpn_client_type_zapp_partner",
                        "zpn_client_type_machine_tunnel",
                        "zpn_client_type_branch_connector"
                    ]
                },
                {
                    "objectType": "COUNTRY_CODE",
                    "values": [
                        "<Country Code>"
                    ]
                }
            ]
        }
    ],
    "name":"<Example Redirection Policy Name>",
    "description":"<Example Policy Rule Description>",
    "action":"REDIRECT_ALWAYS",
    "serviceEdgeGroups":[
      {
         "id":"<ZPA Private Service Edge Group ID>",
         "name":"<Example Policy Rule Name>",
         "graceDistanceEnabled":true,
         "graceDistanceValue":"2500.0",
         "graceDistanceValueUnit":"MILES",
      }
   ]
}
    Close

  • {
   "policySetId":"72057594038644503",
   "conditions":[
      {
         "operands":[
            {
               "objectType":"COUNTRY_CODE",
               "entryValues":[
                  {
                     "lhs":"US",
                     "rhs":true
                  }
               ]
            }
         ],
         "operator":"OR"
      },
      {
         "operands":[
            {
               "objectType":"CLIENT_TYPE",
               "values":[
                  "zpn_client_type_machine_tunnel",
                  "zpn_client_type_edge_connector",
                  "zpn_client_type_zapp_partner",
                  "zpn_client_type_zapp",
                  "zpn_client_type_branch_connector"

               ]
            }
         ],
      }
   ],
   "name":"Example Redirection Policy",
   "description":"Example description",
   "action":"REDIRECT_ALWAYS",
   "serviceEdgeGroups":[
      {
         "id":"72057594038056014",
         "modifiedTime":"1678798195",
         "creationTime":"1634589741",
         "modifiedBy":"72057594038606777",
         "name":"test_abc",
         "MicrotenantName":"Default",
         "enabled":true,
         "description":"Private broker group",
         "versionProfileId":"72057594038644936",
         "overrideVersionProfile":false,
         "versionProfileName":"hshinde-vp",
         "versionProfileVisibilityScope":"ALL",
         "upgradeTimeInSecs":"25200",
         "upgradeDay":"MONDAY",
         "isPublic":"FALSE",
         "location":"California, USA",
         "latitude":"36.778261",
         "longitude":"-119.4179324",
         "cityCountry":"Sanger, US",
         "countryCode":"US",
         "useInDrMode":false,
         "graceDistanceEnabled":true,
         "graceDistanceValue":"2500.0",
         "graceDistanceValueUnit":"MILES",
         "restrictedEntity":false,
         "level":2,
         "parent":"California, USA",
         "isLeaf":true
      }
   ]
}
    Close

A successful response returns code 200. To learn more, see API Response Codes and Error Messages.

Adding Field Descriptions

The following table includes descriptions of available fields you can use for the redirection policy use cases:

FieldDescriptionRequiredValue
nameThe name of the redirection ruleYesString
descriptionThe description of the redirection ruleNoString
actionThis is for providing the rule actionYes

Supported values:

  • REDIRECT_DEFAULT
  • REDIRECT_PREFERRED
  • REDIRECT_ALWAYS
conditionsThis is for providing the set of conditions for the policyNoArray of operands
operandsThe various policy criteriaNoArray of attributes (objectType, lhs, rhs, name)
objectTypeThe policy criteriaNo

Supported values:

  • CLIENT_TYPE
  • COUNTRY_CODE
lhsThe key for the object typeNoString ID example: "id"
rhsThe value for the given object type. Its value depends upon the key.No

For IDP, the supported value is entity id.

For CLIENT_TYPE, the supported values are:

  • zpn_client_type_machine_tunnel (for Machine Tunnels)
  • zpn_client_type_edge_connector (For Cloud Connectors)
  • zpn_client_type_zapp (for Zscaler Client Connector)
  • zpn_client_type_zapp_partner (for Zscaler Client Connector Support for Multiple Tenants)
  • zpn_client_type_branch_connector (for Branch Connectors)

The CLIENT_TYPE values zpn_client_type_edge_connector and zpn_client_type_branch_connector are not supported if the action field is set to REDIRECT_ALWAYS.

