Skip to content
actionlake
Start free

Connectors · Identity & security

Zscaler Internet Access (ZIA) MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Zscaler Internet Access (ZIA) and the rest of your systems. It gives your agent 625 Zscaler Internet Access (ZIA) actions (344 reads, 200 writes and 81 that wait for a confirmation) and holds the Zscaler Internet Access (ZIA) credential itself, so the agent never does. It paces Zscaler Internet Access (ZIA)'s limits and records every call.

Connect Zscaler Internet Access (ZIA) freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "zscaler_zia.users.list",  intent: "check which Zscaler Internet Access (ZIA) account is connected"}# Get Users · read · 1 upstream call
  • 625actionsin one signed file
  • 344readlook, never change
  • 200writecreate and update
  • 81wait for a yesdestructive, confirmed first

Set up

Connect Zscaler Internet Access (ZIA) in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Zscaler Internet Access (ZIA).

    OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.

    • client_idClient ID of a ZIdentity API client (ZIdentity Admin Portal > Integration > API Clients > Add API Client,…
    • client_secretThe API client's secret, shown once when it is created
    • getresponseYour Zscaler Internet Access (ZIA) getresponse
    • requestYour Zscaler Internet Access (ZIA) request
    • tenant_hostWhere your Zscaler Internet Access (ZIA) lives: your tenant host
    account { op: "connections.requirements", service: "zscaler_zia" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "zscaler_zia.users.list" }# get users · read · 1 upstream callcheck { action: "zscaler_zia.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Zscaler Internet Access (ZIA) at a glance

Sign-in
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide
client_idclient_secret
Setup fields
getresponserequesttenant_host
Limits we pace to
1 calls a second, per connection
API covered
ZIA API v1 via Zscaler OneAPI (https://api.zsapi.net/zia/api/v1)api.zsapi.net/zia/api/v1
Built from
Zscaler Internet Access (ZIA)'s documentation, read 23 October 2026automate.zscaler.comhelp.zscaler.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
334 of 344 reads, for up to 5 minutes; a write clears what it affects
Shared entities
3, so ask can line Zscaler Internet Access (ZIA) up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Zscaler Internet Access (ZIA).

625 actions in 128 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 344readlook, never change
  • 200writecreate and update
  • 81destructivewait for a confirmation

  1. Intermediate ca certificate

    18

    10 read · 7 write · 1 destructive

    Add Intermediate Ca Certificate · Get Intermediate Ca Certificates · Get Intermediate Ca Certificates Lite · Get Certificates In Ready To Use State

  2. Alert rule configuration

    16

    6 read · 7 write · 3 destructive

    Create Alert Rule · Get All Security Alert Rules · Create Ueba Alert Rule · Get All Rules

  3. End point applications

    14

    10 read · 3 write · 1 destructive

    Get Zdp Applications · Add DLP Endpoint Resource · Get Custom Applications · Get Custom Applications Lite

  4. Locations

    14

    10 read · 2 write · 2 destructive

    Add Location · Get Groups · Get Groups Summary · Get Top Locations

  5. Cyber threat protection

    13

    7 read · 6 write · 0 destructive

    Get Config · Update Config · Get Atp Malware Inspection Config · Update Atp Malware Inspection Config

  6. End point DLP rules

    10

    4 read · 4 write · 2 destructive

    Add Endpoint DLP Rule · Fetch File Type Categories · Fetch File Types For Endpoint DLP · Get Endpoint DLP Rules

  7. Azure

    9

    5 read · 3 write · 1 destructive

    Get Virtual Hubs · Start Refresh Connection Status · Get Refresh Connection Status · Start Tunnel Config

  8. URL categories

    9

    4 read · 4 write · 1 destructive

    Add Custom Category · Get URL Category · Get Lite URL Categories · Get URL Categories

