Configuring Application Segments Using API

This article provides information for managing Zscaler Private Access (ZPA) application segments using APIs. All APIs are rate limited. To learn more, see ZPA API Rate Limits.

Prerequisite API Calls

Before you create an application segment, enable or disable AppProtection on an existing application segment, or enable AppProtection on a new application segment, you must get the following required details:

• Details of all application segments. To learn more, see Getting Details for All Application Segments.
• Segment group IDs. To learn more, see Configuring Segment Groups Using API.
• Server Group IDs. To learn more, see Configuring Server Groups Using API.
• Certificate ID. To learn more, see Configuring Certificates Using API.

Creating an Application Segment

To create an application segment:

1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/72057615512764416/application
3. Include the request headers to provide information about the request context:
   • Content-Type: application/json
   • Authorization: Bearer <access_token>
4. Use the entire JSON payload to create an application segment and provide the following:
   • The name of the application segment
   • The domains of the application. To learn more, see Adding Field Descriptions.
   • The TCP and UDP ports. You can provide multiple port ranges using the format in the entire JSON payload. To learn more, see Adding Field Descriptions.
   • Other details like the segment group and server group IDs

A successful response returns code 201. To learn more, see ZPA API Codes.

NOTE

You choose the application segment criteria you want to include in the JSON payload. You can also use the minimum criteria JSON payload to create an application segment.

An error is returned if Inspect Traffic with ZIA is not enabled on your tenant and InspectTrafficWithZia is passed as enabled when making a POST or PUT request. The following is an example error:

{
   "params":[
      "inspectTrafficWithZia",
      "testApplication,
      "feature.application.inspect_traffic_with_zia",
      "72057594037927936"
   ],
   "id":"config.change.not.allowed.sku.not.enabled",
   "reason":"Cannot update config inspectTrafficWithZia of testApplication as this is managed by SKU feature.application.inspect_traffic_with_zia which is not enabled for customer 72057594037927936"
}

JSON Payload

{
  "segmentGroupId":"string",
  "segmentGroupName":"string",
  "autoAppProtectEnabled":true,
  "bypassOnReauth":"false",
  "inspectTrafficWithZia":false,
  "bypassType":"ALWAYS",
  "clientlessApps":[
     {
        "allowOptions":true,
        "appId":0,
        "applicationPort":0,
        "applicationProtocol":"HTTP",
        "certificateId":0,
        "certificateName":"string",
        "cname":"string",
        "creationTime":0,
        "description":"string",
        "domain":"string",
        "enabled":true,
        "hidden":true,
        "id":0,
        "modifiedBy":0,
        "modifiedTime":0,
        "name":"string",
        "path":"string",
        "trustUntrustedCert":true
     }
  ],
  "isCnameEnabled":"true",
  "configSpace":"DEFAULT",
  "creationTime":0,
  "defaultIdleTimeout":0,
  "defaultMaxAge":0,
  "description":"string",
  "domainNames":[
     "string"
  ],
  "doubleEncrypt":true,
  "enabled":true,
  "healthCheckType":"DEFAULT",
  "healthReporting":"NONE",
  "id":"string",
  "ipAnchored":true,
  "matchStyle":"EXCLUSIVE",
  "modifiedBy":"string",
  "modifiedTime":0,
  "name":"string",
  "passiveHealthEnabled":true,
  "selectConnectorCloseToApp":true,
  "serverGroups":[
     {
        "configSpace":"DEFAULT",
        "creationTime":0,
        "description":"string",
        "enabled":true,
        "id":0,
        "learningEnabled":true,
        "modifiedBy":0,
        "modifiedTime":0,
        "name":"string"
     }
  ],
  "tcpPortRange":[
     {
        "from":"fromPort1",
        "to":"toPort1"
     },
     {
        "from":"fromPort2",
        "to":"toPort2"
     }
  ],
  "udpPortRange":[
     {
        "from":"fromPort1",
        "to":"toPort1"
     },
     {
        "from":"fromPort2",
        "to":"toPort2"
     }
  ]
}

Minimum Criteria JSON Payload

{
  "name":"string",
  "description":"string",
  "enabled":false,
  "healthReporting":"ON_ACCESS",
  "ipAnchored":false,
  "doubleEncrypt":false,
  "bypassType":"NEVER",
  "isCnameEnabled":"true",
  "tcpPortRange":[
     {
        "from":"fromPort1",
        "to":"toPort1"
     }
  ],
  "domainNames":[
     "domainName or IpAddress"
  ],
  "segmentGroupId":"<segmentGroupId>",
  "selectConnectorCloseToApp":true,
  "serverGroups":[
     {
        "id":"<serverGroupId>"
     }
  ]
}

Example Response

{
  "id":"72057594038648257",
  "name":"Test Example",
  "domainNames":[
     "exampletest.com"
  ],
  "enabled":true,
  "passiveHealthEnabled":true,
  "tcpPortRanges":[
     "335",
     "335"
  ],
  "udpPortRanges":[
     "445",
     "445"
  ],
  "doubleEncrypt":false,
  "segmentGroup":{
     "id":"72057594038071913",
     "name":"123",
     "enabled":true,
     "configSpace":"DEFAULT",
     "tcpKeepAliveEnabled":"0"
  },
  "serverGroupDTOs":[
     {
        "modifiedTime":"1646056922",
        "creationTime":"1612438082",
        "modifiedBy":"72057594038052745",
        "id":"72057594037988579",
        "microtenantName":"Default",
        "enabled":true,
        "name":"1234",
        "learningEnabled":true,
        "description":"/><img src=x onerror=alert(document.cookie)>",
        "ConnectorGroups":[
           {
              "id":"72057594037962495",
              "name":"yo111",
              "useInDrMode":false,
              "siemConnectorGroup":false
           },
           {
              "id":"72057594038010497",
              "name":"Abcdefg12",
              "useInDrMode":false,
              "siemConnectorGroup":false
           },
           {
              "id":"72057594038011104",
              "name":"App_Connector_Test",
              "useInDrMode":false,
              "siemConnectorGroup":false
           },
           {
              "id":"72057594038011105",
              "name":"App_Connector_Test_1",
              "useInDrMode":false,
              "siemConnectorGroup":false
           },
           {
              "id":"72057594038011107",
              "name":"App_Connector_Test_10_ITER1_PRA_ENABLED",
              "useInDrMode":false,
              "siemConnectorGroup":false
           }
        ],
        "ipAnchored":false,
        "configSpace":"DEFAULT",
        "restrictedEntity":false
     }
  ],
  "configSpace":"DEFAULT",
  "bypassType":"NEVER",
  "healthCheckType":"DEFAULT",
  "icmpAccessType":"NONE",
  "ipAnchored":false,
  "autoAppProtectEnabled":true,
  "bypassOnReauth":"false",
  "inspectTrafficWithZia":false,
  "cnameConfig":"NOFLATTEN",
  "isCnameEnabled":true,
  "commonAppsDto":{
     
