zscaler-sdk-python 1.11.0__tar.gz → 1.11.1__tar.gz

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.11.0
+Version: 1.11.1
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -716,6 +716,20 @@ The header `x-ratelimit-reset` is returned in the API response for each API call
 * [ZIA Rate Limiting][rate-limiting-zia] for rate limiting requirements.
 * [ZPA Rate Limiting][rate-limiting-zpa] for rate limiting requirements.
 
+## ZPA Update Responses
+
+ZPA update endpoints return `204 No Content`. In that case the SDK returns an object that carries only the `id`;
+its other attributes are model defaults, not data returned by the API. Use `response.get_status()` to detect this,
+and call the matching `get_*` method to read the updated resource:
+
+```py
+segment, response, err = client.zpa.application_segment.update_segment(segment_id, description="new description")
+if err:
+    ...
+if response.get_status() == 204:
+    segment, _, err = client.zpa.application_segment.get_segment(segment_id)
+```
+
 ## Pagination
 
 The pagination system in this SDK is unified across `ZCC`, `ZTW`, `ZDX`, `ZIA`, `ZPA`, `ZWA`, `ZCell`

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/README.md

@@ -677,6 +677,20 @@ The header `x-ratelimit-reset` is returned in the API response for each API call
 * [ZIA Rate Limiting][rate-limiting-zia] for rate limiting requirements.
 * [ZPA Rate Limiting][rate-limiting-zpa] for rate limiting requirements.
 
+## ZPA Update Responses
+
+ZPA update endpoints return `204 No Content`. In that case the SDK returns an object that carries only the `id`;
+its other attributes are model defaults, not data returned by the API. Use `response.get_status()` to detect this,
+and call the matching `get_*` method to read the updated resource:
+
+```py
+segment, response, err = client.zpa.application_segment.update_segment(segment_id, description="new description")
+if err:
+    ...
+if response.get_status() == 204:
+    segment, _, err = client.zpa.application_segment.get_segment(segment_id)
+```
+
 ## Pagination
 
 The pagination system in this SDK is unified across `ZCC`, `ZTW`, `ZDX`, `ZIA`, `ZPA`, `ZWA`, `ZCell`

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.11.0"
+version = "1.11.1"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.11.0"
+__version__ = "1.11.1"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zia/shadow_it_report.py

@@ -19,7 +19,7 @@ from typing import List, Optional
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.types import APIResult
-from zscaler.utils import convert_keys, format_url
+from zscaler.utils import format_url
 from zscaler.zia.models.shadow_it_report import CloudapplicationsAndTags
 
 
@@ -258,7 +258,7 @@ class ShadowITAPI(APIClient):
         result = self.form_response_body(body) if body else {}
         return (result, response, None)
 
-    def export_shadow_it_report(self, duration: str = "LAST_1_DAYS", **kwargs) -> APIResult[dict]:
+    def export_shadow_it_report(self, duration: str = "LAST_1_DAYS", **kwargs) -> APIResult[str]:
         """
         Export the Shadow IT Report (in CSV format) for the cloud applications recognized by Zscaler
         based on their usage in your organisation.
@@ -441,12 +441,12 @@ class ShadowITAPI(APIClient):
                 ``BITS_3072``, ``BITS_384``, ``BITS_4096``, ``BITS_1024``.
 
         Returns:
-            :obj:`str`: The Shadow IT Report in CSV format.
+            :obj:`Tuple`: A tuple containing (CSV report as ``str``, Response, error)
 
         Examples:
             Export the Shadow IT Report for the last 7 days::
 
-                report = zia.shadow_it.export_shadow_it_report('LAST_7_DAYS')
+                report, _, err = client.zia.shadow_it_report.export_shadow_it_report(duration="LAST_7_DAYS")
 
         Notes:
             Zscaler has a rate limit of 1 report per-minute, ensure you take this into account when calling this method.
@@ -459,28 +459,21 @@ class ShadowITAPI(APIClient):
         """)
 
         payload = {"duration": duration}
-        payload.update(kwargs)  # Update the payload with kwargs
-        convert_keys(payload)  # Convert keys after updating
-
-        body = {}
-        headers = {"Accept": "text/csv"}  # Explicitly request a CSV response
+        payload.update(kwargs)
 