120 more areas · 522 actions
  • DLP dictionaries 8
  • Ip destination groups 8
  • Ip source groups 8
  • NSS feeds 8
  • Pac files 8
  • Traffic capture rules 8
  • Users 8
  • Web application rules 8
  • Departments 7
  • DLP engines 7
  • Email DLP rules 7
  • Email recipient profile 7
  • End point application groups 7
  • Groups 7
  • Ips signature rules 7
  • Admin roles 6
  • Admin users 6
  • Bandwidth classes 6
  • Bandwidth control rules 6
  • Casb DLP rules 6
  • Casb malware rules 6
  • Custom file types 6
  • DLP endpoint resource 6
  • DNS gateways 6
  • Domain profiles 6
  • End point DLP resource groups 6
  • Extranet 6
  • File type rules 6
  • Firewall filtering rules 6
  • Gre tunnels 6
  • Integration partners 6
  • Network application groups 6
  • Network service groups 6
  • Network services 6
  • Proxies 6
  • Risk profiles 6
  • Rule labels 6
  • SSL settings 6
  • Static ip 6
  • Tenancy restriction profile 6
  • URL filtering rules 6
  • VPN credentials 6
  • Web DLP rules 6
  • Alert definitions 5
  • Apps services 5
  • Auth settings 5
  • Cloud application instances 5
  • Cloud to cloud ir 5
  • DLP notification templates 5
  • Firewall DNS rules 5
  • Firewall ips rules 5
  • Forwarding rules 5
  • NSS servers 5
  • Root certificates 5
  • Sandbox rules 5
  • Security 5
  • SSL inspection rules 5
  • Time intervals 5
  • Virtual zen clusters 5
  • Virtual zen nodes 5
  • Workload groups 5
  • Zpa gateways 5
  • Alert subscriptions 4
  • Browser control settings 4
  • Casb tenant 4
  • Cloud applications 4
  • DC exclusions 4
  • Dnat rules 4
  • DNS application groups 4
  • Eventlog entry report 4
  • HTTP header action profile 4
  • HTTP header profile 4
  • Iot discovery 4
  • Isolation votiro CDR 4
  • NSS collectors 4
  • SSL certificates 4
  • Auditlog entry report 3
  • Behavioral analysis advanced settings 3
  • Config audit 3
  • Device groups 3
  • Icap servers 3
  • Idmprofile 3
  • Incident receiver servers 3
  • Ipv6config 3
  • Region 3
  • Subclouds 3
  • User confirmation 3
  • Vips 3
  • Adaptive access profiles 2
  • Advanced settings 2
  • Advanced URL filter and cloud app settings 2
  • Devices 2
  • DLP exact data match schemas 2
  • Eun 2
  • Eun template 2
  • Eusa status 2
  • FTP settings 2
  • Malware policy 2
  • Mobile advance threat settings 2
  • Network applications 2
  • Org information 2
  • Password expiry 2
  • Proxy gateways 2
  • Remote assistance 2
  • Sandbox 2
  • Shadow it 2
  • SMPC instance 2
  • Status 2
  • Time windows 2
  • Web DLP global options 2
  • Browser isolation 1
  • Casb email label 1
  • Custom tags 1
  • Datacenters 1
  • Dedicated ip gateways 1
  • File type categories 1
  • Org provisioning 1
  • Quarantine tombstone template 1
  • Subscriptions 1
  • URL lookup 1