  },
  "healthReporting":"ON_ACCESS",
  "tcpKeepAlive":"0",
  "selectConnectorCloseToApp":false,
  "useInDrMode":false,
  "matchStyle":"EXCLUSIVE"
}

Active Directory (AD) Protection Support

To create an application segment and enable Active Directory Inspection:

1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/72057615512764416/application
3. Include the request headers to provide information about the request context:
   • Content-Type: application/json
   • Authorization: Bearer <access_token>
4. Use the entire JSON payload to create an application segment and provide the following:
   • The name of the application segment
   • The domains of the application
   • The TCP and UDP ports. You can provide multiple port ranges using the format in the entire JSON payload. To learn more, see the Adding Field Descriptions section.
   • Other details like the segment group and server group IDs
   • Set adpEnabled as true.
     NOTE

     If adpEnabled is set to true, then autoAppProtectEnabled cannot be set to true for inspection by AppProtection. To learn more, see the Adding Field Descriptions section.

   • TCP and UDP protocols.

A successful response returns code 201. To learn more, see ZPA API Codes.

NOTE

You choose the application segment criteria you want to include in the JSON payload.

JSON Payload

{
  "matchStyle":"EXCLUSIVE",
  "enabled":true,
  "healthReporting":"ON_ACCESS",
  "ipAnchored":false,
  "selectConnectorCloseToApp":false,
  "icmpAccessType":"NONE",
  "isCnameEnabled":true,
  "tcpKeepAlive":"0",
  "name":"Example Application Segment",
  "useInDrMode":false,
  "description":"",
  "adpEnabled":true,
  "domain":"exampleApp.com",
  "trustUntrustedCert":true,
  "allowOptions":false,
  "doubleEncrypt":false,
  "commonAppsDto":{
     "appsConfig":[
        {
           "domainJson":{
              "domain":""
           },
           "showADInspectionToggle":true,
           "viewId":"3814358737_2917168947",
           "isEmptyModel":false,
           "domain":"exampleapp.com",
           "name":"exampleapp.com",
           "protocols":[
              "LDAP",
              "SMB",
              "KERBEROS"
           ],
           "applicationProtocol":"NONE",
           "certificateId":null,
           "applicationPort":0,
           "trustUntrustedCert":false,
           "allowOptions":false,
           "localDomain":"",
           "adpEnabled":true,
           "appTypes":[
              "INSPECT"
           ],
           "enabled":true
        }
     ]
  },
  "bypassType":"NEVER",
  "tcpPortRanges":[
     "443",
     "443"
  ],
  "tcpProtocols":[
     "LDAP"
  ],
  "udpPortRanges":[
     "334",
     "334"
  ],
  "udpProtocols":[
     "KERBEROS"
  ],
  "domainNames":[
     "exampleApp.com"
  ],
  "hideDependencies":true,
  "segmentGroup":{
     "enabled":true,
     "tcpKeepAliveEnabled":0,
     "skipDetailedAppInfo":false,
     "objectType":"segmentGroup",
     "name":"Example Segment Group",
     "description":"",
     "applications":[
        
     ]
  },
  "serverGroupDTOs":[
     {
        "enabled":true,
        "learningEnabled":true,
        "objectType":"ServerGroup",
        "name":"Example Server Group",
        "description":"",
        "servers":[
           
        ],
        "ConnectorGroups":[
           {
              "id":"72057594038010497",
              "name":"Abcdefg12"
           }
        ]
     }
  ],
  "serverGroups":[
     {
        "id":{
           "enabled":true,
           "learningEnabled":true,
           "objectType":"ServerGroup",
           "name":"Example Server Group",
           "description":"",
           "servers":[
              
           ],
           "ConnectorGroups":[
              {
                 "id":"72057594038010497",
                 "name":"Abcdefg12"
              }
           ]
        }
     }
  ]
}

Example Response

{
  "id":"72057594038668832",
  "name":"Example Application Segment",
  "domainNames":[
     "exampleapp.com"
  ],
  "enabled":true,
  "passiveHealthEnabled":true,
  "tcpPortRanges":[
     "443",
     "443"
  ],
  "udpPortRanges":[
     "334",
     "334"
  ],
  "doubleEncrypt":false,
  "segmentGroup":{
     "id":"72057594038668830",
     "modifiedTime":"1691079323",
     "creationTime":"1691079323",
     "modifiedBy":"72057594038040687",
     "name":"Example Segment Group",
     "enabled":true,
     "configSpace":"DEFAULT",
     "tcpKeepAliveEnabled":"0"
  },
  "serverGroupDTOs":[
     {
        "id":"72057594038668831",
        "enabled":true,
        "name":"Example Server Group",
        "learningEnabled":true,
        "ConnectorGroups":[
           {
              "id":"72057594038010497",
              "name":"Abcdefg12",
              "useInDrMode":false,
              "wafDisabled":false,
              "siemConnectorGroup":false
           }
        ],
        "ipAnchored":false,
        "configSpace":"DEFAULT"
     }
  ],
  "configSpace":"DEFAULT",
  "bypassType":"NEVER",
  "healthCheckType":"DEFAULT",
  "icmpAccessType":"NONE",
  "ipAnchored":false,
  "bypassOnReauth":false,
  "inspectTrafficWithZia":false,
  "cnameConfig":"NOFLATTEN",
  "isCnameEnabled":true,
  "commonAppsDto":{
     "appsConfig":[
        {
           "name":"exampleapp.com",
           "enabled":true,
           "applicationPort":"0",
           "applicationProtocol":"NONE",
           "domain":"exampleapp.com",
           "hidden":false,
           "portal":false,
           "appId":"72057594038668832",
           "trustUntrustedCert":false,
           "allowOptions":false,
           "appTypes":[
              "INSPECT"
           ],
           "protocols":[
              "LDAP",
              "SMB",
              "KERBEROS"
           ],
           "adpEnabled":true
        }
     ]
  },
  "healthReporting":"ON_ACCESS",
  "tcpKeepAlive":"0",
  "selectConnectorCloseToApp":false,
  "useInDrMode":false,
  "matchStyle":"EXCLUSIVE",
  "tcpProtocols":[
     "LDAP"
  ],
  "udpProtocols":[
     "KERBEROS"
  ],
  "adpEnabled":true
}

AppProtection Support

To create a new application segment and enable AppProtection on an application:

1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/72057615512764416/application
3. Include the request headers to provide information about the request context:
   • Content-Type: application/json
   • Authorization: Bearer <access_token>
4. Use the following JSON payload and provide the following information:
   • The name of the application segment
   • The domains of the application
   • The TCP and UDP ports
   • Other details like segment group and server group IDs
5. Ensure "appTypes": ["INSPECT"] and the other fields in "commonAppsDto" are included in the JSON payload.

