Obtaining Access Policy Details for Federated Applications Using API

This article provides information on Zscaler Private Access (ZPA) access policies for federated application use cases using APIs. All APIs are rate limited. To learn more, see ZPA API Rate Limits and Understanding Business-to-Business Federation.

Getting Access Policy Rules for Federated Applications

To get access policy rules for federated applications that the host partner has federated to the guest:

1. Send a GET request to the following endpoint: /mgmtconfig/v1/customers/{customerId}/policySet/rules/policyType/GLOBAL_POLICY/guest/{guest_id}?microtenantId={microtenantId}&page=1&pagesize=20&search={search}.

2. Provide the following in the request endpoint:

   • customerId: The ZPA tenant ID of the customer.
   • guest_id: The partner or guest tenant ID for the policy rules you want to view. This is the partnerGid value when sending a GET request to get all active federation partners.
   • Valid search string values. The search string values are in the format fieldName operator fieldValue. Only search string values that correspond to the values for valid fields and filters are supported. For example, the string name EQ Globex - Allow RDP for SRE would is supported for the Name filter, using the Equals (EQ) operator, for the filter value set to Globex - Allow RDP for SRE would.
   • microtenantId: The unique identifier of the Microtenant. If you are within a Microtenant, you must pass the microtenantId field when making an API call to retrieve data from that Microtenant. The microtenantId can be obtained from the API Keys page, or can be obtained programmatically using the ZPA cloud service API. Access to certain operations is limited when you are within a Microtenant. If you are within the Default Microtenant, pass microtenantId as 0 when making requests to retrieve data from the Default Microtenant. If the microtenantId is not passed in the request when creating or updating a resource, then the resource is created or updated in the Default Microtenant. To learn more, see Configuring Microtenants Using API.

   For example: /mgmtconfig/v1/customers/72057595111669760/policySet/rules/policyType/GLOBAL_POLICY/guest/72057595111669761?page=1&pagesize=20&microtenantId=145260601092866314.

Example Response

{
  "totalPages": "1",
  "totalCount": "1",
  "list": [
    {
      "id": "145260601092866900",
      "name": "Globex - Allow RDP for SRE",
      "description": "Policy created by Globex Inc on the RDP app federated by Acme Corp",
      "action": "ALLOW",
      "operator": "AND",
      "policyType": "1",
      "ruleOrder": "1",
      "priority": "1",
      "conditions": [
        {
          "operator": "OR",
          "negated": false,
          "operands": [
            {
              "objectType": "APP",
              "lhs": "id",
              "rhs": "145260601092866519",
              "name": "rdp-internal-host.com"
            }
          ]
        }
      ],
      "defaultRule": false
    }
  ]
}

A successful response returns code 200. To learn more, see ZPA API Codes.

Field Descriptions

The following table includes descriptions of available fields you can use for the access policy rules for federated applications use cases:

Field	Description	Required	Value
customerId	The unique identifier of the ZPA tenant	Yes	Integer
guestId	The partner or guest tenant GID for the policy rules you want to view. This is the partnerGid value when sending a GET request to get all active federation partners.	Yes	Integer
microtenantId	The unique identifier of the Microtenant. If you are within a Microtenant, you must pass the microtenantId field when making an API call to retrieve data from that Microtenant. The microtenantId can be obtained from the API Keys page, or can be obtained programmatically using the ZPA cloud service API. Access to certain operations is limited when you are within a Microtenant. If you are within the Default Microtenant, pass microtenantId as 0 when making requests to retrieve data from the Default Microtenant. If the microtenantId is not passed in the request when creating or updating a resource, then the resource is created or updated in the Default Microtenant. To learn more, see Configuring Microtenants Using API.	No	Integer
page	Specifies the page number	No	Integer This field is 1 by default.
pagesize	Specifies the page size	No	Integer If not provided, the default page size is 20. The maximum page size is 500.
search	The search string used to support search by features and fields for the API	No	String