> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Zscaler ZDX

> Connect Zscaler Digital Experience to Serval with a ZDX API key so workflows can read device health, application scores, alerts, and run deep traces.

## About Zscaler ZDX

Zscaler Digital Experience (ZDX) monitors end-user experience from the device outward: application scores, device health, network paths, and alerts. Serval connects with a ZDX API key and runs workflows against your tenant on demand.

ZDX is separate from the Zscaler OneAPI integration. ZDX uses its own API framework and its own credentials — a ZIdentity API client cannot call the ZDX API, and a ZDX API key cannot call ZIA, ZPA, or Client Connector endpoints. Connect both integrations if your workflows span the products.

**Authentication:** ZDX API key. Serval stores your Key ID and Key Secret, then exchanges them for short-lived tokens during workflow runs. The Key Secret itself is never sent to Zscaler — only a hash derived from it.

**Data sync:** on demand only. Serval does not run a background sync for ZDX; workflows call the ZDX API live.

## What the Zscaler ZDX integration enables

| Capability                | Description                                                                                                      |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Look up users and devices | Find a user's active devices by name or email, with hardware, network, and software details.                     |
| Read application scores   | List monitored applications with ZDX scores, score trends, and metric trends such as Page Fetch Time or latency. |
| Inspect device health     | Read a device's CPU, memory, disk, network, and Wi-Fi health metrics, plus configuration change events.          |
| Review probes             | List web and Cloud Path probes per device and application, including hop-by-hop path data.                       |
| Triage alerts             | List ongoing and historical alerts and the devices each alert affects.                                           |
| Run deep traces           | Start, poll, and stop deep trace sessions on a device, and read captured top processes.                          |
| Analyze scores            | Start and read ZDX score analyses for an application on a device.                                                |
| Audit software inventory  | List software across the tenant and the users and devices that have a specific package installed.                |

## Get your credentials

You need a ZDX API key. ZDX API access requires a ZDX Advanced or Advanced Plus subscription.

<Steps>
  <Step title="Open API Keys in the ZDX Admin Portal">
    In the ZDX Admin Portal, go to Administration and open API Keys.
  </Step>

  <Step title="Create an API key for Serval">
    Create a new API key. Copy the Key ID and the Key Secret — store the Key Secret before leaving
    the screen.
  </Step>

  <Step title="Record your ZDX cloud">
    Record the cloud name from your ZDX tenant URL: `zdxcloud`, `zdxbeta`, or for government
    tenants `zdxgov` (FedRAMP Moderate) or `zdxten` (FedRAMP High). Most tenants are on
    `zdxcloud`.
  </Step>
</Steps>

## Connect in Serval

<Steps>
  <Step title="Open the Zscaler ZDX connect form">
    In Serval, open the Zscaler ZDX integration and start a new connection.
  </Step>

  <Step title="Enter the instance name">Use a name like `Production` or `Corporate`.</Step>
  <Step title="Enter the API key">Paste the ZDX Key ID and Key Secret.</Step>

  <Step title="Enter the cloud">
    Leave this blank for `zdxcloud`. Enter `zdxbeta`, `zdxgov`, or `zdxten` only when your tenant
    is on that cloud.
  </Step>
</Steps>

## Verifying the connection

The Zscaler ZDX integration ships health checks that validate authentication and list applications, devices, and ongoing alerts. If a check fails, verify the Key ID, Key Secret, and cloud name, and confirm your subscription includes ZDX API access.

## Time ranges and pagination

Most ZDX read endpoints default to the last 2 hours when no `from`/`to` range is given; timestamps are Unix epoch seconds. Historical alerts are limited to a 14-day range. List endpoints return a `next_offset` cursor — pass it back as `offset` until it is null.

<Note>
  Deep traces and score analyses create activity on the target device and count against ZDX
  processing quotas, so workflows that start them should stop or delete sessions they no longer
  need.
</Note>