zscaler-sdk-python 1.9.24__tar.gz → 1.9.26__tar.gz

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.9.24
+Version: 1.9.26
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.9.24"
+version = "1.9.26"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.9.24"
+__version__ = "1.9.26"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/zscaler/errors/zscaler_api_error.py

@@ -17,10 +17,18 @@ class ZscalerAPIError(Exception):
             response_body = {"message": str(response_body)}
 
         self.error_code: Optional[Union[str, int]] = (
-            response_body.get("code") or response_body.get("id") or response_body.get("errorCode")
+            response_body.get("code")
+            or response_body.get("id")
+            or response_body.get("errorCode")
+            # ZCC error envelope: {"title": "INVALID_FIELD_VALUE", "errorCode": null, ...}
+            or response_body.get("title")
         )
         self.error_message: Optional[str] = (
-            response_body.get("message") or response_body.get("reason") or response_body.get("errorDetails")
+            response_body.get("message")
+            or response_body.get("reason")
+            or response_body.get("errorDetails")
+            # ZCC error envelope: {"errorMessage": "Policy with policyId: ...", ...}
+            or response_body.get("errorMessage")
         )
         self.params: List[Any] = response_body.get("params", [])
         self.path: Optional[str] = response_body.get("path")

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/zscaler/helpers.py

@@ -288,6 +288,14 @@ def to_lower_camel_case(string):
         "predefined_adp_controls": "predefinedADPControls",
         "runtime_os": "runtimeOS",
         "default_csp": "defaultCSP",
+        # ZCC WebPolicy: API expects this top-level key in snake_case.
+        "exit_password": "exit_password",
+        # ZCC WebPolicy / PolicyExtension: keys with embedded uppercase
+        # acronyms (WPAD, ZPA, TRP) the heuristic camel-casing cannot
+        # produce on its own.
+        "override_wpad": "overrideWPAD",
+        "instant_force_zpa_reauth_state_update": "instantForceZPAReauthStateUpdate",
+        "support_zpa_search_domains_in_trp": "supportZPASearchDomainsInTRP",
     }
 
     if string in FIELD_EXCEPTIONS:

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/zscaler/request_executor.py

@@ -358,9 +358,18 @@ class RequestExecutor:
         # Special handling for ZCC service - use selective conversion
         if "/zcc/" in endpoint and body:
             from zscaler.helpers import convert_keys_to_camel_case_selective
+            from zscaler.zcc._serialize import _ZccWireBody
             from zscaler.zcc.models.webpolicy import WebPolicy
 
-            # Use the WebPolicy's snake_case keys for selective conversion
+            # If the API client method already serialized the body via the
+            # model-driven ``zcc_to_wire`` helper, every key is already in
+            # the exact wire form declared by the schema. Skip any further
+            # conversion to preserve the model's intent verbatim.
+            if isinstance(body, _ZccWireBody):
+                return dict(body)
+
+            # Legacy path for ZCC endpoints that have not yet been migrated
+            # to the model-driven serializer.
             body = convert_keys_to_camel_case_selective(body, WebPolicy.SNAKE_CASE_KEYS)
             return body
 

{zscaler_sdk_python-1.9.24 → zscaler_sdk_python-1.9.26}/zscaler/utils.py

@@ -847,7 +847,12 @@ def zcc_param_mapper(func):
         raw_device_type = query_params.get("device_type") or body.get("device_type")
 
         if raw_device_type:
-            raw_device_type = [raw_device_type] if isinstance(raw_device_type, str) else raw_device_type
+            # Accept str ("windows"), int (3, matching the API's numeric
+            # device_type code), or a list of either. Scalars get wrapped
+            # into a single-element list so the comprehension below can
+            # iterate uniformly.
+            if isinstance(raw_device_type, (str, int)):
+                raw_device_type = [raw_device_type]
             mapped = [
                 str(zcc_param_map["os"].get(dt.lower()) if isinstance(dt, str) else dt)
                 for dt in raw_device_type

