Managing Client Settings Using API

This article provides information for managing Zscaler Private Access client settings using APIs. All APIs are rate limited. To learn more, see ZPA API Rate Limits.

Getting Details of Client Settings

To get details of client settings for a given customer:

1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/clientSetting.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/145256180497776640/clientSetting.

A successful response returns code 200. To learn more, see ZPA API Codes.

Example Response

[
  {
    "id": "6025",
    "creationTime": "1635186837",
    "modifiedBy": "72057594038006701",
    "clientCertificateType": "ZAPP_CLIENT",
    "signingCertExpiryInEpochSec": "2108226836",
    "name": "Client",
    "enrollmentCertId": "13965",
    "enrollmentCertName": "Client"
  }
]

Prerequisite API Calls

Before you can create or update client settings, you must get the enrollment certificate details. To learn more, see Obtaining Enrollment Certificate Details Using API.

Creating or Updating Client Settings

To create client settings:

1. Send a POST request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/clientSetting.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/145256180497776640/clientSetting.
3. Use the following JSON payload provide the following information:
   • enrollmentCertId: The unique identifier of the generated enrollment certificate. To learn more, see Obtaining Enrollment Certificate Details Using API.
   • clientCertificateType: The client certificate type. The supported values are:
     • APP_PROTECTION: This enrollment (CA) certificate enrolls AppProtection-enabled application segments.
     • ISOLATION_CLIENT: This enrollment (CA) certificate enrolls Isolation clients.
     • NONE: This enrollment (CA) certificate enrolls App Connectors, ZPA Private Service Edges, or Private Cloud Controllers.
     • ZAPP_CLIENT: This enrollment (CA) certificate enrolls Zscaler Client Connector.
   • enrollmentCertName: The name of the generated enrollment certificate.
   • name: The name of the client settings.

A successful response returns code 204, meaning the client settings are created or updated. To learn more, see ZPA API Codes.

JSON Payload

{
  "modifiedTime": 0,
  "creationTime": 0,
  "modifiedBy": 0,
  "microtenantId": <Microtenant ID>,
  "enrollmentCertId": <enrollment certificate ID>,
  "clientCertificateType": "ZAPP_CLIENT",
  "enrollmentCertName": "string",
  "signingCertExpiryInEpochSec": 0,
  "name": <Name of the client settings>
}

Example JSON Payload

{
  "signingCertId: "227050",
  "clientCertificateType: "APP_PROTECTION"
}

Example Response

[
   {
      "id":"150207",
      "modifiedTime":"1746657505",
      "creationTime":"1743663009",
      "modifiedBy":"72057594038040687",
      "signingCertId":"227050",
      "clientCertificateType":"APP_PROTECTION",
      "signingCertName":"Example Cert Test",
      "signingCertExpiryInEpochSec":"2692737505",
      "name":"Example Cert Test"
   }
]

Deleting Client Settings

To delete client settings:

1. Send a DELETE request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/clientSetting.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/145256180497776640/clientSetting.
3. Provide the type (i.e., the client certificate type), as a query-string parameter. The supported values are:
   • APP_PROTECTION: This enrollment (CA) certificate enrolls AppProtection-enabled application segments.
   • ISOLATION_CLIENT: This enrollment (CA) certificate enrolls Isolation clients.
   • NONE: This enrollment (CA) certificate enrolls App Connectors, ZPA Private Service Edges, or Private Cloud Controllers.
   • ZAPP_CLIENT: This enrollment (CA) certificate enrolls Zscaler Client Connector.

A successful response returns code 204, meaning the client settings are deleted. To learn more, see ZPA API Codes.

Getting Details of All Client Settings

To get details of all client settings:

1. Send a GET request to the following endpoint: /mgmtconfig/v1/admin/customers/{customerId}/clientSetting/all.
2. Provide the customerId, the ZPA tenant ID of the customer, in the request endpoint. For example: /mgmtconfig/v1/admin/customers/145256180497776640/clientSetting/all.

A successful response returns code 200. To learn more, see ZPA API Codes.

Example Response

[
  {
    "id": "13370",
    "modifiedTime": "1692635903",
    "creationTime": "1692635903",
    "modifiedBy": "72057594038006701",
    "clientCertificateType": "ISOLATION_CLIENT",
    "name": "Isolation Client",
    "enrollmentCertId": "26781",
    "enrollmentCertName": "Isolation Client"
  },
  {
    "id": "16239",
    "modifiedTime": "1728667950",
    "creationTime": "1728667884",
    "modifiedBy": "72057594038006517",
    "clientCertificateType": "APP_PROTECTION",
    "name": "test 123",
    "enrollmentCertId": "33645",
    "enrollmentCertName": "test 123"
  }
]

Adding Field Descriptions

The following table includes available fields you can use for the client settings API use cases:

Field	Description	Required	Value
clientCertificateType	The client certificate type	Yes	String The supported values are: APP_PROTECTION: This enrollment (CA) certificate enrolls AppProtection-enabled application segments. ISOLATION_CLIENT: This enrollment (CA) certificate enrolls Isolation clients. NONE: This enrollment (CA) certificate enrolls App Connectors, ZPA Private Service Edges, or Private Cloud Controllers. ZAPP_CLIENT: This enrollment (CA) certificate enrolls Zscaler Client Connector.
enrollmentCertId	The unique identifier of the enrollment certificate. To learn more, see Obtaining Enrollment Certificate Details Using API.	Yes	Integer
enrollmentCertName	The name of the enrollment certificate	Yes	String