A successful response returns code 201. To learn more, see ZPA API Codes.

NOTE

When creating an application segment with AppProtection enabled, the field matchStyle must be set to EXCLUSIVE. To learn more, see Adding Field Descriptions.

JSON Payload

{
  "name":"string",
  "description":"string",
  "matchStyle": "EXCLUSIVE",
  "enabled":true,
  "healthReporting":"ON_ACCESS",
  "ipAnchored":false,
  "doubleEncrypt":false,
  "bypassType":"NEVER",
  "isCnameEnabled":true,
  "tcpPortRanges":[
     "from",
     "to"
  ],
  "udpPortRanges":[
     "from",
     "to"
  ],
  "domainNames":[
     "domainName"
  ],
  "serverGroups":[
     {
        "id":"<serverGroupId>"
     }
  ],
  "segmentGroupId":"<segmentGroupId>",
  "commonAppsDto":{
     "appsConfig":[
        {
           "name":"string",
           "domain":"<domainName>",
           "applicationProtocol":"HTTP",
           "applicationPort":"80",
           "appTypes":[
              "INSPECT"
           ],
           "enabled":true
        }
     ]
  }
}

Example Response

{
  "id":"72057594038079016",
  "domainNames":[
     "inspect.com"
  ],
  "name":"WAAP_Public_API_1",
  "description":"WAAP Public API One",
  "serverGroups":[
     {
        "id":"72057594038048851",
        "enabled":false,
        "configSpace":"DEFAULT",
        "dynamicDiscovery":false
     }
  ],
  "enabled":true,
  "passiveHealthEnabled":true,
  "tcpPortRanges":[
     "80",
     "88"
  ],
  "udpPortRanges":[
     "90",
     "98"
  ],
  "doubleEncrypt":false,
  "configSpace":"DEFAULT",
  "bypassType":"NEVER",
  "healthCheckType":"DEFAULT",
  "icmpAccessType":"NONE",
  "isCnameEnabled":true,
  "commonAppsDto":{
     "appsConfig":[
        {
           "name":"common_app",
           "enabled":true,
           "applicationPort":"80",
           "applicationProtocol":"HTTP",
           "domain":"inspect.com",
           "hidden":false,
           "portal":false,
           "appId":"72057594038079016",
           "trustUntrustedCert":false,
           "allowOptions":false,
           "appTypes":[
              "INSPECT"
           ]
        }
     ]
  },
  "ipAnchored":false,
  "healthReporting":"ON_ACCESS",
  "segmentGroupId":"72057594037988995",
  "matchStyle":"EXCLUSIVE"
}

Microtenant Support

To move an application segment from one Microtenant to the Default Microtenant and vice versa:

1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}/move.
2. Provide the following in the request endpoint:
   • customerId: The ZPA tenant ID of the customer.
   • applicationId: The ID of the application.
   • For example: /mgmtconfig/v1/admin/customers/72057594037927936/application/72057594038642786/move
3. Include the request headers to provide information about the request context:
   • Content-Type: application/json
   • Authorization: Bearer <access_token>
4. Use the following JSON payload and provide the following information:
   • targetSegmentGroupId: The unique identifier of the target segment group that the application segment is being moved to.
   • targetMicroTenantId: The unique identifier of the Microtenant that the application segment is being moved to. To learn more, see Configuring Microtenants Using API.
   • targetServerGroupId: The unique identifier of the target server group that the application segment is being moved to. To learn more, see Configuring Server Groups Using API.

NOTE

Browser Access on an application segment does not persist if the application segment is moved from the default Microtenant to another Microtenant. You must select the web server certificate after the application segment is moved.

A successful response returns code 204. To learn more, see ZPA API Codes.

JSON Payload

{
 "targetSegmentGroupId": <targetSegmentGroupId>,
 "targetMicrotenantId": <targetMicroTenantId>,
 "targetServerGroupId": <targetServerGroupId>
}

Example JSON payload

{
  "targetMicrotenantId":"73201978410270733",
  "targetServerGroupId":"73201978410273451",
  "targetSegmentGroupId":"73201978410273450"
}

Privileged Remote Access Support

To create a new application segment with Privileged Remote Access (PRA) enabled on an application:

1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/72057594037927936/application
3. Include the request headers to provide information about the request context:
   • Content-Type: application/json
   • Authorization: Bearer <access_token>
4. Use the following JSON payload and provide the following information:
   • Name of the application segment
   • Domains of the application
   • TCP and UDP ports
   • Segment Group ID
   • Server Group ID
5. Ensure "appTypes": ["SECURE_REMOTE_ACCESS"] and the other fields in "commonAppsDto" are included in the JSON payload.

A successful response returns code 201. To learn more, see ZPA API Codes.

JSON Payload

{
   "name":"<NAME>",
   "commonAppsDto":{
      "appsConfig":[
         {
            "name":"<NAME>",
            "domain":"<DOMAIN_NAME>",
            "appTypes":[
               "SECURE_REMOTE_ACCESS"
            ],
            "applicationPort":"3389",
            "applicationProtocol":"RDP",
            "connectionSecurity":"ANY",
            "enabled":true
         }
      ]
   },
   "segmentGroup":{
      "enabled":true,
      "tcpKeepAliveEnabled":0,
      "skipDetailedAppInfo":false,
      "name":"<Server Group Name>",
      "applications":[
]
   },   
   "tcpPortRanges":[
      "<port_from>",
      "<port_to>"
   ],
   "udpPortRanges":[
      "<port_from>",
      "<port_to>"
   ],
   "domainNames":[
      "<DOMAIN_NAME>"
   ]
}

Example JSON Payload

{
   "name":"test-pra-app3",
   "commonAppsDto":{
      "appsConfig":[
         {
            "name":"testdomain3",
            "domain":"testdomain3",
            "appTypes":[
               "SECURE_REMOTE_ACCESS"
            ],
            "applicationPort":"3389",
            "applicationProtocol":"RDP",
            "connectionSecurity":"ANY",
            "enabled":true
         }
      ]
   },
   "applicationGroup":{
      "enabled":true,
      "tcpKeepAliveEnabled":0,
      "skipDetailedAppInfo":false,
      "name":"Internal Application Group2",
      "applications":[
         