-        # Creating the request
-        request, error = self._request_executor.create_request(http_method, api_url, body, headers)
+        headers = {"Accept": "text/csv"}
 
+        request, error = self._request_executor.create_request(http_method, api_url, payload, headers)
         if error:
-            return (None, error)
+            return (None, None, error)
 
-        # Executing the request
         response, error = self._request_executor.execute(request)
-
         if error:
-            return (response.get_body(), error)
+            return (None, response, error)
 
-        # Return the CSV content directly
-        return (response.get_body(), None)
+        return (response.get_body(), response, None)
 
-    def export_shadow_it_csv(self, application: str, entity: str, duration: str = "LAST_1_DAYS", **kwargs):
+    def export_shadow_it_csv(self, application: str, entity: str, duration: str = "LAST_1_DAYS", **kwargs) -> APIResult[str]:
         """
         Export the Shadow IT Report (in CSV format) for the list of users or known locations
         identified with using the cloud applications specified in the request. The report
@@ -529,12 +522,14 @@ class ShadowITAPI(APIClient):
                 ``id`` and ``name`` fields specify the department information.
 
         Returns:
-            :obj:`str`: The Shadow IT Report in CSV format.
+            :obj:`Tuple`: A tuple containing (CSV report as ``str``, Response, error)
 
         Examples:
-            Export the Shadow IT Report for GitHub the last 15 days::
+            Export the Shadow IT Report for GitHub users over the last 15 days::
 
-                report = zia.shadow_it.export_shadow_it_report(application="Github", duration="LAST_15_DAYS")
+                report, _, err = client.zia.shadow_it_report.export_shadow_it_csv(
+                    application="Github", entity="USER", duration="LAST_15_DAYS"
+                )
 
         Notes:
             Zscaler has a rate limit of 1 report per-minute, ensure you take this into account when calling this method.
@@ -551,20 +546,15 @@ class ShadowITAPI(APIClient):
                 payload[key] = self._convert_ids_to_dict_list(id_list)
 
         payload.update(kwargs)
-        convert_keys(payload)
 
-        body = {}
         headers = {"Accept": "text/csv"}
-        params = {}
-
-        request, error = self._request_executor.create_request(http_method, api_url, body, headers, params=params)
 
+        request, error = self._request_executor.create_request(http_method, api_url, payload, headers)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
-
         if error:
-            return (response.get_body(), error)
+            return (None, response, error)
 
-        return (response.get_body(), None)
+        return (response.get_body(), response, None)

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/app_connector_groups.py

@@ -290,8 +290,9 @@ class AppConnectorGroupAPI(APIClient):
                 The version profile to use. This will automatically set ``override_version_profile`` to True.
                 Accepted values are:
                 ``default``, ``previous_default`` and ``new_release``
-            **enrollment_cert_id (str): ID of the enrollment certificate used for OAuth2 enrollment. 
-                If not set, the provider will automatically look up the "Connector" enrollment certificate by name and populate this attribute for you.
+            **enrollment_cert_id (str): ID of the enrollment certificate used to sign App Connector enrollment.
+                The SDK does not look this up for you; retrieve it with
+                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Connector"})``.
 
         Returns:
             :obj:`Tuple`: A tuple containing (AppConnectorGroup, Response, error)

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/app_segments_ba.py

@@ -272,9 +272,6 @@ class ApplicationSegmentBAAPI(APIClient):
         microtenant_id = kwargs.get("microtenant_id") or body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         # --- Prevent mixed legacy + structured port range usage ---
         if "tcp_port_ranges" in body and "tcp_port_range" in body:
             return None, None, ValueError("Cannot use both 'tcp_port_ranges' and 'tcp_port_range' in the same request.")
@@ -315,6 +312,9 @@ class ApplicationSegmentBAAPI(APIClient):
         """
         Update an existing browser access application segment.
 