Top actions

The Zscaler Internet Access (ZIA) API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 9 of Zscaler Internet Access (ZIA)'s 9 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
zscaler_zia.users.listGet UsersGets a list of all users and allows user filtering by name, department, or group. The name search parameter performs a partial match. The dept and group…readidentity.user.list474 connectors
zscaler_zia.groups.listGet GroupsRetrieves a list of groups. The search parameters find matching values in the name or comments attributes.readidentity.group.list262 connectors
zscaler_zia.admin_roles.listGet RolesRetrieves a list of all admin roles. To learn more, see About Role Management.readidentity.role.list184 connectors
zscaler_zia.users.createAdd UserAdds a new user. A user can belong to multiple groups, but can only belong to one department.writeidentity.user.create262 connectors
zscaler_zia.users.updateUpdate UserUpdates the user information for the specified ID. However, the email attribute is read-only.writeidentity.user.update280 connectors
zscaler_zia.groups.getGet GroupRetrieves the group based on the specified ID.readidentity.group.get212 connectors
zscaler_zia.users.deleteDelete UserDeletes the user for the specified ID.destructiveidentity.user.delete253 connectors
zscaler_zia.admin_users.me_getGet Current UserRetrieves information about the current administrator or auditor user, or both.readidentity.current_user.get307 connectors
zscaler_zia.vips.listGet Zscaler Nodes DetailsGets a paginated list of the virtual IP addresses (VIPs) available in the Zscaler cloud, including region and data center information. By default, the request…readthis connector
zscaler_zia.devices.listGet User DevicesRetrieves a list of all the devices registered with Zscaler. To learn more, see About Devices.readthis connector
zscaler_zia.proxies.listGet ProxiesRetrieves a list of all proxies configured for third-party proxy services.readthis connector
zscaler_zia.groups.createAdd GroupAdds a new group. To learn more, see Adding Groups. Note : This endpoint is accessible via Zscaler OneAPI only.writethis connector

Try it

Prompts to paste into Claude.

Each one names the Zscaler Internet Access (ZIA) actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Who has access in Zscaler Internet Access (ZIA)? List every user and their role.

    callszscaler_zia.users.list

  2. Writewrite

    Add User in Zscaler Internet Access (ZIA). Show me exactly what you will send before you save it.

    callszscaler_zia.users.create

Governance for Zscaler Internet Access (ZIA)

Destructive actions wait for a yes.

81 Zscaler Internet Access (ZIA) actions are destructive. The first 10:

  • Delete Userzscaler_zia.users.delete
  • Delete Groupzscaler_zia.groups.delete
  • Delete Proxyzscaler_zia.proxies.delete
  • Delete Extranetzscaler_zia.extranet.delete
  • Delete Locationzscaler_zia.locations.delete
  • Delete NSS Feedzscaler_zia.nss_feeds.delete
  • Delete Paczscaler_zia.pac_files.delete
  • Delete Static IPzscaler_zia.static_ip.delete
  • Delete Rulezscaler_zia.dnat_rules.delete
  • Bulk Delete Userszscaler_zia.users.bulk_delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dozscaler_zia.users.deleteconfirm_policy: human

Delete User?

intent: the user asked me to delete User

run suspended · waiting for a named person · key zscaler-zia-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "zscaler-zia-agent",  allowed_actions: ["zscaler_zia.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "zscaler_zia.users.delete", approver: "[email protected]" },    { match: "zscaler_zia.groups.delete", approver: "[email protected]" },    { match: "zscaler_zia.proxies.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to Zscaler Internet Access (ZIA) only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Zscaler Internet Access (ZIA) costs on actionlake.

Every Zscaler Internet Access (ZIA) action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Zscaler Internet Access (ZIA) refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 625 Zscaler Internet Access (ZIA) actions
  • 625actions pageeach page of a long list is one call
  • 334reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Zscaler Internet Access (ZIA) action.

625 actions by area: the id your agent calls, what it does, and its effect.