      ]
   },
   "tcpPortRanges":[
      "3389",
      "3389"
   ],
   "udpPortRanges":[
      "3389",
      "3389"
   ],
   "domainNames":[
      "testdomain3"
   ]
}

Example Response

{
   "name":"Sample app segment",
   "description":"sample app segment",
   "enabled":true,
   "healthReporting":"ON_ACCESS",
   "ipAnchored":false,
   "doubleEncrypt":false,
   "bypassType":"NEVER",
   "isCnameEnabled":true,
   "tcpPortRanges":[
      "443",
      "443"
   ],
   "domainNames":[
      "domain.com"
   ],
   "udpPortRanges":[
      
   ],
   "segmentGroupId":"72057594038043583",
   "serverGroups":[
      {
         "id":"72057594037988996"
      }
   ],
   "commonAppsDto":{
      "appsConfig":[
         {
            "name":"domain.com",
            "domain":"domain.com",
            "applicationProtocol":"HTTPS",
            "certificateId":"72057594038037594",
            "applicationPort":"443",
            "appTypes":[
               "SECURE_REMOTE_ACCESS"
            ],
            "enabled":true
         }
      ]
   }
}

Adding Field Descriptions

The following table includes descriptions of available fields you can use for the application segment use cases:

Field	Description	Required	Value
name	Name of the application	Yes	String
description	Description of the application	No	String
enabled	Whether this application is enabled or not	No	Default: false Supported values: true, false
domainNames	List of domains and IP addresses. When creating or updating an application segment using the ZPA cloud service API, ZPA supports domains that contain asterisks (*) and question marks (?) within the prefix of top-level domains (i.e., TLD+1). To support the application pattern match, matchStyle must be set to INCLUSIVE (i.e., Multimatch must be enabled). To learn more, see Using Pattern Matching for Application Segments and Configuring Defined Application Segments.	Yes	List of string values
configSpace	Whether the configuration is created as part of the SIEM or the application segment	No	Default: DEFAULT Supported values: DEFAULT SIEM
healthReporting	Whether health reporting for the app is Continuous or On Access. If matchStyle is set to INCLUSIVE, then healthReporting must be set to either NONE or ON ACCESS. To learn more, see Understanding Health Reporting.	No	Supported values: NONE ON_ACCESS CONTINUOUS
ipAnchored	Whether Source IP Anchoring for use with ZIA is enabled or disabled for the app. If ipAnchored is set to true, then matchStyle must be set to EXCLUSIVE.	No	Default: false Supported: true, false
doubleEncrypt	Whether Double Encryption is enabled or disabled for the app. If doubleEncrypt is set to true, then matchStyle must be set to EXCLUSIVE.	No	Default: false Boolean: true, false
isCnameEnabled	Indicates if Zscaler Client Connector]] receives CNAME DNS records from the connectors	No	Default: true Boolean: true, false
icmpAccessType	Indicates the ICMP access type	No	Default: NONE Supported values: NONE PING_TRACEROUTING PING
bypassType	Indicates whether users can bypass ZPA to access applications	No	Default: NEVER Supported values: ALWAYS NEVER ON_NET The value NEVER indicates the use of the client forwarding policy.
tcpPortRange	TCP port ranges used to access the app	No	List of valid TCP ports. The application segment API supports multiple TCP and UDP port ranges. The port ranges are in the format: "tcpPortRange":[ { "from":"fromPort1", "to":"toPort1" } ] For providing multiple ports, use the following format: "tcpPortRange":[ { "from":"fromPort1", "to":"toPort1" } , { "from":"fromPort2", "to":"toPort2" } ]
updPortRange	UDP port ranges used to access the app	No	List of valid UDP ports. The port ranges are in the format: "udpPortRange":[ { "from":"fromPort1", "to":"toPort1" } ] For providing multiple ports, use the following format: "udpPortRange":[ { "from":"fromPort1", "to":"toPort1" } , { "from":"fromPort2", "to":"toPort2" } ]
tcpPortRanges	TCP port ranges used to access the app. Note that this field will be deprecated in a future release.		List of valid TCP ports. The port ranges are in the format: "tcpPortRanges":[ "from", "to" ] For providing multiple ports, use the following format: "tcpPortRanges":[ "fromPort1", "toPort1", "fromPort2", "toPort2" ]
udpPortRanges	UDP port ranges used to access the app. Note that this field will be deprecated in a future release.		List of valid UDP ports. The port ranges are in the format: "udpPortRanges":[ "from", "to" ] For providing multiple ports, use the following format: "udpPortRanges":[ "fromPort1", "toPort1", "fromPort2", "toPort2" ]
segmentGroupId	ID of the segment group	Yes	A valid segment group ID
segmentGroupName	Name of the segment group. Not required for PUT and POST requests.	No	String
serverGroups:id	ID of the server group	Yes	A valid server group ID
serverGroups:name	Name of the server group. Not required for PUT and POST requests.	No	String
selectConnectorCloseToApp	Whether the App Connector is closest to the application (True) or closest to the user (False).	No	Default: false Boolean: true, false
clientlessApps	List of clientless or Browser Access applications. If a list of Browser Access applications are provided, then the field matchStyle must be set to EXCLUSIVE.	No
commonAppsDto	List of applications (e.g., AppProtection, Privileged Remote Access, or Browser Access). If AppProtection or Browser Access applications are provided, then the field matchStyle must be set to EXCLUSIVE.	Yes
commonAppsDto.appsconfig	List of applications to be configured	Yes
commonAppsDto.appsConfig.name	Name of the AppProtection or Privileged Remote Access application	Yes	String
commonAppsDto.appsConfig.domain	Domain name of the AppProtection or Privileged Remote Access application	Yes	String
commonAppsDto.appsConfig.applicationProtocol	Protocol for the Privileged Console or AppProtection application	Yes	Supported values: HTTP HTTPS RDP SSH VNC
commonAppsDto.appsConfig.certificateId	ID of the signing certificate. This field is required if the applicationProtocol is set to HTTPS. The certificateId is not supported if the applicationProtocol is set to HTTP.	Yes	A valid certificate ID
commonAppsDto.appsConfig.applicationPort	Port for the AppProtection or Privileged Remote Access application	Yes	String
commonAppsDto.appsConfig.connectionSecurity	The connection security mode for the application	Yes	String For RDP, the supported values are: ANY NLA TLS RDP
commonAppsDto.appsConfig.appTypes	Indicates the type of application	Yes	String Supported values: INSPECT: AppProtection SECURE_REMOTE_ACCESS: Privileged Remote Access
commonAppsDto.appsConfig.enabled	Whether this application is enabled or not	Yes	String
commonAppsDto.deletedInspectApps	Indicates the AppProtection application to be disabled	Yes	A valid application ID
microtenantId	The unique identifier of the Microtenant for the ZPA tenant. If you are within a Microtenant, you must pass the microtenantId field when making an API call to retrieve data from that Microtenant. The microtenantId can be obtained in the API Keys page, or can be obtained programmatically using the ZPA cloud service API. Access to certain operations are limited when you are within a Microtenant. If you are within the Default Microtenant, pass microtenantId as 0 when making requests to retrieve data from the Default Microtenant. Pass microtenantId as null to retrieve data from all Microtenants associated with the tenant. If the microtenantId is not passed in the request when creating or updating a resource, then the resource is created or updated in the Default Microtenant. To learn more, see Configuring Microtenants Using API.	No	Integer
