Reads Zscaler Internet Access, Private Access, Client Connector and ZIdentity through OneAPI, with one read-only API client created in your tenant's ZIdentity.
For the general flow of adding a source, see Connect Data Sources.
A Zscaler tenant on ZIdentity (OneAPI). Legacy ZIA API keys and per-cloud ZPA API keys are not supported
Admin rights in ZIdentity, to create an API client, and in the ZIA Admin Portal, to choose the admin role it uses
For the Private Access tables: your ZPA customer ID
In the ZIA Admin Portal, open Administration → Role Management
Use (or create) a read-only admin role for HARVEN
Set Username Access and Device Information Access to Read Only — otherwise ZIA returns obfuscated user names and device data, and no Zscaler user can be matched with your other sources
In the ZIdentity Admin Portal, open Integration → API Clients and add an API client named e.g. HARVEN
Choose Client Secret authentication (private-key JWT is not supported)
Assign read-only API resources for the products you want to read: ZIA (with the role of step 1), ZIdentity, ZPA and Client Connector. A product left out shows up as failing tables on the Tables tab
Save, then copy the Client ID and the client secret — the secret is shown only once
Open Workspace → Data sources → Add → Zscaler
Enter the vanity domain: the first part of your ZIdentity address, e.g. acme for acme.zslogin.net (pasting acme.zslogin.net or its URL also works)
Paste the Client ID and the client secret
To read Private Access, enter the ZPA customer ID, shown in the ZPA Admin Portal under Configuration & Control → Public API → API Keys. Leave it empty if you do not use ZPA
Click Save. HARVEN does not test the credentials on save: the connector opens on its Tables tab, where each table is checked, so a product whose API resource is missing shows up there as failing tables
Every query reads Zscaler live, within the quotas Zscaler sets per tenant: ZIA allows 2 reads a second and 1,000 an hour, and Client Connector 100 calls an hour for the whole tenant — a full device scan uses up to 5 of them. HARVEN paces its calls to stay within these quotas, so a large scan takes time; when a quota resets more than a minute later, the query stops and says how long to wait.
Shadow IT applications is one export per time window: the last 7 days unless the query chooses another window (1, 7 or 15 days, month, quarter).
Private Access policy rules are listed per policy type: a query that names a type reads only that one.
Field | Where to find it |
|---|---|
Vanity domain | The first part of your ZIdentity address (acme for acme.zslogin.net) |
Client ID | ZIdentity → Integration → API Clients |
Client secret | ZIdentity → Integration → API Clients (shown once when created) |
ZPA customer ID (optional) | ZPA Admin Portal → Configuration & Control → Public API → API Keys |
internet_access_users — ZIA end users: Identification and join keys (user_id, name, email), Organisation (department_name, groups), Privileged accounts (admin_user, user_type)
internet_access_admins — ZIA administrators and auditors: Who administers what (login_name, role_name, admin_scope), false = SSO only (is_password_login_allowed), Account and password hygiene (the org-wide password_expiry_days stays empty on ZIdentity tenants) (disabled, is_password_expired, password_expiry_days)
internet_access_admin_roles — ZIA admin roles: Identification (name, rank, role_type), What the role may change (policy_access, admin_acct_access, permissions)
shadow_it_applications — Cloud applications seen in traffic (last 7 days by default): Which application (application, application_category), Sanction and risk (sanctioned_state, risk_index), Usage over the window (users, transactions, upload_bytes, download_bytes)
firewall_filtering_rules — ZIA cloud firewall rules: Rule and verdict (name, rule_order, action, state), Match criteria (empty = any) (src_ips, dest_addresses, nw_services), Last change (last_modified_time)
private_access_app_connectors — ZPA App Connectors: Identification (name, app_connector_group_name), Patch compliance (current_version, expected_version, upgrade_status), Health (last_broker_connect_time)
private_access_application_segments — Private applications published through ZPA: What is published (name, domain_names), Exposed ports (tcp_port_ranges, udp_port_ranges), Policy enforcement (bypass_type, enabled)
private_access_policy_rules — ZPA policy rules (read per policy type): Rule and verdict (policy_type, name, action, rule_order), Who and what the rule matches, device posture included (conditions)
client_connector_devices — Devices enrolled in Client Connector: Identification and join keys (udid, hostname, mac_address, user_name), Platform and agent (os_type, os_version, agent_version), Enrolment and liveness (registration_state, last_seen_time)
identity_users — ZIdentity user directory: Join keys (login_name, primary_email), Active or not, and where the account comes from (status, source, idp_name)
Need help? Contact [email protected].