Intermediate ca certificate18
  • zscaler_zia.intermediate_ca_certificate.createAdd Intermediate Ca Certificatewrite
  • zscaler_zia.intermediate_ca_certificate.listGet Intermediate Ca Certificatesread
  • zscaler_zia.intermediate_ca_certificate.lite_listGet Intermediate Ca Certificates Literead
  • zscaler_zia.intermediate_ca_certificate.ready_to_use_listGet Certificates In Ready To Use Stateread
  • zscaler_zia.intermediate_ca_certificate.deleteDelete Intermediate Ca Certificatedestructive
  • zscaler_zia.intermediate_ca_certificate.download_attestation_getDownload Attestation Stmtread
  • and 12 more in this area
Alert rule configuration16
  • zscaler_zia.alert_rule_configuration.rules_createCreate Alert Rulewrite
  • zscaler_zia.alert_rule_configuration.rules_listGet All Security Alert Rulesread
  • zscaler_zia.alert_rule_configuration.ueba_rules_createCreate Ueba Alert Rulewrite
  • zscaler_zia.alert_rule_configuration.ueba_rules_listGet All Rulesread
  • zscaler_zia.alert_rule_configuration.rules_deleteDelete Rulesdestructive
  • zscaler_zia.alert_rule_configuration.rules_getGet Alert Ruleread
  • and 10 more in this area
End point applications14
  • zscaler_zia.end_point_applications.cloud_apps_listGet Zdp Applicationsread
  • zscaler_zia.end_point_applications.custom_app_createAdd DLP Endpoint Resourcewrite
  • zscaler_zia.end_point_applications.custom_apps_listGet Custom Applicationsread
  • zscaler_zia.end_point_applications.custom_apps_lite_listGet Custom Applications Literead
  • zscaler_zia.end_point_applications.cloud_apps_count_getGet Cloud Applications Countread
  • zscaler_zia.end_point_applications.count_getGet Applications Countread
  • and 8 more in this area
Locations14
  • zscaler_zia.locations.createAdd Locationwrite
  • zscaler_zia.locations.groups_listGet Groupsread
  • zscaler_zia.locations.groups_lite_listGet Groups Summaryread
  • zscaler_zia.locations.listGet Top Locationsread
  • zscaler_zia.locations.bulk_deleteBulk Delete Locationsdestructive
  • zscaler_zia.locations.deleteDelete Locationdestructive
  • and 8 more in this area
Cyber threat protection13
  • zscaler_zia.cyber_threat_protection.advanced_threat_settings_getGet Configread
  • zscaler_zia.cyber_threat_protection.advanced_threat_settings_updateUpdate Configwrite
  • zscaler_zia.cyber_threat_protection.atp_malware_inspection_getGet Atp Malware Inspection Configread
  • zscaler_zia.cyber_threat_protection.atp_malware_inspection_updateUpdate Atp Malware Inspection Configwrite
  • zscaler_zia.cyber_threat_protection.atp_malware_protocols_getGet Atp Malware Protocols Configread
  • zscaler_zia.cyber_threat_protection.atp_malware_protocols_updateUpdate Atp Malware Protocols Configwrite
  • and 7 more in this area
End point DLP rules10
  • zscaler_zia.end_point_dlp_rules.createAdd Endpoint DLP Rulewrite
  • zscaler_zia.end_point_dlp_rules.file_type_categories_listFetch File Type Categoriesread
  • zscaler_zia.end_point_dlp_rules.file_types_listFetch File Types For Endpoint DLPread
  • zscaler_zia.end_point_dlp_rules.listGet Endpoint DLP Rulesread
  • zscaler_zia.end_point_dlp_rules.deleteDelete Endpoint DLP Ruledestructive
  • zscaler_zia.end_point_dlp_rules.getGet Endpoint DLP Rule By IDread
  • and 4 more in this area
Azure9
  • zscaler_zia.azure.refresh_connection_statusStart Refresh Connection Statuswrite
  • zscaler_zia.azure.refresh_connection_status_getGet Refresh Connection Statusread
  • zscaler_zia.azure.tunnel_configurationStart Tunnel Configwrite
  • zscaler_zia.azure.virtual_hubs_listGet Virtual Hubsread
  • zscaler_zia.azure.tunnel_configuration_getGet Tunnel Configuration Statusread
  • zscaler_zia.azure.un_configure_tunnel_deleteUnconfigure Tunneldestructive
  • and 3 more in this area
URL categories9
  • zscaler_zia.url_categories.createAdd Custom Categorywrite
  • zscaler_zia.url_categories.getGet URL Categoriesread
  • zscaler_zia.url_categories.listGet URL Categoryread
  • zscaler_zia.url_categories.lite_listGet Lite URL Categoriesread
  • zscaler_zia.url_categories.deleteDelete Custom Categorydestructive
  • zscaler_zia.url_categories.review_domainsGet Categories With Matching Domainswrite
  • and 3 more in this area
DLP dictionaries8
  • zscaler_zia.dlp_dictionaries.createAdd Custom DLP Dictionarywrite
  • zscaler_zia.dlp_dictionaries.listGet DLP Dictionariesread
  • zscaler_zia.dlp_dictionaries.lite_listGet DLP Dictionary Summaryread
  • zscaler_zia.dlp_dictionaries.predefined_identifiers_listGet Predefined Hierarchical Identifiers By Dictionary IDread
