--- title: "Zscaler" slug: "zscaler-zia" updated: 2026-05-22T14:17:21Z published: 2026-05-22T14:17:21Z canonical: "help.calero.com/zscaler-zia" excludeFromExternalSearch: true --- > ## Documentation Index > Fetch the complete documentation index at: https://help.calero.com/llms.txt > Use this file to discover all available pages before exploring further. # Zscaler This is a Vendor Integration. --- ## Collect Required Information from Vendor > [!TIP] > IMPORTANT! > > You must meet the following prerequisites before you can continue. > > - You must have a subscription to OneAPI and ZIdentity. > - To obtain access to these services, contact your Zscaler Account team. > - The administrator who will configure the required API roles must be assigned to a role that has full permission to **Administration > API Key management** in the ZIA Admin Portal. > - To learn more, refer to [Adding Admin Roles](https://help.zscaler.com/zia/adding-admin-roles). > - ZIdentity administrators assigned with **Full permission to access the API Clients and API Resources modules** can configure API clients in the ZIdentity Admin Portal. > - To learn more, refer to [Admin Roles and Permissions](https://help.zscaler.com/zidentity/admin-roles-and-permissions). ### Obtain the Vanity Domain 1. Determine the Zscaler domain name for your account. > [!NOTE] > EXAMPLE: > > If your domain is acme.zslogin.net, “acme” would be your vanity domain. 2. Copy/save the following field(s) for use when onboarding this Integration: - **Vanity Domain** (i.e., the subdomain of the URL) ### Set Up the API Role 1. In ZIdentity Admin portal, go to **Administration > Role Management**. 2. Select **Add API Role**. 3. In the Add API Role window, enter the following: - **Name** — Enter a name for the API role. - **Scope** — Assign **View Only Permissions** to all categories. 4. Select **Save** and then follow instructions to [activate the change](https://help.zscaler.com/unified/saving-and-activating-changes-admin-console). ### Obtain the Client ID and Client Secret 1. In ZIdentity Admin portal, go to **Integration > API Clients**. 2. Select **Add API Client**. 3. On the **Add API Client** page, the **Client** tab is selected by default. 4. In the **Client Information** section, enter the following details: ![](https://cdn.us.document360.io/fb224436-75bb-46fa-9a8f-b669516b6929/Images/Documentation/image-8H72XG8K.png?sv=2026-02-06&spr=https&st=2026-10-26T09%3A01%3A52Z&se=2026-10-26T10%3A01%3A52Z&sr=c&sp=r&sig=0KN3pw1vrMHu4aihvsByzeF38dlBwfsVP4RutgxPrig%3D) - **Name** —Enter a name to identify the API client. - **Description** — Enter a brief description that indicates the purpose of the API client (example: a software application or a script that is using this name to interact with OneAPI). - **Status** — Enable the status. This allows the API client to authenticate and use the API resources. - When the status is disabled, the API client cannot get the access tokens issued by ZIdentity. - **Access Token Lifetime** — The validity of the access token that is used to access the API resource. - Enter the time in minutes. - The minimum and maximum validity periods are 1 minute and 24 hours, respectively. 5. In the **Client Authentication** section, select **Add** to configure the secret authentication method. ![](https://cdn.us.document360.io/fb224436-75bb-46fa-9a8f-b669516b6929/Images/Documentation/image-A7O65PY6.png?sv=2026-02-06&spr=https&st=2026-10-26T09%3A01%3A52Z&se=2026-10-26T10%3A01%3A52Z&sr=c&sp=r&sig=0KN3pw1vrMHu4aihvsByzeF38dlBwfsVP4RutgxPrig%3D) - A key is auto-generated and displayed along with the validity period. - This key is generated once, and it cannot be updated. - The minimum duration is 30 days, and the maximum duration is 365 days. - Copy the secret key and save it in your local folder as it is not going to be displayed again. You can add a maximum of two client secrets. If you add a third one, the new value replaces the most recent client secret. So, at any point in time, there are only two client secrets. 6. Go to the **Resources** tab and select the [role you created earlier](/v1/docs/zscaler-zia#set-up-the-api-role). ![](https://cdn.us.document360.io/fb224436-75bb-46fa-9a8f-b669516b6929/Images/Documentation/image-O9SY5KM6.png?sv=2026-02-06&spr=https&st=2026-10-26T09%3A01%3A52Z&se=2026-10-26T10%3A01%3A52Z&sr=c&sp=r&sig=0KN3pw1vrMHu4aihvsByzeF38dlBwfsVP4RutgxPrig%3D) 7. Select **Save**. - When you save the API client details, ZIdentity auto-generates a **Client ID** and it is displayed on the **API Clients** page. 8. Copy/save the following fields for use when onboarding this Integration: > [!WARNING] > NOTE: > > You can also copy the client ID from the **Edit API Client** window. > > 1. On the API Clients page, select the **Edit** icon for the newly configured API client. > 2. In the Edit API Client window, copy the Client ID and save it in your local folder. - **Client ID** - **Client Secret** (generated in step 5 above) ## Onboard This Integration 1. Go to **SaaS Management > Applications.** 2. Select **Add Integration**. 3. From the **Vendors** tab, select the card with the **vendor's name.** 4. From the **API** tab, enter the field(s) you copy/saved above. 5. If your company has more than one instance (or “tenant”) of this application, you will also be prompted for a **Connection Alias**. 6. Select the **Authorize** button. > [!TIP] > SUCCESS! > > You will now be redirected to the [Integrations](/v1/docs/integrations) page in Calero.com, where the data sync will continue in the background, and you can monitor progress. --- SUGGESTION: Access Help through your Calero.com instance if links between articles return errors or if there are fewer sections in the Help menu than expected. Doing so will ensure you see *all* Help articles.