zscaler-sdk-python 1.11.1__tar.gz → 1.11.3__tar.gz

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.11.1
+Version: 1.11.3
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -1079,6 +1079,8 @@ Higher numbers win. In other words, configuration passed via the constructor wil
 
 **NOTE:** This option is only supported for OneAPI Zidentity credentials at the moment.
 
+> **Security note:** TLS verification (`sslContext`) can only be set in the configuration passed to the constructor; it is ignored in `zscaler.yaml` files. The SDK logs a warning when it applies a `zscaler.yaml` from the current working directory and whenever TLS verification is disabled. Only run the SDK from directories whose configuration files you trust.
+
 ### YAML configuration
 
 When you use an API Token instead of OAuth 2.0 the full YAML configuration looks like:
@@ -1145,7 +1147,7 @@ Each one of the configuration values above can be turned into an environment var
 | `proxyHost`       | _(String)_ HTTP proxy host  | `ZSCALER_CLIENT_PROXY_HOST` |
 | `proxyUsername`       | _(String)_ HTTP proxy username  | `ZSCALER_CLIENT_PROXY_USERNAME` |
 | `proxyPassword`       | _(String)_ HTTP proxy password  | `ZSCALER_CLIENT_PROXY_PASSWORD` |
-| `disableHttpsCheck`       | _(String)_ Disable SSL checks  | `ZSCALER_TESTING_TESTINGDISABLEHTTPSCHECK` |
+| `sslContext`       | _(Boolean or String)_ TLS certificate verification: `True` (default), `False` (testing only), or a CA bundle path. Constructor only; ignored in YAML files. | _(none)_ |
 | `sandboxToken`       | _(String)_ The Zscaler Internet Access Sandbox Token | `ZSCALER_SANDBOX_TOKEN` |
 | `sandboxCloud`       | _(String)_ The Zscaler Internet Access Sandbox cloud name | `ZSCALER_SANDBOX_CLOUD` |
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/README.md

@@ -1040,6 +1040,8 @@ Higher numbers win. In other words, configuration passed via the constructor wil
 
 **NOTE:** This option is only supported for OneAPI Zidentity credentials at the moment.
 
+> **Security note:** TLS verification (`sslContext`) can only be set in the configuration passed to the constructor; it is ignored in `zscaler.yaml` files. The SDK logs a warning when it applies a `zscaler.yaml` from the current working directory and whenever TLS verification is disabled. Only run the SDK from directories whose configuration files you trust.
+
 ### YAML configuration
 
 When you use an API Token instead of OAuth 2.0 the full YAML configuration looks like:
@@ -1106,7 +1108,7 @@ Each one of the configuration values above can be turned into an environment var
 | `proxyHost`       | _(String)_ HTTP proxy host  | `ZSCALER_CLIENT_PROXY_HOST` |
 | `proxyUsername`       | _(String)_ HTTP proxy username  | `ZSCALER_CLIENT_PROXY_USERNAME` |
 | `proxyPassword`       | _(String)_ HTTP proxy password  | `ZSCALER_CLIENT_PROXY_PASSWORD` |
-| `disableHttpsCheck`       | _(String)_ Disable SSL checks  | `ZSCALER_TESTING_TESTINGDISABLEHTTPSCHECK` |
+| `sslContext`       | _(Boolean or String)_ TLS certificate verification: `True` (default), `False` (testing only), or a CA bundle path. Constructor only; ignored in YAML files. | _(none)_ |
 | `sandboxToken`       | _(String)_ The Zscaler Internet Access Sandbox Token | `ZSCALER_SANDBOX_TOKEN` |
 | `sandboxCloud`       | _(String)_ The Zscaler Internet Access Sandbox cloud name | `ZSCALER_SANDBOX_CLOUD` |
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.11.1"
+version = "1.11.3"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.11.1"
+__version__ = "1.11.3"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/config/config_setter.py

@@ -42,7 +42,6 @@ class ConfigSetter:
                 "maxRetries": 2,
                 "maxRetrySeconds": "",
             },
-            "testing": {"disableHttpsCheck": ""},
         }
     }
 
@@ -97,7 +96,10 @@ class ConfigSetter:
 
         # check if LOCAL yaml exists, apply if true
         if os.path.exists(_LOCAL_YAML_PATH):
-            logger.info(f"Applying local YAML configuration from {_LOCAL_YAML_PATH}.")
+            logger.warning(
+                f"Applying zscaler.yaml from the current working directory ({_LOCAL_YAML_PATH}). "
+                "Only run the SDK from directories whose configuration files you trust."
+            )
             self._apply_yaml_config(_LOCAL_YAML_PATH)
 