  • zscaler_zia.dlp_dictionaries.deleteDelete Custom DLP Dictionarydestructive
  • zscaler_zia.dlp_dictionaries.getGet DLP Dictionary By IDread
  • and 2 more in this area
Ip destination groups8
  • zscaler_zia.ip_destination_groups.createAdd Destination IP Groupwrite
  • zscaler_zia.ip_destination_groups.ipv6_destination_groups_listGet Destination Ipv6 Groupsread
  • zscaler_zia.ip_destination_groups.ipv6_destination_groups_lite_listGet Destination Ipv6 Groups Literead
  • zscaler_zia.ip_destination_groups.listGet Destination IP Groupsread
  • zscaler_zia.ip_destination_groups.deleteDelete Destination IP Groupdestructive
  • zscaler_zia.ip_destination_groups.getGet Destination IP Group By IDread
  • and 2 more in this area
Ip source groups8
  • zscaler_zia.ip_source_groups.createAdd Source IP Groupwrite
  • zscaler_zia.ip_source_groups.ipv6_source_groups_listGet Source Ipv6 Groupsread
  • zscaler_zia.ip_source_groups.ipv6_source_groups_lite_listGet Source Ipv6 Groups Literead
  • zscaler_zia.ip_source_groups.listGet Source IP Groupsread
  • zscaler_zia.ip_source_groups.deleteDelete Source IP Groupdestructive
  • zscaler_zia.ip_source_groups.getGet Source IP Group By IDread
  • and 2 more in this area
NSS feeds8
  • zscaler_zia.nss_feeds.createCreate NSS Feedwrite
  • zscaler_zia.nss_feeds.feed_output_defaults_getGet Feed Out Put Formatsread
  • zscaler_zia.nss_feeds.listGet All NSS Feedsread
  • zscaler_zia.nss_feeds.validate_feed_formatValidate Feed Formatread
  • zscaler_zia.nss_feeds.deleteDelete NSS Feeddestructive
  • zscaler_zia.nss_feeds.getGet NSS Feed Detailsread
  • and 2 more in this area
Pac files8
  • zscaler_zia.pac_files.createAdd Pacwrite
  • zscaler_zia.pac_files.listGet Pacsread
  • zscaler_zia.pac_files.validateValidate Pacread
  • zscaler_zia.pac_files.version_listGet Pac By IDread
  • zscaler_zia.pac_files.deleteDelete Pacdestructive
  • zscaler_zia.pac_files.versionAdd Pac Versionwrite
  • and 2 more in this area
Traffic capture rules8
  • zscaler_zia.traffic_capture_rules.count_getGet Traffic Capture Rules Countread
  • zscaler_zia.traffic_capture_rules.createCreate Pcap Traffic Capture Rulewrite
  • zscaler_zia.traffic_capture_rules.listGet Packet Capture Rulesread
  • zscaler_zia.traffic_capture_rules.rule_labels_listGet Rule Label Inforead
  • zscaler_zia.traffic_capture_rules.deleteDelete Traffic Capture Ruledestructive
  • zscaler_zia.traffic_capture_rules.getGet Traffic Capture Ruleread
  • and 2 more in this area
Users8
  • zscaler_zia.users.createAdd Userwrite
  • zscaler_zia.users.getGet Userread
  • zscaler_zia.users.listGet Usersread
  • zscaler_zia.users.updateUpdate Userwrite
  • zscaler_zia.users.auditors_listGet Auditorsread
  • zscaler_zia.users.bulk_deleteBulk Delete Usersdestructive
  • and 2 more in this area
Web application rules8
  • zscaler_zia.web_application_rules.available_actionsGet Available Actionswrite
  • zscaler_zia.web_application_rules.createAdd Rulewrite
  • zscaler_zia.web_application_rules.duplicateDuplicate Rulewrite
  • zscaler_zia.web_application_rules.getGet Rules By Typeread
  • zscaler_zia.web_application_rules.deleteDelete Ruledestructive
  • zscaler_zia.web_application_rules.get_by_idGet Rule By IDread
  • and 2 more in this area
Departments7
  • zscaler_zia.departments.createAdd Departmentwrite
  • zscaler_zia.departments.getGet Departmentread
  • zscaler_zia.departments.listGet Departmentsread
  • zscaler_zia.departments.lite_listGet Departments Literead
  • zscaler_zia.departments.deleteDelete Departmentdestructive
  • zscaler_zia.departments.lite_getGet Department Literead
  • and 1 more in this area
DLP engines7
  • zscaler_zia.dlp_engines.createAdd Custom DLP Enginewrite
  • zscaler_zia.dlp_engines.listGet DLP Enginesread
  • zscaler_zia.dlp_engines.lite_listGet DLP Engines Summaryread
  • zscaler_zia.dlp_engines.validate_dlp_exprValidate DLP Patternread
  • zscaler_zia.dlp_engines.deleteDelete Custom DLP Enginedestructive
  • zscaler_zia.dlp_engines.getGet DLP Engine By IDread
  • and 1 more in this area
Email DLP rules7
  • zscaler_zia.email_dlp_rules.actions_getGet Email DLP Policy Actionsread
  • zscaler_zia.email_dlp_rules.createAdd Rulewrite
  • zscaler_zia.email_dlp_rules.listGet Rulesread
  • zscaler_zia.email_dlp_rules.lite_listGet Summaryread
  • zscaler_zia.email_dlp_rules.deleteDelete Ruledestructive
  • zscaler_zia.email_dlp_rules.getGet Rule By IDread
  • and 1 more in this area
Email recipient profile7
