Skip to main content

​
About Zscaler ZDX

Zscaler Digital Experience (ZDX) monitors end-user experience from the device outward: application scores, device health, network paths, and alerts. Serval connects with a ZDX API key and runs workflows against your tenant on demand. ZDX is separate from the Zscaler OneAPI integration. ZDX uses its own API framework and its own credentials — a ZIdentity API client cannot call the ZDX API, and a ZDX API key cannot call ZIA, ZPA, or Client Connector endpoints. Connect both integrations if your workflows span the products. Authentication: ZDX API key. Serval stores your Key ID and Key Secret, then exchanges them for short-lived tokens during workflow runs. The Key Secret itself is never sent to Zscaler — only a hash derived from it. Data sync: on demand only. Serval does not run a background sync for ZDX; workflows call the ZDX API live.

​
What the Zscaler ZDX integration enables

​
Get your credentials

You need a ZDX API key. ZDX API access requires a ZDX Advanced or Advanced Plus subscription.
1

Open API Keys in the ZDX Admin Portal

In the ZDX Admin Portal, go to Administration and open API Keys.
2

Create an API key for Serval

Create a new API key. Copy the Key ID and the Key Secret — store the Key Secret before leaving the screen.
3

Record your ZDX cloud

Record the cloud name from your ZDX tenant URL: zdxcloud, zdxbeta, or for government tenants zdxgov (FedRAMP Moderate) or zdxten (FedRAMP High). Most tenants are on zdxcloud.

​
Connect in Serval

1

Open the Zscaler ZDX connect form

In Serval, open the Zscaler ZDX integration and start a new connection.
2

Enter the instance name

Use a name like Production or Corporate.
3

Enter the API key

Paste the ZDX Key ID and Key Secret.
4

Enter the cloud

Leave this blank for zdxcloud. Enter zdxbeta, zdxgov, or zdxten only when your tenant is on that cloud.

​
Verifying the connection

The Zscaler ZDX integration ships health checks that validate authentication and list applications, devices, and ongoing alerts. If a check fails, verify the Key ID, Key Secret, and cloud name, and confirm your subscription includes ZDX API access.

​
Time ranges and pagination

Most ZDX read endpoints default to the last 2 hours when no from/to range is given; timestamps are Unix epoch seconds. Historical alerts are limited to a 14-day range. List endpoints return a next_offset cursor — pass it back as offset until it is null.
Deep traces and score analyses create activity on the target device and count against ZDX processing quotas, so workflows that start them should stop or delete sessions they no longer need.