         # apply existing environment variables
@@ -138,13 +140,6 @@ class ConfigSetter:
         self._config["client"]["requestTimeout"] = 0
         self._config["client"]["rateLimit"] = {"maxRetries": 2}
 
-        # Add a check for the 'testing' key before accessing it
-        if "testing" not in self._config:
-            self._config["testing"] = {}
-
-        # Initialize the 'testing' section with default values
-        self._config["testing"]["disableHttpsCheck"] = False
-
     def _apply_config(self, new_config: dict):
         """Apply a config dictionary to the current config, overwriting values"""
         # logger.debug("Applying new configuration settings.")
@@ -170,8 +165,13 @@ class ConfigSetter:
         with open(path, "r") as file:
             # Open file stream and attempt to load YAML
             config = yaml.load(file, Loader=yaml.SafeLoader)
-        # Apply acquired config to configuration
-        self._apply_config(config.get("zscaler", {}))
+        zscaler_config = (config or {}).get("zscaler", {}) or {}
+        # TLS verification settings are only honored when passed to the client constructor.
+        client_config = zscaler_config.get("client") or {}
+        if "sslContext" in client_config:
+            client_config.pop("sslContext")
+            logger.warning(f"Ignoring 'sslContext' in {path}; TLS settings must be passed to the client constructor.")
+        self._apply_config(zscaler_config)
 
     def _apply_env_config(self, conf_key):
         """

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/logger.py

@@ -21,6 +21,9 @@ SENSITIVE_FIELDS = {
     "access_token",
     "accessToken",
     "accesstoken",
+    "api_token",
+    "apiToken",
+    "apitoken",
     "refresh_token",
     "refreshToken",
     "refreshtoken",
@@ -181,7 +184,7 @@ def dump_request(logger, url: str, method: str, json, params, headers, request_u
     log_lines.append(f"\n---[ ZSCALER SDK REQUEST | ID:{request_uuid} ]-------------------------------")
     full_url = url
     if params:
-        full_url += "?" + urlencode(params)
+        full_url += "?" + urlencode(_sanitize_for_logging(params))
     log_lines.append(f"{method} {full_url}")
     for key, value in request_headers_filtered.items():
         log_lines.append(f"{key}: {value}")
@@ -214,7 +217,7 @@ def dump_response(
 
     full_url = url
     if params:
-        full_url += "?" + urlencode(params)
+        full_url += "?" + urlencode(_sanitize_for_logging(params))
     log_lines = []
 
     if from_cache:

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/oneapi_http_client.py

@@ -69,13 +69,11 @@ class HTTPClient:
         else:
             self._proxy: Optional[str] = None
 
-        # Setup SSL context or handle disableHttpsCheck
-        if "sslContext" in http_config:
-            self._ssl_context: Union[bool, Any] = http_config["sslContext"]  # Use the custom SSL context
-        elif "disableHttpsCheck" in http_config and http_config["disableHttpsCheck"]:
-            self._ssl_context: Union[bool, Any] = False  # Disable SSL certificate validation if disableHttpsCheck is true
-        else:
-            self._ssl_context: Union[bool, Any] = True  # Enable SSL certificate validation by default
+        # Passed to requests as ``verify``: True (default), False, or a CA bundle path.
+        ssl_context: Union[bool, Any] = http_config.get("sslContext")
+        self._ssl_context: Union[bool, Any] = True if ssl_context is None else ssl_context
+        if self._ssl_context is False:
+            logger.warning("TLS certificate verification is disabled (sslContext=False). Do not use this outside of testing.")
 
         self._session: Optional[requests.Session] = None
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zia/locations.py

@@ -529,7 +529,7 @@ class LocationsAPI(APIClient):
             location_ids (list): The list of unique ids for the ZIA Locations that will be deleted.
 