  • zscaler_zia.email_recipient_profile.count_getGet Email Recipient Profiles Countread
  • zscaler_zia.email_recipient_profile.createCreate Email Recipient Profilewrite
  • zscaler_zia.email_recipient_profile.listGet Email Recipient Profilesread
  • zscaler_zia.email_recipient_profile.lite_listGet Email Recipient Profiles Literead
  • zscaler_zia.email_recipient_profile.deleteDelete Email Recipient Profiledestructive
  • zscaler_zia.email_recipient_profile.getGet Email Recipient Profile By IDread
  • and 1 more in this area
End point application groups7
  • zscaler_zia.end_point_application_groups.createGroupwrite
  • zscaler_zia.end_point_application_groups.getGet Endpoint Application Group By IDread
  • zscaler_zia.end_point_application_groups.listGet Endpoint Application Groupsread
  • zscaler_zia.end_point_application_groups.policies_listGet Policies Associated With Groupsread
  • zscaler_zia.end_point_application_groups.updateGroupwrite
  • zscaler_zia.end_point_application_groups.deleteDelete DLP Endpoint Resourcedestructive
  • and 1 more in this area
Groups7
  • zscaler_zia.groups.createAdd Groupwrite
  • zscaler_zia.groups.getGet Groupread
  • zscaler_zia.groups.listGet Groupsread
  • zscaler_zia.groups.lite_listGet Groups Literead
  • zscaler_zia.groups.deleteDelete Groupdestructive
  • zscaler_zia.groups.lite_getGet Group Literead
  • and 1 more in this area
Ips signature rules7
  • zscaler_zia.ips_signature_rules.createAdd IPS Signature Rulewrite
  • zscaler_zia.ips_signature_rules.getGet IPS Signature Rule By IDread
  • zscaler_zia.ips_signature_rules.listGet IPS Signature Rulesread
  • zscaler_zia.ips_signature_rules.validate_rule_textValidate Rule Textread
  • zscaler_zia.ips_signature_rules.deleteDelete IPS Signature Ruledestructive
  • zscaler_zia.ips_signature_rules.import_getImport IPS Sig Rule Statusread
  • and 1 more in this area
Admin roles6
  • zscaler_zia.admin_roles.createAdd Rolewrite
  • zscaler_zia.admin_roles.getGet Roleread
  • zscaler_zia.admin_roles.listGet Rolesread
  • zscaler_zia.admin_roles.lite_listGet Role Summaryread
  • zscaler_zia.admin_roles.deleteDelete Roledestructive
  • zscaler_zia.admin_roles.updateUpdate Rolewrite
Admin users6
  • zscaler_zia.admin_users.convert_to_userConvert Admin To End Userwrite
  • zscaler_zia.admin_users.createAdd Admin Userwrite
  • zscaler_zia.admin_users.listGet Admin Usersread
  • zscaler_zia.admin_users.me_getGet Current Userread
  • zscaler_zia.admin_users.deleteDelete Admin Userdestructive
  • zscaler_zia.admin_users.updateUpdate Admin Userwrite
Bandwidth classes6
  • zscaler_zia.bandwidth_classes.createAdd Bandwidth Classwrite
  • zscaler_zia.bandwidth_classes.getGet Bandwidth Classread
  • zscaler_zia.bandwidth_classes.listGet Bandwidth Classesread
  • zscaler_zia.bandwidth_classes.lite_listGet Bandwidth Classes Summaryread
  • zscaler_zia.bandwidth_classes.deleteDelete Bandwidth Classdestructive
  • zscaler_zia.bandwidth_classes.updateUpdate Bandwidth Classwrite
Bandwidth control rules6
  • zscaler_zia.bandwidth_control_rules.createAdd Rulewrite
  • zscaler_zia.bandwidth_control_rules.getGet Rule By IDread
  • zscaler_zia.bandwidth_control_rules.listGet Rulesread
  • zscaler_zia.bandwidth_control_rules.lite_listGet Summaryread
  • zscaler_zia.bandwidth_control_rules.deleteDelete Ruledestructive
  • zscaler_zia.bandwidth_control_rules.updateUpdate Rulewrite
Casb DLP rules6
  • zscaler_zia.casb_dlp_rules.all_listGet All DLP Rulesread
  • zscaler_zia.casb_dlp_rules.createAdd Rulewrite
  • zscaler_zia.casb_dlp_rules.getGet Rule By IDread
  • zscaler_zia.casb_dlp_rules.listGet Rulesread
  • zscaler_zia.casb_dlp_rules.deleteDelete Ruledestructive
  • zscaler_zia.casb_dlp_rules.updateUpdate Rulewrite
Casb malware rules6
  • zscaler_zia.casb_malware_rules.all_listGet All Malware Rulesread
  • zscaler_zia.casb_malware_rules.createAdd Rulewrite
  • zscaler_zia.casb_malware_rules.getGet Rule By IDread
  • zscaler_zia.casb_malware_rules.listGet Rulesread
  • zscaler_zia.casb_malware_rules.deleteDelete Ruledestructive
  • zscaler_zia.casb_malware_rules.updateUpdate Rulewrite
Custom file types6
  • zscaler_zia.custom_file_types.count_getGet Custom File Type Countread
  • zscaler_zia.custom_file_types.createCreate Custom File Typewrite
  • zscaler_zia.custom_file_types.getGet Custom File Type By IDread
  • zscaler_zia.custom_file_types.listGet All Custom File Typesread
  • zscaler_zia.custom_file_types.deleteDelete Custom File Typedestructive
  • zscaler_zia.custom_file_types.updateUpdate Custom File Typewrite