+        Port fields (``tcp_port_range(s)`` / ``udp_port_range(s)``) that are omitted are sent as empty
+        lists and therefore cleared. To keep the existing ports, pass them on every update.
+
         See the
         `Updating Application Segments Using API reference:
         <https://help.zscaler.com/zpa/application-segment-management#/mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}-put>`_
@@ -409,9 +409,6 @@ class ApplicationSegmentBAAPI(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         if "clientless_app_ids" in body:
             clientless_apps = body.pop("clientless_app_ids")
 

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/app_segments_ba_v2.py

@@ -253,10 +253,6 @@ class AppSegmentsBAV2API(APIClient):
         microtenant_id = kwargs.get("microtenant_id") or body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        # Reformat server_group_ids to match the expected API format (serverGroups)
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         # Auto-add `"app_types": ["BROWSER_ACCESS"]` if missing
         common_apps_dto = kwargs.get("common_apps_dto")
         if common_apps_dto and "apps_config" in common_apps_dto:
@@ -300,6 +296,9 @@ class AppSegmentsBAV2API(APIClient):
         """
         Update an existing browser access application segment.
 
+        Port fields (``tcp_port_range(s)`` / ``udp_port_range(s)``) that are omitted are sent as empty
+        lists and therefore cleared. To keep the existing ports, pass them on every update.
+
         Args:
             segment_id (str): The unique identifier of the application segment.
 
@@ -357,9 +356,6 @@ class AppSegmentsBAV2API(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": gid} for gid in body.pop("server_group_ids")]
-
         # Auto-add `"app_types": ["BROWSER_ACCESS"]` if missing
         common_apps_dto = kwargs.get("common_apps_dto")
         if common_apps_dto and "apps_config" in common_apps_dto:

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/app_segments_inspection.py

@@ -240,10 +240,6 @@ class AppSegmentsInspectionAPI(APIClient):
         if "udp_port_ranges" in body and "udp_port_range" in body:
             return None, None, ValueError("Cannot use both 'udp_port_ranges' and 'udp_port_range' in the same request.")
 
-        # Reformat server_group_ids to match the expected API format (serverGroups)
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         # Auto-add `"app_types": ["INSPECT"]` if missing
         common_apps_dto = kwargs.get("common_apps_dto")
         if common_apps_dto and "apps_config" in common_apps_dto:
@@ -289,6 +285,9 @@ class AppSegmentsInspectionAPI(APIClient):
         """
         Update an AppProtection application segment.
 
+        Port fields (``tcp_port_range(s)`` / ``udp_port_range(s)``) that are omitted are sent as empty
+        lists and therefore cleared. To keep the existing ports, pass them on every update.
+
         Args:
             segment_id (str):
                 The unique identifier for the AppProtection application segment.
@@ -393,9 +392,6 @@ class AppSegmentsInspectionAPI(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": gid} for gid in body.pop("server_group_ids")]
-
         # Auto-add `"app_types": ["INSPECT"]` if missing
         common_apps_dto = kwargs.get("common_apps_dto")
         if common_apps_dto and "apps_config" in common_apps_dto:

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/app_segments_pra.py

@@ -248,10 +248,6 @@ class AppSegmentsPRAAPI(APIClient):
         microtenant_id = kwargs.get("microtenant_id") or body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        # Reformat server_group_ids to match the expected API format (serverGroups)
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         # Auto-add `"app_types": ["SECURE_REMOTE_ACCESS"]` if missing
         common_apps_dto = kwargs.get("common_apps_dto")
         if common_apps_dto and "apps_config" in common_apps_dto:
@@ -295,6 +291,9 @@ class AppSegmentsPRAAPI(APIClient):
         """
         Update an existing application segment.
 
+        Port fields (``tcp_port_range(s)`` / ``udp_port_range(s)``) that are omitted are sent as empty
+        lists and therefore cleared. To keep the existing ports, pass them on every update.
+
         Args:
             segment_id (str): The unique identifier of the application segment.
 
