> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/network-security/zscaler/zscaler-nss-on-prem/execute-response-actions-with-zscaler-oneapi.md).

# Execute Response Actions with Zscaler OneAPI

In this guide, you will create an API role in Zscaler Internet Access (ZIA), register an API client in ZIdentity, and configure the Zscaler OneAPI action connector in Radiant Security to enable URL containment and remediation tasks.

<details>

<summary><i class="fa-bolt-lightning">:bolt-lightning:</i> <mark style="color:red;">Available actions</mark></summary>

The following actions are available after you set up the Zscaler OneAPI action connector. Additional permissions are required.

* Block URL
* Unblock URL

</details>

At the end of this configuration, you will provide Radiant Security with these values:

* **Client ID**
* **Client Secret**
* **Vanity Domain**

This article walks you through three steps:

* Create an API role in ZIA
* Register an API client in ZIdentity
* Add the Zscaler OneAPI action connector in Radiant Security

### Prerequisites

* [ ] Super Administrator access to ZIA and Admin access to ZIdentity
* [ ] Environment migrated to the Zscaler ZIdentity platform. Legacy NSS-based tenants are not supported.
* [ ] Zscaler Internet Access (ZIA) with Advanced Threat Protection license

### Create an API role in ZIA

1. Log in to the [Zscaler Experience Center](https://console.zscaler.com) (or the legacy ZIA Admin Portal, depending on your tenant).
2. Navigate to **Administration** > **Role Management**.
3. Click **Add API Role**.
4. Enter a **Name** for the role (e.g. `Radiant_Security_API_Role`). Note this name - you will need it when assigning the role in ZIdentity.
5. Under **Permissions**, set the following:

   <table><thead><tr><th width="280">Functional Scope</th><th>Permission</th></tr></thead><tbody><tr><td>Cyber Threat Protection</td><td>View, Edit</td></tr></tbody></table>
6. Save and **activate** the change in the Zscaler Experience Center.

{% hint style="info" %}
**Note:** API roles created in ZIA are synced to ZIdentity automatically. If the role does not appear in ZIdentity immediately, navigate to **Administration** > **API Configuration** > **OneAPI** > **API Resources** in the ZIdentity Admin Console and click **Sync Now**.
{% endhint %}

### Register an API client in ZIdentity

1. Log in to the ZIdentity Admin Console.
2. Navigate to **Administration** > **API Configuration** > **OneAPI** > **API Clients**.
3. Click **Add API Client**. The **Add API Client** drawer opens with the **Client** tab selected by default.
4. On the **Client** tab, enter the following:
   * **Name**: An identifier for the client (e.g. `Radiant Security OneAPI Client`)
   * **Description**: A brief description of the client's purpose
   * **Status**: Enabled
   * **Access Token Validity**: The token lifetime in minutes. Minimum is 1 minute; maximum is 24 hours (1440 minutes).
5. Under **Client Authentication**, select **Secret** and click **Add**. ZIdentity auto-generates a secret key and displays it once.
6. Set the validity period for the secret. Minimum is 30 days; maximum is 365 days.
7. Copy the **Client Secret** and store it securely.

{% hint style="warning" %}
**Important note:** Be sure to document and store the **Client Secret** carefully, as it cannot be retrieved later. You can configure a maximum of two client secrets per API client; adding a third replaces the oldest.
{% endhint %}

8. Click the **Resources** tab.
9. Under **Internet & SaaS**, select the API role you created in Create an API role in ZIA.
10. Click **Save**.
11. On the **API Clients** page, locate the newly configured client and click the **Edit** icon.
12. Copy and store the following values:
    * **Client ID**
    * **Vanity Domain**: The domain prefix used in your ZIdentity login URL (Typically in the format `https://<vanity_domain>.zslogin.net`).

#### Add the Zscaler OneAPI action connector in Radiant Security

1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, select **Settings** > **Action Connectors** and click **+ Add Connector**.
3. Select **Zscaler OneAPI** from the vendor list.
4. Under **Credential Name**, give the credential an identifiable name (e.g. `Zscaler OneAPI Credentials`).
5. Enter the **Client ID**, **Client Secret**, and **Vanity Domain** values from the previous section.
6. Click **Add Connector** to save.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/network-security/zscaler/zscaler-nss-on-prem/execute-response-actions-with-zscaler-oneapi.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.