         Returns:
-            :obj:`int`: The status code for the operation.
+            :obj:`Tuple`: A tuple containing (None, Response, error)
 
         Examples:
             >>> location_ids_to_delete = ['8665786', '8766865']
@@ -541,10 +541,10 @@ class LocationsAPI(APIClient):
         """
         # Validate input before making the request
         if not location_ids:
-            return (None, ValueError("Empty location_ids list provided"))
+            return (None, None, ValueError("Empty location_ids list provided"))
 
         if len(location_ids) > 100:
-            return (None, ValueError("Maximum 100 location IDs allowed per bulk delete request"))
+            return (None, None, ValueError("Maximum 100 location IDs allowed per bulk delete request"))
 
         http_method = "post".upper()
         api_url = format_url(f"""
@@ -558,18 +558,13 @@ class LocationsAPI(APIClient):
             method=http_method, endpoint=api_url, body=payload, headers={}, params={}
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
-
-        # For 204 No Content responses, the executor may return None
         if error:
-            return (None, error)
-        elif response is None:
-            # This is the expected case for 204 No Content
-            return (None, None)
+            return (None, response, error)
 
-        return (response, None)
+        return (None, response, None)
 
     def list_sub_locations(self, location_id: int, query_params: Optional[dict] = None) -> APIResult[List[LocationManagement]]:
         """

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zia/models/cloudappcontrol.py

@@ -112,8 +112,10 @@ class CloudApplicationControl(ZscalerObject):
                 config["formSharingDomainProfiles"] if "formSharingDomainProfiles" in config else [],
                 common_reference.ResourceReference,
             )
-            self.cloud_app_risk_profile = ZscalerCollection.form_list(
-                config["cloudAppRiskProfile"] if "cloudAppRiskProfile" in config else [], common_reference.ResourceReference
+            self.cloud_app_risk_profile = (
+                common_reference.ResourceReference(config["cloudAppRiskProfile"])
+                if config.get("cloudAppRiskProfile")
+                else None
             )
 
             # Assign the cbi_profile as-is; conversions are handled by ZscalerObject

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zia/outbound_email_dlp_rules.py

@@ -411,10 +411,10 @@ class OutboundEmailDLPRulesAPI(APIClient):
             output_file (str): Optional path; when given, the downloaded bytes are written to this file.
 
         Returns:
-            tuple: A 2-tuple of (the CSV mapping of supported outbound email DLP rule actions as bytes, error).
+            :obj:`Tuple`: A tuple containing (CSV mapping of supported actions as bytes, Response, error)
 
         Examples:
-            >>> content, error = client.zia.outbound_email_dlp_rules.get_actions(output_file='get_actions.csv')
+            >>> content, _, error = client.zia.outbound_email_dlp_rules.get_actions(output_file='get_actions.csv')
             >>> if error:
             ...     print(f"Error downloading outbound email DLP rule: {error}")
             ...     return
@@ -441,11 +441,11 @@ class OutboundEmailDLPRulesAPI(APIClient):
             params=query_params,
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request, return_raw_response=True)
         if error:
-            return (None, f"Request failed: {error}")
+            return (None, response, error)
 
         content = response.content
 
@@ -453,4 +453,4 @@ class OutboundEmailDLPRulesAPI(APIClient):
             with open(output_file, "wb") as f:
                 f.write(content)
 
-        return (content, None)
+        return (content, response, None)

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zia/policy_export.py

@@ -41,14 +41,11 @@ class PolicyExportAPI(APIClient):
             output_file (str): Optional. If provided, the ZIP is saved to disk at this file path.
 
         Returns:
-            tuple:
-                (export_content, error)
-
-                - export_content (bytes): The raw ZIP file bytes from the server (or raw JSON if only one type).
-                - error (str): Any error message, or None on success.
+            :obj:`Tuple`: A tuple containing (export content as bytes, Response, error). The content is the raw
+            ZIP file from the server (or raw JSON if only one policy type is exported).
 
         Example:
-            >>> export_content, err = client.zia.policy_export.policy_export(
+            >>> export_content, _, err = client.zia.policy_export.policy_export(
             ...     policy_types=["BA","URL_FILTERING"],
             ...     output_file="policy_export.zip"
             ... )
@@ -76,12 +73,12 @@ class PolicyExportAPI(APIClient):
             use_raw_data_for_body=False,  # We'll let JSON be formed from the Python list
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         # We want raw bytes so we can save them if it's a ZIP
         response, error = self._request_executor.execute(request, return_raw_response=True)
         if error:
-            return (None, f"Request failed: {error}")
+            return (None, response, error)
 
         content = response.content  # raw bytes (likely a .zip)
 
@@ -90,4 +87,4 @@ class PolicyExportAPI(APIClient):
             with open(output_file, "wb") as f:
                 f.write(content)
 
-        return (content, None)
+        return (content, response, None)

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zia/traffic_vpn_credentials.py

@@ -331,18 +331,21 @@ class TrafficVPNCredentialAPI(APIClient):
             credential_ids (list): List containing IDs of each vpn credential that will be deleted.
 