targetSegmentGroupId	The unique identifier of the target segment group that the application segment is being moved to. This field is required if you want to move an application segment.	No	Integer
targetMicrotenantId	The unique identifier of the Microtenant that the application segment is being moved to. This field is required if you want to move an application segment.	No	Integer
targetServerGroupId	The unique identifier of the target server group that the application segment is being moved to. This field is required if you want to move an application segment.	No	Integer
shareToMicrotenants	The unique identifier of the Microtenant that the application segment is being shared to. This field is required if you want to share an application segment.	No	Integer
adpEnabled	Indicates if Active Directory Inspection is enabled or not for the application. This allows the application segment's traffic to be inspected by Active Directory (AD) Protection. By default, this field is set to false. If adpEnabled is set to true, then the field matchStyle must be set to EXCLUSIVE. If adpEnabled is set to true, then autoAppProtectEnabled cannot be set to true. To learn more, see Configuring Defined Application Segments.	No	Boolean Supported values: true, false
protocols	Indicates the AD Protection protocols to be inspected on the application. This field is only required if adpEnabled is set to true.	No	String Supported values: LDAP SMB KERBEROS
tcpProtocols	Indicates the AD Protection protocols to be inspected on the specified TCP port ranges. This field is only required if adpEnabled is set to true.	No	String Supported values: NONE LDAP SMB KERBEROS
udpProtocols	Indicates the AD Protection protocols to be inspected on the specified UDP port ranges. This field is only required if adpEnabled is set to true.	No	String Supported values: NONE LDAP SMB KERBEROS
bypassOnReauth	Indicates if Bypass During Reauthentication is enabled for the application. To learn more, see Configuring Defined Application Segments.	No	Default: false Boolean: true, false
inspectTrafficWithZia	Indicates if Inspect Traffic with ZIA is enabled for the application. When enabled, this leverages a single posture for securing internet/SaaS and private applications, and applies Data Loss Prevention policies to the application segment you are creating. To learn more, see Configuring Defined Application Segments.	No	Default: false Boolean: true, false
matchStyle	Indicates if Multimatch is enabled for the application segment. If enabled (INCLUSIVE), the request allows traffic to match multiple applications. If disabled (EXCLUSIVE), the request allows traffic to match a single application. A domain can only be INCLUSIVE or EXCLUSIVE, and any application segment can only contain inclusive or exclusive domains. To learn more, see Configuring Defined Application Segments.	No	Default: EXCLUSIVE Supported values: INCLUSIVE: All matched applications marked as INCLUSIVE, including their domains, protocols, and ports, are selected for application access. This includes the application segments and segment groups marked as INCLUSIVE that are selected for the policy evaluation. EXCLUSIVE: The first matched application marked as EXCLUSIVE is selected for application access.
autoAppProtectEnabled	If autoAppProtectEnabled is set to true, this field indicates if the application segment’s traffic is inspected by AppProtection. If set to true, a valid AppProtection enrollment certificate must be generated to inspect application segment traffic by AppProtection. If adpEnabled is set to true for Active Directory Inspection, then autoAppProtectEnabled cannot be true. To learn more, see Configuring Defined Application Segments.	No	Boolean: true, false
weightedLoadBalancing	Indicates if the application load balancing configuration for application segments is enabled (true) or disabled (false). This field is not supported when sending a POST request to the /mgmtconfig/v1/admin/customers/{customerId}/application endpoint to create an application segment, or when sending a PUT request to the /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId} endpoint to update an application segment.	No	Boolean: true, false
extLabel	The authentication domain name prefix used for the managed application URL		String and integer The supported string can include integers, lowercase characters, and hyphens (-). This field supports integers between 3 and 31 (e.g., server-2).
extDomain	The external domain name prefix of the Browser Access application that is used for Zscaler-managed certificates when creating a managed application. This field is returned when making GET requests to retrieve application segment details. If you are using Zscaler-managed certificates and pass the external domain name prefix, the certificateId field becomes null.	No	String and integer Periods (.) are not supported since the FQDN includes a period as part of the suffix or top-level domain.

Getting Details for a Particular Application Segment

To get application segment details:

1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}.
2. Provide the following in the request endpoint:
   • customerId: The ZPA tenant ID of the customer.
   • applicationId: The particular application segment ID you want to get details for.
   • For example: /mgmtconfig/v1/admin/customers/144118148382064640/application/144118148382065748

A successful response returns code 200. To learn more, see ZPA API Codes.

Example Response

{
 "modifiedTime": "1716571633",
 "creationTime": "1716571633",
 "modifiedBy": "144118148382064930",
 "id": "144118148382065748",
 "domainNames": [
   "example.com"
 ],
 "name": "Copy of Test App Segment",
 "serverGroups": [
   {
     "id": "144118148382064812",
     "modifiedTime": "1584421166",
     "creationTime": "1492592504",
     "modifiedBy": "144118148382064930",
     "name": "161_sg",
     "enabled": true,
     "description": "DESC - u",
     "configSpace": "DEFAULT",
     "weight": "0",
     "passive": false,
     "extranetEnabled": false,
     "dynamicDiscovery": false
   }
 ],
 "enabled": true,
 "passiveHealthEnabled": true,
 "tcpPortRanges": [
   "89",
   "90"
 ],
 "tcpPortRange": [
   {
     "from": "89",
     "to": "90"
   }
 ],
 "doubleEncrypt": false,
 "configSpace": "DEFAULT",
 "bypassType": "NEVER",
 "healthCheckType": "DEFAULT",
 "icmpAccessType": "NONE",
 "isCnameEnabled": true,
 "ipAnchored": false,
 "bypassOnReauth": false,
 "inspectTrafficWithZia": false,
 "healthReporting": "ON_ACCESS",
 "useInDrMode": false,
 "tcpKeepAlive": "0",
 "selectConnectorCloseToApp": false,
 "matchStyle": "EXCLUSIVE",
 "isIncompleteDRConfig": false,
 "adpEnabled": false,
 "autoAppProtectEnabled": false,
 "apiProtectionEnabled": false,
 "fqdnDnsCheck": false,
 "weightedLoadBalancing": false,
 "extranetEnabled": false,
 "microtenantName": "Default",
 "segmentGroupId": "144118148382065533",
 "segmentGroupName": "exampleSegmentGroup"
}