zscaler_sdk_python-1.9.26/zscaler/zcc/_field_introspect.py

@@ -0,0 +1,181 @@
+"""
+ZCC-only model introspection.
+
+This module derives the wire-level field mapping for any ZCC ZscalerObject
+subclass directly from its existing ``request_format`` and ``__init__``
+implementations. It does not modify or require any change to the model
+classes themselves.
+
+The serializer in ``_serialize.py`` uses the maps produced here to convert
+user-supplied snake_case bodies into the exact key casing the ZCC API
+expects, without relying on the heuristic snake-to-camel converter or its
+hand-maintained ``FIELD_EXCEPTIONS`` table.
+
+This module applies to ZCC only and does not affect other services.
+"""
+
+from __future__ import annotations
+
+import ast
+import inspect
+import sys
+import textwrap
+from functools import lru_cache
+from typing import Any, Dict, Set, Type
+
+from zscaler.oneapi_object import ZscalerObject
+
+
+class _AttrTracer:
+    """Sentinel that records the snake_case attribute name accessed on the tracer."""
+
+    __slots__ = ("name",)
+
+    def __init__(self, name: str) -> None:
+        self.name = name
+
+    def __repr__(self) -> str:  # pragma: no cover - debugging aid only
+        return f"_AttrTracer({self.name!r})"
+
+
+def _make_tracer(cls: Type[ZscalerObject]):
+    """
+    Return an instance that masquerades as ``cls`` and records every attribute
+    access. Used to introspect ``cls.request_format`` without running the
+    real ``__init__`` logic.
+
+    A dynamic subclass is required because ``request_format`` calls
+    ``super()`` (zero-arg form) which validates that ``self`` is an instance
+    of the enclosing class.
+    """
+
+    accessed: Dict[str, _AttrTracer] = {}
+
+    class _Tracer(cls):  # type: ignore[misc, valid-type]
+        # ``__getattr__`` only fires on missing attribute lookup, so it does
+        # not interfere with method dispatch or ``super()`` resolution.
+        def __getattr__(self, name: str):
+            if name not in accessed:
+                accessed[name] = _AttrTracer(name)
+            return accessed[name]
+
+    inst = _Tracer.__new__(_Tracer)
+    return inst, accessed
+
+
+@lru_cache(maxsize=None)
+def field_map(cls: Type[ZscalerObject]) -> Dict[str, str]:
+    """
+    Return ``{snake_case_attr -> wire_key}`` for ``cls`` by tracing its
+    ``request_format`` method.
+
+    Only entries whose value is a direct ``self.<attr>`` reference are
+    captured. Literal/computed values (rare in current ZCC models) are
+    intentionally skipped because they are not user-controllable and have
+    no snake_case form.
+    """
+
+    tracer, _ = _make_tracer(cls)
+    raw = cls.request_format(tracer)  # type: ignore[arg-type]
+    return {value.name: key for key, value in raw.items() if isinstance(value, _AttrTracer)}
+
+
+@lru_cache(maxsize=None)
+def wire_keys(cls: Type[ZscalerObject]) -> Set[str]:
+    """Return the set of wire-level keys declared by ``cls.request_format``."""
+    return set(field_map(cls).values())
+
+
+def _extract_nested_class_name(value_node: ast.AST) -> str | None:
+    """
+    Extract the name of a likely nested model class from the RHS of an
+    ``Assign`` node in a model's ``__init__``.
+
+    Recognized patterns (matching the conventions used throughout
+    ``zscaler/zcc/models``):
+
+    * ``self.x = NestedClass(config[...])``
+    * ``self.x = ZscalerCollection.form_list(..., NestedClass)``
+    * Either of the above wrapped in a conditional expression
+      (``A if cond else B``).
+    """
+
+    if isinstance(value_node, ast.Call):
+        func = value_node.func
+        if isinstance(func, ast.Name):
+            return func.id
+        if (
+            isinstance(func, ast.Attribute)
+            and isinstance(func.value, ast.Name)
+            and func.value.id == "ZscalerCollection"
+            and func.attr == "form_list"
+            and value_node.args
+        ):
+            last = value_node.args[-1]
+            if isinstance(last, ast.Name):
+                return last.id
+        return None
+
+    if isinstance(value_node, ast.IfExp):
+        for branch in (value_node.body, value_node.orelse):
+            name = _extract_nested_class_name(branch)
+            if name is not None:
+                return name
+
+    return None
+
+
+@lru_cache(maxsize=None)
+def nested_types(cls: Type[ZscalerObject]) -> Dict[str, Type[ZscalerObject]]:
+    """
+    Inspect ``cls.__init__`` and return ``{snake_case_attr -> NestedClass}``
+    for every attribute whose value is constructed from another
+    ``ZscalerObject`` subclass.
+
+    This drives recursive serialization: when a nested attribute is present
+    in the user's body, the serializer uses the corresponding nested class
+    as the schema for that sub-tree.
+    """
+
+    try:
+        source = textwrap.dedent(inspect.getsource(cls.__init__))
+    except (OSError, TypeError):
+        return {}
+
+    try:
+        tree = ast.parse(source)
+    except SyntaxError:
+        return {}
+
+    module = sys.modules.get(cls.__module__)
+    if module is None:
+        return {}
+
+    if not tree.body or not isinstance(tree.body[0], ast.FunctionDef):
+        return {}
+
+    result: Dict[str, Type[ZscalerObject]] = {}
+    for node in ast.walk(tree.body[0]):
+        if not isinstance(node, ast.Assign) or len(node.targets) != 1:
+            continue
+        target = node.targets[0]
+        if not (isinstance(target, ast.Attribute) and isinstance(target.value, ast.Name) and target.value.id == "self"):
+            continue
+        attr_name = target.attr
+        if attr_name in result:
+            continue
+        class_name = _extract_nested_class_name(node.value)
+        if class_name is None:
+            continue
+        candidate = getattr(module, class_name, None)
+        if isinstance(candidate, type) and issubclass(candidate, ZscalerObject) and candidate is not ZscalerObject:
+            result[attr_name] = candidate
+
+    return result
+
+
+def reset_caches() -> None:
+    """Clear all introspection caches. Intended for tests only."""
+    field_map.cache_clear()
+    wire_keys.cache_clear()
+    nested_types.cache_clear()