For POSTURE, the supported values are:

  • true (verified)
  • false (verification failed)
operatorThe operation typeNo

Supported values:

  • AND
  • OR
graceDistanceEnabledIf enabled, allows ZPA Private Service Edge Groups within the specified distance to be prioritized over a closer ZPA Public Service Edge. To learn more, see Configuring ZPA Private Service Edges.No

Default: false

Boolean: true, false

graceDistanceValueIndicates the maximum distance in miles or kilometers to ZPA Private Service Edge groups that would override a ZPA Public Service EdgeNoInteger
graceDistanceValueUnitIndicates the grace distance unit of measure in miles or kilometers. This value is only required if graceDistanceEnabled is set to true.No

Supported values:

  • MILES
  • KMS
microtenantIdThe unique identifier of the Microtenant for the ZPA tenant. If you are within a Microtenant, you must pass the microtenantId field when making an API call to retrieve data from that Microtenant. The microtenantId can be obtained in the API Keys page, or can be obtained programmatically using the ZPA cloud service API. Access to certain operations are limited when you are within a Microtenant. If you are within the Default Microtenant, pass microtenantId as 0 when making requests to retrieve data from the Default Microtenant. If the microtenantId is not passed in the request when creating or updating a resource, then the resource is created or updated in the Default Microtenant. To learn more, see Configuring Microtenants Using API.NoInteger

For a comprehensive table of LHS and RHS values, see Configuring Access Policies Using API.

Getting Details for a Particular Redirection Rule

To get details for a particular redirection rule:

  1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}.
  2. Provide the following values in the request endpoint:
  • customerId: The ZPA tenant ID of the customer.
  • policySetId: The ID of the redirection policy set captured in the prerequisite API call.
  • ruleId: The ID of the redirection rule.

For example: /mgmtconfig/v1/admin/customers/72057594037927936/policySet/72057594038644503/rule/72057594038649412.

  • {
  "id": "72057594038649412",
  "modifiedTime": "1683038920",
  "creationTime": "1683038920",
  "modifiedBy": "72057594038040687",
  "name": "Example Redirection Policy",
  "description": "Example description",
  "ruleOrder": "9",
  "priority": "1",
  "policyType": "10",
  "operator": "AND",
  "conditions": [
    {
      "id": "31470342",
      "modifiedTime": "1683038920",
      "creationTime": "1683038920",
      "modifiedBy": "72057594038040687",
      "operator": "OR",
      "negated": false,
      "operands": [
        {
          "id": "31470343",
          "creationTime": "1683038920",
          "modifiedBy": "72057594038040687",
          "objectType": "COUNTRY_CODE",
          "lhs": "US",
          "rhs": "true",
          "name": "US"
        }
      ]
    },
    {
      "id": "31470344",
      "modifiedTime": "1683038920",
      "creationTime": "1683038920",
      "modifiedBy": "72057594038040687",
      "operator": "OR",
      "negated": false,
      "operands": [
        {
          "id": "31470345",
          "creationTime": "1683038920",
          "modifiedBy": "72057594038040687",
          "objectType": "CLIENT_TYPE",
          "lhs": "id",
          "rhs": "zpn_client_type_branch_connector"
        },
        {
          "id": "31470346",
          "creationTime": "1683038920",
          "modifiedBy": "72057594038040687",
          "objectType": "CLIENT_TYPE",
          "lhs": "id",
          "rhs": "zpn_client_type_zapp"
        }
      ]
    },
  ],
  "action": "REDIRECT_ALWAYS",
  "serviceEdgeGroups": [
    {
      "id": "72057594038056014",
      "modifiedTime": "1678798195",
      "creationTime": "1634589741",
      "modifiedBy": "72057594038606777",
      "name": "dhareeshkumar_pb_grp",
      "enabled": true,
      "description": "Private broker group",
      "versionProfileId": "0",
      "overrideVersionProfile": false,
      "isPublic": "FALSE",
      "location": "California, USA",
      "cityCountry": "Sanger, US",
      "countryCode": "US",
      "useInDrMode": false,
      "graceDistanceEnabled": true,
      "graceDistanceValue": "2500.0",
      "graceDistanceValueUnit": "MILES"
    }
  ],
  "policySetId": "72057594038644503",
  "defaultRule": false,
  "restrictedEntity": false
}
    Close

A successful response returns code 200. To learn more, see API Response Codes and Error Messages.