@@ -353,9 +352,6 @@ class AppSegmentsPRAAPI(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": gid} for gid in body.pop("server_group_ids")]
-
         common_apps_dto = kwargs.get("common_apps_dto")
         if common_apps_dto and "apps_config" in common_apps_dto:
             for app_config in common_apps_dto["apps_config"]:

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/application_segment.py

@@ -270,9 +270,6 @@ class ApplicationSegmentAPI(APIClient):
         microtenant_id = kwargs.get("microtenant_id") or body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         # --- Prevent mixed legacy + structured port range usage ---
         if "tcp_port_ranges" in body and "tcp_port_range" in body:
             return None, None, ValueError("Cannot use both 'tcp_port_ranges' and 'tcp_port_range' in the same request.")
@@ -313,6 +310,9 @@ class ApplicationSegmentAPI(APIClient):
         """
         Update an existing application segment.
 
+        Port fields (``tcp_port_range(s)`` / ``udp_port_range(s)``) that are omitted are sent as empty
+        lists and therefore cleared. To keep the existing ports, pass them on every update.
+
         See the
         `Updating Application Segments Using API reference:
         <https://help.zscaler.com/zpa/application-segment-management#/mgmtconfig/v1/admin/customers/{customerId}/application/{applicationId}-put>`_
@@ -405,9 +405,6 @@ class ApplicationSegmentAPI(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
-        if "server_group_ids" in body:
-            body["serverGroups"] = [{"id": group_id} for group_id in body.pop("server_group_ids")]
-
         if "clientless_app_ids" in body:
             clientless_apps = body.pop("clientless_app_ids")
 
@@ -418,18 +415,21 @@ class ApplicationSegmentAPI(APIClient):
             if err:
                 return (None, None, f"Error fetching application segment data: {err}")
 
-            matched_segment = next((app for app in segments_list if app.get("appId") == segment_id), None)
-
-            if not matched_segment:
-                return (None, None, f"Error: No matching clientless App found with appId '{segment_id}' in existing segments.")
-
-            clientless_app_id = matched_segment["id"]
-
             body["clientlessApps"] = []
             for app in clientless_apps:
-                app["appId"] = segment_id
-                app["id"] = clientless_app_id
+                matched_segment = next(
+                    (seg for seg in segments_list if seg.domain == app.get("domain") and str(seg.app_id) == segment_id), None
+                )
+
+                if not matched_segment:
+                    return (
+                        None,
+                        None,
+                        f"Error: No matching clientless App found for domain '{app.get('domain')}' in existing segments.",
+                    )
 
+                app["appId"] = segment_id
+                app["id"] = matched_segment.id
                 body["clientlessApps"].append(app)
 
         if "tcp_port_ranges" in body:

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/policies.py

@@ -190,14 +190,14 @@ class PolicySetControllerAPI(APIClient):
             operator = "OR"  # Default operator
 
             # Handle optional operator prefix
-            if isinstance(condition, tuple) and condition[0].upper() in ["AND", "OR"]:
+            if isinstance(condition, (tuple, list)) and condition[0].upper() in ["AND", "OR"]:
                 # Skip operator for chrome_enterprise conditions
-                if not (isinstance(condition[1], tuple) and condition[1][0].lower() == "chrome_enterprise"):
+                if not (isinstance(condition[1], (tuple, list)) and condition[1][0].lower() == "chrome_enterprise"):
                     operator = condition[0].upper()
                 condition = condition[1]
 
             # Process the actual condition
-            if isinstance(condition, tuple):
+            if isinstance(condition, (tuple, list)):
                 object_type = condition[0].lower()
                 values = condition[1:]
 
@@ -763,9 +763,9 @@ class PolicySetControllerAPI(APIClient):
                 A custom message.
             description (str):
                 A description for the rule.
-            re_auth_idle_timeout (int):
+            reauth_idle_timeout (int):
                 The re-authentication idle timeout value in seconds.
-            re_auth_timeout (int):
+            reauth_timeout (int):
                 The re-authentication timeout value in seconds.
         """
         policy_type_response, _, err = self.get_policy("timeout", query_params={"microtenantId": kwargs.get("microtenantId")})
@@ -836,9 +836,9 @@ class PolicySetControllerAPI(APIClient):
                 A custom message.
             description (str):
                 A description for the rule.
-            re_auth_idle_timeout (int):
+            reauth_idle_timeout (int):
                 The re-authentication idle timeout value in seconds.
-            re_auth_timeout (int):
+            reauth_timeout (int):
                 The re-authentication timeout value in seconds.
 