DLP endpoint resource 6DNS gateways 6Domain profiles 6End point DLP resource groups 6Extranet 6File type rules 6Firewall filtering rules 6Gre tunnels 6Integration partners 6Network application groups 6Network service groups 6Network services 6Proxies 6Risk profiles 6Rule labels 6SSL settings 6Static ip 6Tenancy restriction profile 6URL filtering rules 6VPN credentials 6Web DLP rules 6Alert definitions 5Apps services 5Auth settings 5Cloud application instances 5Cloud to cloud ir 5DLP notification templates 5Firewall DNS rules 5Firewall ips rules 5Forwarding rules 5NSS servers 5Root certificates 5Sandbox rules 5Security 5SSL inspection rules 5Time intervals 5Virtual zen clusters 5Virtual zen nodes 5Workload groups 5Zpa gateways 5Alert subscriptions 4Browser control settings 4Casb tenant 4Cloud applications 4DC exclusions 4Dnat rules 4DNS application groups 4Eventlog entry report 4HTTP header action profile 4HTTP header profile 4Iot discovery 4Isolation votiro CDR 4NSS collectors 4SSL certificates 4Auditlog entry report 3Behavioral analysis advanced settings 3Config audit 3Device groups 3Icap servers 3Idmprofile 3Incident receiver servers 3Ipv6config 3Region 3Subclouds 3User confirmation 3Vips 3Adaptive access profiles 2Advanced settings 2Advanced URL filter and cloud app settings 2Devices 2DLP exact data match schemas 2Eun 2Eun template 2Eusa status 2FTP settings 2Malware policy 2Mobile advance threat settings 2Network applications 2Org information 2Password expiry 2Proxy gateways 2Remote assistance 2Sandbox 2Shadow it 2SMPC instance 2Status 2Time windows 2Web DLP global options 2Browser isolation 1Casb email label 1Custom tags 1Datacenters 1Dedicated ip gateways 1File type categories 1Org provisioning 1Quarantine tombstone template 1Subscriptions 1URL lookup 1