Updating a Redirection Policy Rule

This API will be deprecated in a future release, and a new API to create a new policy rule is provided. To learn more, see Updating a New Redirection Policy Rule V2.

To update the details of a redirection policy rule in the policy set:

  1. Get the policySetId captured in the prerequisite API call.
  2. Use the JSON payload from Creating a New Redirection Policy Rule and send a PUT request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}.
  3. Provide the following values in the request endpoint:
  • customerId: The ZPA tenant ID of the customer.
  • policySetId: The ID of the redirection policy set.
  • ruleId: The ID of the redirection policy rule.

For example: /mgmtconfig/v1/admin/customers/72057615512764416/policySet/72057615512764421/rule/72057615512764641.

  • {
    "conditions": [{
            "objectType": "CLIENT_TYPE",
            "lhs": "id",
            "rhs": "zpn_client_type_zapp"
        }],
        "operator": "OR"
    }, {
        "operands": [{
            "objectType": "COUNTRY_CODE",
            "entryValues":[
                  {
                     "lhs":"<CountryCode>",
                     "rhs":true
                  }
               ]
            }
        }]
    }],
    "name": "PolicyName",
    "description": "Description",
    "action": "REDIRECT_ALWAYS",
    "customMsg": "MsgString"
}
    Close
  • {
   "policySetId":"72057594038644503",
   "conditions":[
      {
         "operands":[
            {
               "objectType":"COUNTRY_CODE",
               "entryValues":[
                  {
                     "lhs":"US",
                     "rhs":true
                  }
               ]
            }
         ],
         "operator":"OR"
      },
      {
         "operands":[
            {
               "objectType":"CLIENT_TYPE",
               "values":[
                  "zpn_client_type_machine_tunnel",
                  "zpn_client_type_edge_connector",
                  "zpn_client_type_zapp_partner",
                  "zpn_client_type_zapp",
                  "zpn_client_type_branch_connector"
               ]
                }
         ],
      }
   ],
   "name":"Example Redirection Policy",
   "description":"Example description",
   "action":"REDIRECT_ALWAYS",
   "serviceEdgeGroups":[
      {
         "id":"72057594038665671",
         "modifiedTime":"1689071571",
         "creationTime":"1689071571",
         "modifiedBy":"72057594038642792",
         "name":"test_abc",
         "MicrotenantName":"Default",
         "enabled":true,
         "versionProfileId":"72057594038660432",
         "overrideVersionProfile":false,
         "versionProfileName":"test_aglawe07",
         "versionProfileVisibilityScope":"ALL",
         "upgradeTimeInSecs":"66600",
         "upgradeDay":"SUNDAY",
         "isPublic":"FALSE",
         "location":"Nagpur, Maharashtra, India",
         "latitude":"21.1458004",
         "longitude":"79.0881546",
         "cityCountry":"Nagpur, IN",
         "countryCode":"IN",
         "useInDrMode":false,
         "graceDistanceEnabled":true,
         "graceDistanceValue":"2500.0",
         "graceDistanceValueUnit":"MILES",
         "restrictedEntity":false,
         "level":2,
         "parent":"Nagpur, Maharashtra, India",
         "isLeaf":true
      }
   ]
}
    Close

A successful response returns code 204, meaning the redirection rule is updated. To learn more, see API Response Codes and Error Messages.

The ability to update the rule order for all rules in a policy set is also available. To learn more, see Configuring Access Policies Using API.