         Returns:
@@ -1305,7 +1305,7 @@ class PolicySetControllerAPI(APIClient):
             "name": name,
             "description": kwargs.get("description"),
             "rule_order": kwargs.get("rule_order"),
-            "action": action.upper(),
+            "action": action.upper() if action else None,
             "zpnIsolationProfileId": zpn_isolation_profile_id,
             "conditions": self._create_conditions_v1(kwargs.pop("conditions", [])),
         }
@@ -1833,6 +1833,8 @@ class PolicySetControllerAPI(APIClient):
         """
         Add a new timeout policy rule.
 
+        The rule action is always ``RE_AUTH``; it is set automatically.
+
         Ensure you are using the correct arguments for the policy type that you want to update.
 
         Args:
@@ -1855,16 +1857,13 @@ class PolicySetControllerAPI(APIClient):
                     ("client_type", ["zpn_client_type_exporter", "zpn_client_type_zapp",
                     "zpn_client_type_browser_isolation", "zpn_client_type_zapp_partner"]),
 
-            action (str):
-                The action for the policy. Accepted values are:
-                |  ``RE_AUTH``
             custom_msg (str):
                 A custom message.
             description (str):
                 A description for the rule.
-            re_auth_idle_timeout (str):
+            reauth_idle_timeout (str):
                 The re-authentication idle timeout value in seconds.
-            re_auth_timeout (str):
+            reauth_timeout (str):
                 The re-authentication timeout value in seconds.
 
         Returns:
@@ -1909,7 +1908,7 @@ class PolicySetControllerAPI(APIClient):
         """
         policy_type_response, _, err = self.get_policy("timeout", query_params={"microtenantId": kwargs.get("microtenantId")})
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'timeout': {err}")
+            return (None, None, f"Error retrieving policy for 'timeout': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -1955,6 +1954,8 @@ class PolicySetControllerAPI(APIClient):
         """
         Update an existing policy rule.
 
+        The rule action is always ``RE_AUTH``; it is set automatically.
+
         Ensure you are using the correct arguments for the policy type that you want to update.
 
         Args:
@@ -1976,16 +1977,13 @@ class PolicySetControllerAPI(APIClient):
                     ("client_type", ["zpn_client_type_exporter", "zpn_client_type_zapp",
                     "zpn_client_type_browser_isolation", "zpn_client_type_zapp_partner"]),
 
-            action (str):
-                The action for the policy. Accepted values are:
-                |  ``RE_AUTH``
             custom_msg (str):
                 A custom message.
             description (str):
                 A description for the rule.
-            re_auth_idle_timeout (str):
+            reauth_idle_timeout (str):
                 The re-authentication idle timeout value in seconds.
-            re_auth_timeout (str):
+            reauth_timeout (str):
                 The re-authentication timeout value in seconds.
 
