- Secure Private Access (ZPA) Help
- ZPA API
- API Developer & Reference Guide
- Understanding Rate Limiting
- API Developer & Reference Guide
- Getting Started
- Configuring the Postman REST API Client
- Understanding Rate Limiting
- API Response Codes and Error Messages
- Reference Guide
- Application Controller
- /mgmtconfig/v1/admin/customers/{customerId}/application/getAppsByType
- /mgmtconfig/v1/admin/customers/{customerId}/application
- /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}
- /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}/share
- /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}/move
- Segment Group Controller
- AppProtection Control Controller
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/controlTypes
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/custom
- /mgmtconfig/v1/admin/inspectionControls/customControlTypes
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/custom/{id}/profiles
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/custom/httpMethods
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/severityTypes
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/custom/{id}
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/predefined/versions
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/actionTypes
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/predefined/{id}
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionControls/predefined
- AppProtection Profile Controller
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionProfile/{inspectionProfileId}/dissociateAllPredefinedControls
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionProfile
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionProfile/{inspectionProfileId}/associateAllPredefinedControls
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionProfile/{inspectionProfileId}
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionProfile/{inspectionProfileId}/patch
- /mgmtconfig/v1/admin/customers/{customerId}/inspectionProfile/{inspectionProfileId}/deAssociateAllPredefinedControls
- App Connector Controller
- /mgmtconfig/v1/admin/customers/{customerId}/connector/bulkDelete
- /mgmtconfig/v1/admin/customers/{customerId}/connector/{connectorId}
- /mgmtconfig/v1/admin/customers/{customerId}/connector
- /mgmtconfig/v1/admin/customers/{customerId}/connectorSchedule/{id}
- /mgmtconfig/v1/admin/customers/{customerId}/connectorSchedule
- App Connector Group Controller
- Certificate Controller
- /mgmtconfig/v1/admin/customers/{customerId}/clientlessCertificate/{certificateId}
- /mgmtconfig/v2/admin/customers/{customerId}/clientlessCertificate/issued
- /mgmtconfig/v1/admin/customers/{customerId}/certificate
- /mgmtconfig/v2/admin/customers/{customerId}/certificate/issued
- /mgmtconfig/v1/admin/customers/{customerId}/certificate/{certificateId}
- Customer Controller
- /mgmtconfig/v1/admin/customers/{customerId}/authDomains
- Customer Version Profile Controller
- /mgmtconfig/v1/admin/customers/{customerId}/visible/versionProfiles
- Cloud Connector Group Controller
- Emergency Access Controller
- /mgmtconfig/v1/admin/customers/{customerId}/emergencyAccess/user/{userId}
- /mgmtconfig/v1/admin/customers/{customerId}/emergencyAccess/user/{userId}/deactivate
- /mgmtconfig/v1/admin/customers/{customerId}/emergencyAccess/user/{userId}/activate
- /mgmtconfig/v1/admin/customers/{customerId}/emergencyAccess/users
- /mgmtconfig/v1/admin/customers/{customerId}/emergencyAccess/user
- Enrollment Certificate Controller
- IdP Controller
- Isolation Profile Controller
- /mgmtconfig/v1/admin/customers/{customerId}/isolation/profiles
- Log Streaming Service (LSS) Configuration
- /mgmtconfig/v2/admin/customers/{customerId}/lssConfig/{lssId}
- /mgmtconfig/v2/admin/lssConfig/logType/formats
- /mgmtconfig/v2/admin/lssConfig/clientTypes
- /mgmtconfig/v2/admin/customers/{customerId}/lssConfig
- /mgmtconfig/v2/admin/customers/{customerId}/lssConfig/logType/formats
- /mgmtconfig/v2/admin/lssConfig/statusCodes
- /mgmtconfig/v2/admin/lssConfig/customers/{customerId}/clientTypes
- Machine Group Controller
- Microtenant Controller
- /mgmtconfig/v1/admin/customers/{customerId}/microtenants/{microtenantId}
- /mgmtconfig/v1/admin/customers/{customerId}/microtenants/summary