Getting Details for All Application Segments

To get details of all application segments:

1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application.
2. Provide the customerId, the ZPA tenant ID of the customer, in the endpoint. For example: /mgmtconfig/v1/admin/customers/72057615512764416/application

A successful response returns code 200. To learn more, see ZPA API Codes.

Example Response

{
  "totalPages":"1",
  "totalCount": "6",
  "list":[
     {
        "modifiedTime":"1560983316",
        "creationTime":"1560983270",
        "modifiedBy":"72057615512764447",
        "id":"72057615512764474",
        "domainNames":[
           "www.oneone.com"
        ],
        "name":"app1",
        "serverGroups":[
           {
              "id":"72057615512764473",
              "creationTime":"1560983270",
              "modifiedBy":"72057615512764447",
              "name":"srvgrp1",
              "enabled":true,
              "learningEnabled":false,
              "configSpace":"DEFAULT"
           }
        ],
        "enabled":true,
        "passiveHealthEnabled":true,
        "tcpPortRange":[
           {
              "from":"80",
              "to":"80"
           }
        ],
        "doubleEncrypt":false,
        "segmentGroupId":"72057615512764420",
        "segmentGroupName":"Internal Application Group",
        "configSpace":"DEFAULT",
        "bypassType":"NEVER",
        "healthCheckType":"DEFAULT",
        "isCnameEnabled":"true",
        "clientlessApps":[
           {
              "id":"72057615512764475",
              "modifiedTime":"1560983316",
              "creationTime":"1560983270",
              "modifiedBy":"72057615512764447",
              "name":"www.oneone.com",
              "enabled":true,
              "certificateId":"72057615512764448",
              "certificateName":"Wild Card Cert",
              "applicationPort":"80",
              "applicationProtocol":"HTTP",
              "domain":"www.oneone.com",
              "path":"/",
              "hidden":false,
              "appId":"72057615512764474",
              "trustUntrustedCert":false,
              "allowOptions":false,
              "cname":"67.72057615512764416.h.b.zpa-app.net"
           }
        ],
        "icmpAccessType":"NONE",
        "ipAnchored":false,
        "bypassOnReauth":false,
        "inspectTrafficWithZia":false,
        "healthReporting":"ON_ACCESS",
        "useInDrMode":"false",
        "tcpKeepAlive":"0",
        "selectConnectorCloseToApp":false,
        "adpEnabled":false,
        "autoAppProtectEnabled":false,
        "isIncompleteDRConfig":false,
        "microtenantName":"Default",
        "segmentGroupId":"217246660303026632",
        "segmentGroupName":"test-app-seg-group",
        "matchStyle":"EXCLUSIVE"
     }
  ]
}

Pagination

This API supports pagination. To get a paginated response:

1. Send a GET request to the endpoint /mgmtconfig/v1/admin/customers/{customerId}/application?page=1&pagesize=20.
2. Provide the customerId and valid values for page and page size parameters. For example: /mgmtconfig/v1/admin/customers/72057615512764416/application?page=1&pagesize=2

The following is an example response:

{
 "totalPages": "1",
 "totalCount": "6",
 "list": [
   {
     "id": "144118148382064803",
     "domainNames": [
       "crm.lanukcorp.com"
     ],
     "name": "CRM AWS",
     "description": "Test text",
     "enabled": true,
     "passiveHealthEnabled": true,
     "tcpPortRanges": [
       "80",
       "80"
     ],
     "segmentGroupId": "144118148382064801",
     "segmentGroupName": "Do not delete"
   }
 ]
}

NOTE

If not provided, the default page size is 20. The maximum page size is 500.

Getting Application Type Details for the Application Segment

To get application type details for the application segment:

1. Send a GET request to the following endpoint: /mgmtconfig/v2/admin/customers/{customerId}/application/getAppsByType?applicationType={applicationType}.
2. Provide the following in the request endpoint:
   • customerId: The ZPA tenant ID of the customer.
   • applicationType: The type of application. Supported values are AppProtection (INSPECT) or Privileged Remote Access (SECURE_REMOTE_ACCESS).
   • For example: /mgmtconfig/v2/admin/customers/145256180497776640/application/getAppsByType?applicationType=SECURE_REMOTE_ACCESS

A successful response returns code 200. To learn more, see ZPA API Codes.

Example Response

{
   "totalPages":"1",
   "totalCount": "8",
   "list":[
      {
         "id":"145256180497776887",
         "name":"1.1.1.122",
         "enabled":true,
         "applicationPort":"22",
         "applicationProtocol":"SSH",
         "domain":"1.1.1.122",
         "appId":"145256180497776882",
         "hidden":false,
         "portal":false
      }
   ]
}

Getting Application Type Details by Microtenant ID

This API supports a search option to get application type details by Microtenant ID. To get application type details by microtenantId:

1. Send a GET request to the following endpoint: mgmtconfig/v1/admin/customers/{customerId}/application/getAppsByType?applicationType={applicationType}?microtenantId={microtenantId}&search={searchString}.
2. Provide the search string in the format: {filter}%20{operator}%20{filterValue}. Supported filter is ownershipType. Operator is EQ. Values: INHERITED, MICROTENANT_SPECIFIC, SHARED_FROM_THIS_MICROTENANT, SHARED_TO_THIS_MICROTENANT.

The following is an example response:

{
   "totalPages":"1",
   "totalCount":"0",
   "list":[
      {
         "id":"145260601092866291",
         "name":"example-Microtenanta-test.com",
         "enabled":true,
         "applicationPort":"22",
         "applicationProtocol":"SSH",
         "domain":"example-Microtenanta-test.com",
         "microtenantId":"145260601092866116",
         "microtenantName":"Microtenant A",
         "appId":"145260601092866290",
         "hidden":false
      }
   ]
}

Updating Application Segment Details

To update an application segment:

1. Use the updated JSON payload from Creating an Application Segment and send a PUT request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}.

