Skip to main content

​
About Zscaler ZDX (Legacy API Key)

Zscaler Digital Experience (ZDX) monitors end-user experience from the device outward: application scores, device health, network paths, and alerts.
This integration authenticates with a legacy ZDX API key (Key ID and Key Secret from the ZDX Admin Portal). Zscaler now serves ZDX through OneAPI, and tenants that never created a legacy key cannot create one today. If your Zscaler tenant uses ZIdentity API clients, connect ZDX through the Zscaler integration instead: grant the API client the ZDX resource and the ZDX workflows run on that connection. Existing connections made with this integration keep working and need no migration.
A legacy ZDX API key cannot call ZIA, ZPA, or Client Connector endpoints, and a ZIdentity API client cannot authenticate to this integration. Use the Zscaler integration for both when your tenant is on ZIdentity. Authentication: ZDX API key. Serval stores your Key ID and Key Secret, then exchanges them for short-lived tokens during workflow runs. The Key Secret itself is never sent to Zscaler — only a hash derived from it. Data sync: on demand only. Serval does not run a background sync for ZDX; workflows call the ZDX API live.

​
What the Zscaler ZDX (Legacy API Key) integration enables

​
Get your credentials

You need a legacy ZDX API key that already exists on your tenant, or a tenant where the API Keys page still offers key creation. ZDX API access requires a ZDX Advanced or Advanced Plus subscription.
1

Open API Keys in the ZDX Admin Portal

In the ZDX Admin Portal, go to Administration and open API Keys.
2

Create an API key for Serval

Create a new API key. Copy the Key ID and the Key Secret — store the Key Secret before leaving the screen.
3

Record your ZDX cloud

Record the cloud name from your ZDX tenant URL: zdxcloud, zdxbeta, or for government tenants zdxgov (FedRAMP Moderate) or zdxten (FedRAMP High). Most tenants are on zdxcloud.

​
Connect in Serval

1

Open the Zscaler ZDX (Legacy API Key) connect form

In Serval, open the Zscaler ZDX (Legacy API Key) integration and start a new connection.
2

Enter the instance name

Use a name like Production or Corporate.
3

Enter the API key

Paste the ZDX Key ID and Key Secret.
4

Enter the cloud

Leave this blank for zdxcloud. Enter zdxbeta, zdxgov, or zdxten only when your tenant is on that cloud.

​
Verifying the connection

The Zscaler ZDX (Legacy API Key) integration ships health checks that validate authentication and list applications, devices, and ongoing alerts. If a check fails, verify the Key ID, Key Secret, and cloud name, and confirm your subscription includes ZDX API access.

​
Time ranges and pagination

Most ZDX read endpoints default to the last 2 hours when no from/to range is given; timestamps are Unix epoch seconds. Historical alerts are limited to a 14-day range. List endpoints return a next_offset cursor — pass it back as offset until it is null.
Deep traces and score analyses create activity on the target device and count against ZDX processing quotas, so workflows that start them should stop or delete sessions they no longer need.