- /mgmtconfig/v1/admin/customers/{customerId}/microtenants
- /mgmtconfig/v1/admin/customers/{customerId}/microtenants/search
- /mgmtconfig/v1/admin/me
- Policy Set Controller
- /mgmtconfig/v1/admin/customers/{customerId}/policySet/policyType/{policyType}
- /mgmtconfig/v2/admin/customers/{customerId}/policySet/{policySetId}/rule
- /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule
- /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/reorder
- /mgmtconfig/v1/admin/customers/{customerId}/platform
- /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}/reorder/{newOrder}
- /mgmtconfig/v2/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}
- /mgmtconfig/v1/admin/customers/{customerId}/policySet/rules/policyType/{policyType}
- /mgmtconfig/v1/admin/customers/{customerId}/clientTypes
- /mgmtconfig/v1/admin/customers/{customerId}/policySet/{policySetId}/rule/{ruleId}
- Posture Profile Controller
- Private Service Edge Controller
- Private Service Edge Group Controller
- Privileged Approval Controller
- Privileged Console Controller
- Privileged Credential Controller
- Privileged Portal Controller
- Provisioning Key Controller
- SAML Attribute Controller
- SCIM Attribute Header Controller
- SCIM Group Controller
- Server Controller
- Server Group Controller
- Trusted Network Controller
- Zscaler Path Cloud Controller
- /mgmtconfig/v1/admin/zpathCloud/getAltClouds
- Working with APIs
- Obtaining Alternative Cloud Domain Details Using API
- Configuring Application Segments Using API
- Configuring Segment Groups Using API
- Managing App Connectors Using API
- Configuring Auto Delete for Disconnected App Connectors Using API
- Configuring App Connector Groups Using API
- Configuring Browser Access Application Segments Using API
- Configuring Certificates Using API
- Obtaining Cloud Connector Group Details Using API
- Obtaining Customer Details Using API
- Configuring Emergency Access Users Using API
- Obtaining Enrollment Certificate Details Using API
- Obtaining IdP Configuration Details Using API
- Configuring AppProtection Controls Using API
- Configuring AppProtection Profiles Using API
- Obtaining Isolation Profile Details Using API
- Managing Log Streaming Service Configurations Using API
- Configuring Access Policies Using API
- Configuring AppProtection Policies Using API
- Configuring Client Forwarding Policies Using API
- Configuring Isolation Policies Using API
- Configuring Privileged Policies Using API
- Configuring Redirection Policies Using API
- Configuring Timeout Policies Using API
- Obtaining Machine Group Details Using API
- Configuring Microtenants Using API
- Obtaining Posture Profile Details Using API
- Configuring Privileged Approvals Using API
- Configuring Privileged Credentials Using API
- Configuring Privileged Consoles Using API
- Configuring Privileged Portals Using API
- Configuring Provisioning Keys Using API
- Obtaining SAML Attribute Details Using API
- Obtaining SCIM Attribute Details Using API
- Obtaining SCIM Group Details Using API
- Configuring Servers Using API
- Configuring Server Groups Using API
- Managing ZPA Private Service Edges Using API
- Configuring ZPA Private Service Edge Groups Using API
- Obtaining Trusted Network Details Using API
- Obtaining Version Profile Details Using API
Understanding Rate Limiting
Rate limits throttle the number of API calls you can make for any basic CRUD operation.
The system will rate limit if an endpoint is called from a given IP more than:
- 20 times in a 10-second interval for a
GET
call. - 10 times in a 10-second interval for any
POST/PUT/DELETE
call.
All rate limits start as soon as the first call is executed. Calls can occur more than once per second, but no more than the limits for each operation type.
When an API request is rate limited, error code 429 is returned along with a response header. The response header includes the retry-after
field, which is a retry mechanism that indicates the time required to wait before another call can be made. The following example is a response header that includes the retry-after
field. The value 13s
indicates 13 seconds:
{
"content-type": "application/json",
"date": "Wed, 6 Mar 2024 11:38 GMT",
"retry-after": "13s"
}
To learn more, see API Response Codes and Error Messages.