         Returns:
-            :obj:`tuple`: Response code for operation.
+            :obj:`Tuple`: A tuple containing (None, Response, error)
 
         Examples:
-            >>> zia.traffic.bulk_delete_vpn_credentials(['94963984', '97679232'])
+            >>> _, _, err = client.zia.traffic_vpn_credentials.bulk_delete_vpn_credentials(['94963984', '97679232'])
+            ... if err:
+            ...     print(f"Error bulk deleting VPN credentials: {err}")
+            ...     return
 
         """
         # Validate input before making the request
         if not credential_ids:
-            return (None, ValueError("Empty credential_ids list provided"))
+            return (None, None, ValueError("Empty credential_ids list provided"))
 
         if len(credential_ids) > 100:
-            return (None, ValueError("Maximum 100 credential IDs allowed per bulk delete request"))
+            return (None, None, ValueError("Maximum 100 credential IDs allowed per bulk delete request"))
 
         http_method = "post".upper()
         api_url = format_url(f"""
@@ -356,12 +359,10 @@ class TrafficVPNCredentialAPI(APIClient):
             method=http_method, endpoint=api_url, body=payload, headers={}, params={}
         )
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
-
         if error:
             return (None, response, error)
 
-        # ✅ Return a 3-tuple, even if response is None (e.g., 204 No Content)
         return (None, response, None)

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/app_connector_groups.py

@@ -20,6 +20,7 @@ from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.types import APIResult
 from zscaler.utils import format_url
+from zscaler.zpa.enrollment_certificates import EnrollmentCertificateAPI
 from zscaler.zpa.models.app_connector_groups import AppConnectorGroup
 
 
@@ -33,6 +34,7 @@ class AppConnectorGroupAPI(APIClient):
         self._request_executor: RequestExecutor = request_executor
         customer_id = config["client"].get("customerId")
         self._zpa_base_endpoint = f"/zpa/mgmtconfig/v1/admin/customers/{customer_id}"
+        self._enrollment_certificates = EnrollmentCertificateAPI(request_executor, config)
 
     def list_connector_groups(self, query_params: Optional[dict] = None) -> APIResult[List[AppConnectorGroup]]:
         """
@@ -290,9 +292,11 @@ class AppConnectorGroupAPI(APIClient):
                 The version profile to use. This will automatically set ``override_version_profile`` to True.
                 Accepted values are:
                 ``default``, ``previous_default`` and ``new_release``
-            **enrollment_cert_id (str): ID of the enrollment certificate used to sign App Connector enrollment.
-                The SDK does not look this up for you; retrieve it with
-                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Connector"})``.
+            **enrollment_cert_id (str):
+                ID of the enrollment certificate used for App Connector enrollment. Required by the ZPA API.
+                If not provided, the SDK looks up the ``Connector`` enrollment certificate via
+                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Connector"})``
+                and sends its ID. Pass it explicitly to use a different certificate.
 
         Returns:
             :obj:`Tuple`: A tuple containing (AppConnectorGroup, Response, error)
@@ -327,6 +331,12 @@ class AppConnectorGroupAPI(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
+        if not body.get("enrollment_cert_id"):
+            cert, _, error = self._enrollment_certificates.get_enrolment_by_name("Connector")
+            if error:
+                return (None, None, error)
+            body["enrollment_cert_id"] = cert.id
+
         # Create the request
         request, error = self._request_executor.create_request(http_method, api_url, body=body, params=params)
         if error:
@@ -384,6 +394,11 @@ class AppConnectorGroupAPI(APIClient):
                 Accepted values are:
 
                 ``default``, ``previous_default`` and ``new_release``
+            **enrollment_cert_id (str):
+                ID of the enrollment certificate used for App Connector enrollment. Required by the ZPA API.
+                If not provided, the SDK looks up the ``Connector`` enrollment certificate via
+                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Connector"})``
+                and sends its ID. Pass it explicitly to keep a different certificate.
 