Updating a Redirection Policy Rule V2

To update the details of a redirection policy rule in the policy set:

  1. Get the policySetId captured in the prerequisite API call.
  2. Use the JSON payload from Creating a New Redirection Rule and send a PUT request to the following endpoint: /mgmtconfig/v2/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}.

  3. Provide the following values in the request endpoint:

    1. customerId: The ZPA tenant ID of the customer.
    2. policySetId: The ID of the redirection policy set.
    3. ruleId: The ID of the redirection policy rule.

    For example: /mgmtconfig/v2/admin/customers/72057615512764416/policySet/72057615512764421/rule/72057615512764641.

  • {
    "policySetId": "<policySetId>",
    "id": "<ruleId>",
    "conditions": [
        {
            "operands": [
                {
                    "objectType": "CLIENT_TYPE",
                    "values": [
                        "zpn_client_type_zappl",
                        "zpn_client_type_edge_connector",
                        "zpn_client_type_zapp_partner",
                        "zpn_client_type_machine_tunnel",
                        "zpn_client_type_branch_connector"
                    ]
                },
                {
                    "objectType": "COUNTRY_CODE",
                    "values": [
                        "<Country Code>"
                    ]
                }
            ]
        }
    ],
    "name":"<Example Redirection Policy Name>",
    "description":"<Example Policy Rule Description>",
    "action":"REDIRECT_ALWAYS",
    "serviceEdgeGroups":[
      {
         "id":"<ZPA Private Service Edge Group ID>",
         "name":"<Example Policy Rule Name>",
         "graceDistanceEnabled":true,
         "graceDistanceValue":"2500.0",
         "graceDistanceValueUnit":"MILES",
      }
   ]
}
    Close

A successful response returns code 204, meaning the redirection rule is updated. To learn more, see API Response Codes and Error Messages.

Updating a Rule Order

To update a rule order:

  1. Send a PUT request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}/reorder/{newOrder}.
  2. Provide the following parameters in the request endpoint:
  • customerId: The ZPA tenant ID of the customer.
  • policySetId: The ID of the policy set.
  • ruleId: The ID of the redirection rule.
  • newOrder: The new order of the rule.

For example: /mgmtconfig/v1/admin/customers/72057594037927936/policySet/72057594037938994/rule/72057615512764641/reorder/4.

A successful response returns code 204, meaning the rule order is updated. To learn more, see API Response Codes and Error Messages.

Deleting a Redirection Rule

To delete a redirection rule:

  1. Send a DELETE request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}.
  2. Provide the following values in the request endpoint:
  • customerId: The ZPA tenant ID of the customer.
  • policySetId: The ID of the redirection policy set captured in the prerequisite API call.
  • ruleId: The ID of the rule you want to delete.

For example: /mgmtconfig/v1/admin/customers/72057615512764416/policySet/72057615512764421/rule/72057615512764641.

A successful response returns code 204, meaning the redirection rule is deleted. To learn more, see API Response Codes and Error Messages.

Getting Details of All Client Types

To get details of all client types:

  1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/clientTypes.
  2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/217246660302995456/clientTypes.
  • {
    "zpn_client_type_exporter": "Web Browser",
    "zpn_client_type_exporter_noauth": "Web Browser Unauthenticated",
    "zpn_client_type_machine_tunnel": "Machine Tunnel",
    "zpn_client_type_edge_connector": "Cloud Connector",
    "zpn_client_type_zia_inspection": "ZIA Inspection",
    "zpn_client_type_zapp": "Client Connector",
    "zpn_client_type_slogger": "ZPA LSS",
    "zpn_client_type_browser_isolation": "Cloud Browser",
    "zpn_client_type_ip_anchoring": "ZIA Service Edge",
    "zpn_client_type_zapp_partner": "Client Connector Partner",
    "zpn_client_type_branch_connector": "Branch Connector",
    "zpn_client_type_vdi":"Client Connector for VDI"
    }
    Close

A successful response returns code 200. To learn more, see API Response Codes and Error Messages.