Zscaler OneAPI

Zscaler OneAPI Configuration

1. Create an API Role

• Name → WitnessAI-API-Role
• Policy & Components → URL Categories
• URL Categories → Custom
• Zscaler Defined URL Category Management → None
• Custom URL Management → Full
• Override Existing Categories → None
• Set all other scopes as “None” or “View Only”
• Save, then Activate the change so the role is committed

2. Create the API Client

• Name → WitnessAI-API-Client
• Status → Active
• Access Token Lifetime → at least 60 minutes
• Client Authentication → Secret → click Add, then copy the generated Client Secret (it is shown only once and cannot be retrieved later)

• Resources → select WitnessAI-API-Role (the ZIA role created in Step 1)

• Under the ZIA dropdown, confirm WitnessAI-API-Role is listed
• If it is not listed, click Sync Now to run an on-demand sync, then re-check

• Save → Zidentity auto-generates the Client ID, shown on the API Clients page. Copy it.

3. Identify the Vanity Domain

• If you sign in at companyname.zslogin.net (or companyname-admin.zslogin.net), your vanity domain is companyname
• It can also be found under ZIA portal → Administration → Company Profile → Organization → Domains

• Client ID
• Client Secret
• Vanity Domain