         Returns:
@@ -2032,7 +2030,7 @@ class PolicySetControllerAPI(APIClient):
         """
         policy_type_response, _, err = self.get_policy("timeout", query_params={"microtenantId": kwargs.get("microtenantId")})
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'timeout': {err}")
+            return (None, None, f"Error retrieving policy for 'timeout': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2156,7 +2154,7 @@ class PolicySetControllerAPI(APIClient):
             "client_forwarding", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'client_forwarding': {err}")
+            return (None, None, f"Error retrieving policy for 'client_forwarding': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2261,7 +2259,7 @@ class PolicySetControllerAPI(APIClient):
             "client_forwarding", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'client_forwarding': {err}")
+            return (None, None, f"Error retrieving policy for 'client_forwarding': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2378,7 +2376,7 @@ class PolicySetControllerAPI(APIClient):
             "isolation", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'isolation': {err}")
+            return (None, None, f"Error retrieving policy for 'isolation': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2504,7 +2502,7 @@ class PolicySetControllerAPI(APIClient):
             "isolation", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'isolation': {err}")
+            return (None, None, f"Error retrieving policy for 'isolation': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2520,7 +2518,7 @@ class PolicySetControllerAPI(APIClient):
             "name": name,
             "description": kwargs.get("description"),
             "rule_order": kwargs.get("rule_order"),
-            "action": action.upper(),
+            "action": action.upper() if action else None,
             "zpnIsolationProfileId": zpn_isolation_profile_id,
             "conditions": self._create_conditions_v2(kwargs.pop("conditions", [])),
         }
@@ -2640,7 +2638,7 @@ class PolicySetControllerAPI(APIClient):
             "inspection", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'inspection': {err}")
+            return (None, None, f"Error retrieving policy for 'inspection': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2763,7 +2761,7 @@ class PolicySetControllerAPI(APIClient):
             "inspection", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'inspection': {err}")
+            return (None, None, f"Error retrieving policy for 'inspection': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -2787,13 +2785,6 @@ class PolicySetControllerAPI(APIClient):
         if action == "inspect":
             payload["zpnInspectionProfileId"] = zpn_inspection_profile_id
 
-        if "conditions" in payload and "conditions" not in kwargs:
-            del payload["conditions"]
-
-        for key, value in kwargs.items():
-            if key == "conditions":
-                payload["conditions"] = self._create_conditions_v2(value)
-
         request, error = self._request_executor.create_request(http_method, api_url, body=payload)
         if error:
             return (None, None, error)
@@ -3040,7 +3031,7 @@ class PolicySetControllerAPI(APIClient):
             "credential", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'credential': {err}")
+            return (None, None, f"Error retrieving policy for 'credential': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -3175,7 +3166,7 @@ class PolicySetControllerAPI(APIClient):
             "capabilities", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'capabilities': {err}")
+            return (None, None, f"Error retrieving policy for 'capabilities': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -3349,9 +3340,7 @@ class PolicySetControllerAPI(APIClient):
         }
 
         for key, value in kwargs.items():
-            if key == "conditions":
-                payload["conditions"] = self._create_conditions_v2(value)
-            elif key == "privileged_capabilities":
+            if key == "privileged_capabilities":
                 capabilities = []
                 priv_caps_map = value
 
@@ -3753,7 +3742,7 @@ class PolicySetControllerAPI(APIClient):
             "clientless", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'browser protection': {err}")
+            return (None, None, f"Error retrieving policy for 'browser protection': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:
@@ -3869,7 +3858,7 @@ class PolicySetControllerAPI(APIClient):
             "clientless", query_params={"microtenantId": kwargs.get("microtenantId")}
         )
         if err or not policy_type_response:
-            return (None, None, "Error retrieving policy for 'Browser Protection': {err}")
+            return (None, None, f"Error retrieving policy for 'Browser Protection': {err}")
 
         policy_set_id = policy_type_response.get("id")
         if not policy_set_id:

{zscaler_sdk_python-1.11.0 → zscaler_sdk_python-1.11.1}/zscaler/zpa/service_edge_group.py

@@ -191,8 +191,9 @@ class ServiceEdgeGroupAPI(APIClient):
                 Indicates the grace distance unit of measure in miles or kilometers.
                 This value is only required if graceDistanceEnabled is set to true.
                 Supported Values: `MILES`, `KMS`
-            **enrollment_cert_id (str): ID of the enrollment certificate used for OAuth2 enrollment. 
-                If not set, the provider will automatically look up the "Service Edge" enrollment certificate by name and populate this attribute for you.
+            **enrollment_cert_id (str): ID of the enrollment certificate used to sign Service Edge enrollment.
+                The SDK does not look this up for you; retrieve it with
+                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Service Edge"})``.
 
         Returns:
             :obj:`Tuple`: ServiceEdgeGroup: The newly created service edge group object.