         Returns:
             tuple: A tuple containing (AppConnectorGroup, Response, error)
@@ -419,6 +434,12 @@ class AppConnectorGroupAPI(APIClient):
         microtenant_id = body.get("microtenant_id", None)
         params = {"microtenantId": microtenant_id} if microtenant_id else {}
 
+        if not body.get("enrollment_cert_id"):
+            cert, _, error = self._enrollment_certificates.get_enrolment_by_name("Connector")
+            if error:
+                return (None, None, error)
+            body["enrollment_cert_id"] = cert.id
+
         request, error = self._request_executor.create_request(http_method, api_url, body, {}, params)
         if error:
             return (None, None, error)

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/c2c_ip_ranges.py

@@ -309,7 +309,7 @@ class IPRangesAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/client_settings.py

@@ -196,7 +196,7 @@ class ClientSettingsAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/enrollment_certificates.py

@@ -143,6 +143,33 @@ class EnrollmentCertificateAPI(APIClient):
             return (None, response, error)
         return (result, response, None)
 
+    def get_enrolment_by_name(self, name: str) -> APIResult[EnrollmentCertificate]:
+        """
+        Returns the enrollment certificate whose name matches ``name`` (case-insensitive).
+
+        Args:
+            name (str): The name of the enrollment certificate, e.g. ``Connector`` or ``Service Edge``.
+
+        Returns:
+            :obj:`Tuple`: A tuple containing (EnrollmentCertificate, Response, error). If no certificate
+            matches, the error is a ``ValueError``.
+
+        Examples:
+            >>> cert, _, err = client.zpa.enrollment_certificates.get_enrolment_by_name("Connector")
+            ... if err:
+            ...     print(f"Error fetching certificate by name: {err}")
+            ...     return
+            ... print(cert.id)
+        """
+        certs, response, error = self.list_enrolment(query_params={"search": name})
+        if error:
+            return (None, response, error)
+
+        cert = next((c for c in certs or [] if (c.name or "").lower() == name.lower()), None)
+        if cert is None or not cert.id:
+            return (None, response, ValueError(f"Enrollment certificate '{name}' not found"))
+        return (cert, response, None)
+
     def add_enrollment_cert(self, **kwargs) -> APIResult[dict]:
         """
         Creates a new Enrollment Certificate.
@@ -308,7 +335,7 @@ class EnrollmentCertificateAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/microtenants.py

@@ -134,10 +134,10 @@ class MicrotenantsAPI(APIClient):
         Returns the name and ID of the configured Microtenant.
 
         Returns:
-            :obj:`Tuple`: Microtenant: The resource record for the microtenant.
+            :obj:`Tuple`: A tuple containing (list of Microtenant instances, Response, error)
 
         Examples:
-            >>> microtenants_list, err = client.zpa.microtenants.get_microtenant_summary()
+            >>> microtenants_list, _, err = client.zpa.microtenants.get_microtenant_summary()
             ... if err:
             ...     print(f"Error listing microtenants: {err}")
             ...     return
@@ -153,20 +153,18 @@ class MicrotenantsAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
         if error:
-            return (None, error)
-
-        microtenant_list = []
-        response_body = response.get_body()
-
-        if isinstance(response_body, list):
-            for item in response_body:
-                microtenant_list.append(Microtenant(item))
+            return (None, response, error)
 
-        return (microtenant_list, None)
+        try:
+            body = response.get_body()
+            result = [Microtenant(self.form_response_body(item)) for item in body] if isinstance(body, list) else []
+        except Exception as error:
+            return (None, response, error)
+        return (result, response, None)
 
     def get_microtenant_search(self, **kwargs) -> APIResult[dict]:
         """

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/models/service_edge_groups.py

@@ -42,6 +42,7 @@ class ServiceEdgeGroup(ZscalerObject):
             self.location = config["location"] if "location" in config else None
             self.version_profile_id = config["versionProfileId"] if "versionProfileId" in config else None
             self.version_profile_name = config["versionProfileName"] if "versionProfileName" in config else None
+            self.enrollment_cert_id = config["enrollmentCertId"] if "enrollmentCertId" in config else None
             self.override_version_profile = config["overrideVersionProfile"] if "overrideVersionProfile" in config else None
             self.version_profile_visibility_scope = (
                 config["versionProfileVisibilityScope"] if "versionProfileVisibilityScope" in config else None
@@ -87,6 +88,7 @@ class ServiceEdgeGroup(ZscalerObject):
             self.version_profile_id = None
             self.override_version_profile = None
             self.version_profile_name = None
+            self.enrollment_cert_id = None
             self.upgrade_priority = None
             self.version_profile_visibility_scope = None
             self.alt_cloud = None
@@ -127,6 +129,7 @@ class ServiceEdgeGroup(ZscalerObject):
             "versionProfileId": self.version_profile_id,
             "overrideVersionProfile": self.override_version_profile,
             "versionProfileName": self.version_profile_name,
+            "enrollmentCertId": self.enrollment_cert_id,
             "upgradePriority": self.upgrade_priority,
             "versionProfileVisibilityScope": self.version_profile_visibility_scope,
             "altCloud": self.alt_cloud,