2. Provide the following in the request endpoint:

   • customerId: The ZPA tenant ID of the customer.
   • applicationId: The particular application segment ID you want to update.

   For example: /mgmtconfig/v1/admin/customers/72057615512764416/application/217246660302996821

You can provide multiple port ranges using the format in the entire JSON payload. To learn more, refer to the entire JSON payload, or see the Adding Field Descriptions section.

A successful response returns code 204. To learn more, see ZPA API Codes.

An error is returned if Inspect Traffic with ZIA is not enabled on your tenant and InspectTrafficWithZia is passed as enabled when making a POST or PUT request. The following is an example error:

{
   "params":[
      "inspectTrafficWithZia",
      "testApplication",
      "feature.application.inspect_traffic_with_zia",
      "72057594037927936"
   ],
   "id":"config.change.not.allowed.sku.not.enabled",
   "reason":"Cannot update config inspectTrafficWithZia of testApplication as this is managed by SKU feature.application.inspect_traffic_with_zia which is not enabled for customer 72057594037927936"
}

JSON Payload

{
  "segmentGroupId":"string",
  "segmentGroupName":"string",
  "bypassType":"ALWAYS",
  "clientlessApps":[
     {
        "allowOptions":true,
        "appId":0,
        "applicationPort":0,
        "applicationProtocol":"HTTP",
        "certificateId":0,
        "certificateName":"string",
        "cname":"string",
        "creationTime":0,
        "description":"string",
        "domain":"string",
        "enabled":true,
        "hidden":true,
        "id":0,
        "modifiedBy":0,
        "modifiedTime":0,
        "name":"string",
        "path":"string",
        "trustUntrustedCert":true
     }
  ],
  "isCnameEnabled":"true",
  "configSpace":"DEFAULT",
  "creationTime":0,
  "defaultIdleTimeout":0,
  "defaultMaxAge":0,
  "description":"string",
  "domainNames":[
     "string"
  ],
  "doubleEncrypt":true,
  "enabled":true,
  "healthCheckType":"DEFAULT",
  "healthReporting":"NONE",
  "id":"string",
  "ipAnchored":true,
  "matchStyle":"EXCLUSIVE",
  "modifiedBy":"string",
  "modifiedTime":0,
  "name":"string",
  "passiveHealthEnabled":true,
  "selectConnectorCloseToApp":true,
  "serverGroups":[
     {
        "configSpace":"DEFAULT",
        "creationTime":0,
        "description":"string",
        "enabled":true,
        "id":0,
        "learningEnabled":true,
        "modifiedBy":0,
        "modifiedTime":0,
        "name":"string"
     }
  ],
  "tcpPortRange":[
     {
        "from":"fromPort1",
        "to":"toPort1"
     }
  ]
}

Minimum Criteria JSON Payload

{
  "name":"string",
  "description":"string",
  "enabled":false,
  "healthReporting":"ON_ACCESS",
  "ipAnchored":false,
  "doubleEncrypt":false,
  "bypassType":"NEVER",
  "isCnameEnabled":"true",
  "tcpPortRange":[
     {
        "from":"fromPort1",
        "to":"toPort1"
     }
  ],
  "domainNames":[
     "domainName or IpAddress"
  ],
  "segmentGroupId":"<segmentGroupId>",
  "selectConnectorCloseToApp":true,
  "serverGroups":[
     {
        "id":"<serverGroupId>"
     }
  ]
}

Applicable Limits

The following limits are applicable when updating an application segment using the ZPA cloud service API:

• If an application segment is configured using Zscaler Deception, then the update and delete options are unavailable.
• The weightedLoadBalancing field is not supported when sending a PUT request to the /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId} endpoint to update an application segment.
• Removing all active server groups that have values for the weight field greater than 0 disables application load balancing and high availability. To learn more, see Managing Application Load Balancing and High Availability Using API.

AD Protection Support

To update an application segment and enable Active Directory Inspection:

1. Send a PUT request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}.

2. Provide the following in the request endpoint:

   • customerId: The ZPA tenant ID of the customer.
   • applicationId: The particular application segment ID you want to update.

   For example: /mgmtconfig/v1/admin/customers/72057615512764416/application/217246660302996821

   You can provide multiple port ranges using the format in the entire JSON payload. To learn more, refer to the entire JSON payload, or see the Adding Field Descriptions section.

3. Provide the following in the JSON payload:

   • Set adpEnabled as true.
   • TCP and UDP protocols.

A successful response returns code 204. To learn more, see ZPA API Codes.

JSON Payload

{
  "enabled":true,
  "adpEnabled":true,
  "tcpProtocols":[
     "SMB"
  ],
  "udpProtocols":[
     "LDAP"
  ],
  "commonAppsDto":{
     "appsConfig":[
        {
           "name":"exampleapp.com",
           "domain":"exampleapp.com",
           "adpEnabled":true,
           "appTypes":[
              "INSPECT"
           ],
           "enabled":true
        }
     ]
  }
}

AppProtection Support

The following operations to enable or disable AppProtection on an application are supported for the same endpoint to update an application segment.

Enable AppProtection

To enable AppProtection on an existing application segment:

1. Send a PUT request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}.

2. Provide the following in the request endpoint:

   • customerId: The ZPA tenant ID of the customer, in the request endpoint.
   • applicationId: The ID of the application.

   For example: /mgmtconfig/v1/admin/customers/72057615512764416/application/217246660302996821

3. Include the request headers to provide information about the request context:

   • Content-Type: application/json
   • Authorization: Bearer <access_token>

4. Use the following JSON payload and provide the following information:

   • The name of the application segment
   • The domains of the application
   • The TCP and UDP ports
   • Other details like the segment group and server group ID

5. Ensure "appTypes": ["INSPECT"] and the other fields in "commonAppsDto" are included in the JSON payload.

A successful response returns code 201. To learn more, see ZPA API Codes.

NOTE

You choose the application criteria you want to include in the JSON payload. Refer to the Adding Field Descriptions section for supported values.