This index shows a sample of each area. All 625 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Zscaler Internet Access (ZIA) MCP server, answered.

Is there a Zscaler Internet Access (ZIA) MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 625 Zscaler Internet Access (ZIA) actions across intermediate ca certificate, alert rule configuration, end point applications and locations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Zscaler Internet Access (ZIA).

What do I need to connect Zscaler Internet Access (ZIA)?

Client ID of a ZIdentity API client (ZIdentity Admin Portal > Integration > API Clients > Add API Client,… and The API client's secret, shown once when it is created. Plus your getresponse, your request and your tenant host. The free call account { op: "connections.requirements", service: "zscaler_zia" } lists exactly what to paste.

Can an AI agent delete or change things in Zscaler Internet Access (ZIA)?

Only if its key allows it, and only with an explicit confirmation. 81 Zscaler Internet Access (ZIA) actions are destructive, including delete User, delete Group and delete Proxy. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Zscaler Internet Access (ZIA) API limit?

actionlake paces every call to the limits in the Zscaler Internet Access (ZIA) service file: 1 calls a second per connection. Repeated reads are answered from cache (334 Zscaler Internet Access (ZIA) actions can be), which never reaches Zscaler Internet Access (ZIA).

What does a Zscaler Internet Access (ZIA) action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (625 Zscaler Internet Access (ZIA) actions page). Cache hits, searches, dry runs and calls Zscaler Internet Access (ZIA) refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Zscaler Internet Access (ZIA) API does it cover?

The ZIA API v1 via Zscaler OneAPI (https://api.zsapi.net/zia/api/v1) at api.zsapi.net/zia/api/v1. It is built from Zscaler Internet Access (ZIA)'s documentation as read on 23 October 2026. 625 actions in 128 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Zscaler Internet Access (ZIA) data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Zscaler Internet Access (ZIA) credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Zscaler Internet Access (ZIA)

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Zscaler Internet Access (ZIA); the name is the vendor's own. Counts are from the Zscaler Internet Access (ZIA) service file, version 1.0.0.

Give your agent Zscaler Internet Access (ZIA) today.

Connect Zscaler Internet Access (ZIA) freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.