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/role_controller.py

@@ -350,7 +350,7 @@ class RoleControllerAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/saml_attributes.py

@@ -316,7 +316,7 @@ class SAMLAttributesAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, {})
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/service_edge_group.py

@@ -20,6 +20,7 @@ from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.types import APIResult
 from zscaler.utils import format_url
+from zscaler.zpa.enrollment_certificates import EnrollmentCertificateAPI
 from zscaler.zpa.models.service_edge_groups import ServiceEdgeGroup
 
 
@@ -33,6 +34,7 @@ class ServiceEdgeGroupAPI(APIClient):
         self._request_executor: RequestExecutor = request_executor
         customer_id = config["client"].get("customerId")
         self._zpa_base_endpoint = f"/zpa/mgmtconfig/v1/admin/customers/{customer_id}"
+        self._enrollment_certificates = EnrollmentCertificateAPI(request_executor, config)
 
     def list_service_edge_groups(self, query_params: Optional[dict] = None) -> APIResult[List[ServiceEdgeGroup]]:
         """
@@ -191,9 +193,11 @@ class ServiceEdgeGroupAPI(APIClient):
                 Indicates the grace distance unit of measure in miles or kilometers.
                 This value is only required if graceDistanceEnabled is set to true.
                 Supported Values: `MILES`, `KMS`
-            **enrollment_cert_id (str): ID of the enrollment certificate used to sign Service Edge enrollment.
-                The SDK does not look this up for you; retrieve it with
-                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Service Edge"})``.
+            **enrollment_cert_id (str):
+                ID of the enrollment certificate used for Service Edge enrollment. Required by the ZPA API.
+                If not provided, the SDK looks up the ``Service Edge`` enrollment certificate via
+                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Service Edge"})``
+                and sends its ID. Pass it explicitly to use a different certificate.
 
         Returns:
             :obj:`Tuple`: ServiceEdgeGroup: The newly created service edge group object.
@@ -236,6 +240,12 @@ class ServiceEdgeGroupAPI(APIClient):
         if "service_edge_ids" in body:
             body["serviceEdges"] = [{"id": id} for id in body.pop("service_edge_ids")]
 
+        if not body.get("enrollment_cert_id"):
+            cert, _, error = self._enrollment_certificates.get_enrolment_by_name("Service Edge")
+            if error:
+                return (None, None, error)
+            body["enrollment_cert_id"] = cert.id
+
         request, error = self._request_executor.create_request(http_method, api_url, body=body, params=params)
         if error:
             return (None, None, error)
@@ -258,6 +268,13 @@ class ServiceEdgeGroupAPI(APIClient):
             group_id (str): The unique ID of the service edge group.
             microtenant_id (str): The unique identifier of the Microtenant for the ZPA tenant.
 
+        Keyword Args:
+            **enrollment_cert_id (str):
+                ID of the enrollment certificate used for Service Edge enrollment. Required by the ZPA API.
+                If not provided, the SDK looks up the ``Service Edge`` enrollment certificate via
+                ``client.zpa.enrollment_certificates.list_enrolment(query_params={"search": "Service Edge"})``
+                and sends its ID. Pass it explicitly to keep a different certificate.
+
         Returns:
             :obj:`Tuple`: ServiceEdgeGroup: The updated service edge group object.
 
@@ -303,6 +320,12 @@ class ServiceEdgeGroupAPI(APIClient):
         if "service_edge_ids" in body:
             body["serviceEdges"] = [{"id": id} for id in body.pop("service_edge_ids")]
 
+        if not body.get("enrollment_cert_id"):
+            cert, _, error = self._enrollment_certificates.get_enrolment_by_name("Service Edge")
+            if error:
+                return (None, None, error)
+            body["enrollment_cert_id"] = cert.id
+
         request, error = self._request_executor.create_request(http_method, api_url, body=body, params=params)
         if error:
             return (None, None, error)

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/user_portal_controller.py

@@ -301,7 +301,7 @@ class UserPortalControllerAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)
 

{zscaler_sdk_python-1.11.1 → zscaler_sdk_python-1.11.3}/zscaler/zpa/user_portal_link.py

@@ -307,7 +307,7 @@ class UserPortalLinkAPI(APIClient):
 
         request, error = self._request_executor.create_request(http_method, api_url, params=params)
         if error:
-            return (None, error)
+            return (None, None, error)
 
         response, error = self._request_executor.execute(request)