JSON Payload

{
  "name":"string",
  "domainNames":[
     "existing domain name",
     "new domain name"
  ],
  "serverGroups":[
     {
        "id":"<serverGroupId>"
     }
  ],
  "enabled":true,
  "passiveHealthEnabled":true,
  "tcpPortRange":[
     "from",
     "to"
  ],
  "udpPortRanges":[
     "from",
     "to"
  ],
  "doubleEncrypt":false,
  "configSpace":"DEFAULT",
  "bypassType":"NEVER",
  "healthCheckType":"DEFAULT",
  "icmpAccessType":"NONE",
  "isCnameEnabled":true,
  "ipAnchored":false,
  "healthReporting":"ON_ACCESS",
  "segmentGroupId":"<segmentGroupId>",
  "commonAppsDto":{
 "appsConfig":[
 {
 "name":"string",
 "enabled":true,
 "applicationProtocol":"HTTPS",
 "applicationPort":"443",
 "path":"/",
 "domain":"string",
 "trustUntrustedCert":false,
 "allowOptions":false,
 "certificateId":"<signingCertId>",
 "appTypes":[
 "INSPECT"
 ]
 }
  ]
  }
}

Example JSON Payload

{  
  "domainNames":[  
     "domain.com"  
  ],  
  "name":"app segment name",  
  "serverGroups":[  
     {  
        "id":"72057594037988996"  
     }  
  ],  
  "enabled":true,  
  "passiveHealthEnabled":true,  
  "tcpPortRanges":[  
     "from":"10",  
     "to":"10"  
  ],  
  "doubleEncrypt":false,  
  "configSpace":"DEFAULT",  
  "bypassType":"NEVER",  
  "healthCheckType":"DEFAULT",  
  "icmpAccessType":"NONE",  
  "isCnameEnabled":true,  
  "ipAnchored":false,  
  "healthReporting":"ON_ACCESS",  
  "segmentGroupId":"72057594037988995",  
  "commonAppsDto":{  
     "appsConfig":[  
        {  
           "name":"domain.com",  
           "enabled":true,  
           "applicationProtocol":"HTTPS",  
           "applicationPort":"10",  
           "path":"/",  
           "domain":"domain.com",  
           "trustUntrustedCert":false,  
           "allowOptions":false,  
           "certificateId":"72057594038037594",  
           "appTypes":[  
              "INSPECT"  
           ]  
        }  
     ]  
  }  
}

Disable AppProtection

To disable AppProtection on an existing application segment:

1. Send a PUT request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}.

2. Provide the following in the request endpoint:

   • customerId: The ZPA tenant ID of the customer, in the request endpoint.
   • applicationId: The ID of the application.

   For example: /mgmtconfig/v1/admin/customers/72057615512764416/application/217246660302996821

3. Include the request headers to provide information about the request context:

   • Content-Type: application/json
   • Authorization: Bearer <access_token>

4. Use one of the following JSON payloads and provide the following information:

   • The name of the application segment
   • The domains of the existing or new application segment
   • The TCP and UDP ports
   • Other details like the segment group and server group IDs

5. Include the "deletedInspectApps" field.

Entire JSON Payload

{  
  "name":"string",  
  "domainNames":[  
     "existing domain name",  
     "new domain name"  
  ],  
  "serverGroups":[  
     {  
        "id":"<serverGroupId>"  
     }  
  ],  
  "enabled":true,  
  "passiveHealthEnabled":true,  
  "tcpPortRanges":[  
     "from",  
     "to"  
  ],  
  "udpPortRanges":[  
     "from",  
     "to"  
  ],  
  "doubleEncrypt":false,  
  "configSpace":"DEFAULT",  
  "bypassType":"NEVER",  
  "healthCheckType":"DEFAULT",  
  "icmpAccessType":"NONE",  
  "isCnameEnabled":true,  
  "ipAnchored":false,  
  "healthReporting":"ON_ACCESS",  
  "segmentGroupId":"<segmentGroupId>",  
  "commonAppsDto":{  
     "deletedInspectApps":[  
 "<applicationId>"  
     ]  
  }  
}

Example JSON Payload

{  
  "name":"WAAP_Public_API_Test",  
  "description":"WAAP Public API Test",  
  "enabled":true,  
  "healthReporting":"ON_ACCESS",  
  "ipAnchored":false,  
  "doubleEncrypt":false,  
  "bypassType":"NEVER",  
  "isCnameEnabled":true,  
  "tcpPortRanges":[  
     "20",  
     "28"  
  ],  
  "udpPortRanges":[  
     "30",  
     "38"  
  ],  
  "domainNames":[  
     "inspect.com"  
  ],  
  "serverGroups":[  
     {  
        "id":"72057594038048851"  
     }  
  ],  
  "segmentGroupId":"72057594037988995",  
  "commonAppsDto":{  
     "deletedInspectApps":[  
        72057594038079024  
     ]  
  }  
}

Minimum Criteria JSON Payload

{
   "domainNames": ["existing domain name"],
   "commonAppsDto": {
       "deletedInspectApps": [
           <applicationId>
       ]
   }
}

Minimum Criteria Example JSON Payload

{
   "domainNames": ["inspect3.com"],
   "commonAppsDto": {
       "deletedInspectApps": [
           72057594038079526
       ] 
    }
}

Microtenant Support

To share an application segment to Microtenants:

1. Send a PUT request to the following endpoint: /mgmtconfig/v1/customers/{customerId}/application/{applicationId}/share.

2. Provide the following in the request endpoint:

   • customerId: The ZPA tenant ID of the customer.
   • applicationId: The ID of the application.

   For example: /mgmtconfig/v1/customers/72057594037927936/application/72057594038642786/share

3. Use the following JSON payload and provide the microtenantId, the unique identifier of the Microtenants you want to share to, in the shareToMicrotenants model.

A successful response returns code 204. To learn more, see ZPA API Codes.

JSON Payload

{
 "shareToMicrotenants": [
   <MicrotenantId>
 <MicrotenantId>
   …
 ]
}

Example JSON Payload

{
  "shareToMicrotenants":[
     "73201978410270795",
     "73201978410270803",
     "73201978410270741"
  ]
}

Deleting an Application Segment

To delete an application segment:

1. Send a DELETE request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}.

2. Provide the following key-value pairs in the request endpoint:

   • customerId: The ZPA tenant ID of the customer.
   • applicationId: The particular application segment ID you want to delete.

   For example: /mgmtconfig/v1/admin/customers/72057615512764416/application/217246660302996821

A successful response returns code 204. To learn more, see ZPA API Codes.

CAUTION

An object that is referenced in another object cannot be deleted. Error code 400 is returned in this situation.

Error Code 400

{
   "params": [
       "Application",
       "app 3 created on postman feb 5_edited"
   ],
   "id": "resource.referenced",
   "reason": "Resource is being referenced in Application : app 3 created on postman feb 5_edited."
}

NOTE

If an application segment is configured using Zscaler Deception, then the update and delete options are unavailable.