zscaler_sdk_python-1.9.26/zscaler/zcc/_serialize.py

@@ -0,0 +1,156 @@
+"""
+ZCC-only request body serializer.
+
+This module converts a user-supplied request body (typically containing
+snake_case keys) into the exact wire-key casing declared by a ZCC model
+class via its ``request_format`` method.
+
+Design goals:
+
+* The model class is the single source of truth for wire keys.
+* No reliance on heuristic snake-to-camel conversion or hand-maintained
+  ``FIELD_EXCEPTIONS`` tables.
+* Per-class scoping: the same snake_case attribute can map to different
+  wire keys depending on which model class it belongs to (e.g.
+  ``WindowsPolicy.disable_password`` -> ``disable_password`` (snake on
+  the wire) vs ``LinuxPolicy.disable_password`` -> ``disablePassword``).
+* camelCase wire keys passed by the user are accepted as-is; unknown keys
+  pass through unchanged so we never silently drop or mangle data.
+
+This module applies to ZCC only and must not be used by other services.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Type
+
+from zscaler.helpers import convert_keys_to_camel_case_selective, to_lower_camel_case
+from zscaler.oneapi_object import ZscalerObject
+
+from ._field_introspect import field_map, nested_types, wire_keys
+
+
+def _legacy_snake_preserve_keys() -> "set[str]":
+    """
+    The set of snake_case keys the legacy ZCC converter has historically
+    preserved on the wire (currently ``WebPolicy.SNAKE_CASE_KEYS``).
+
+    Treated as a transitional fallback: any key listed here passes through
+    the serializer unchanged when the per-class model does not declare it.
+    Sourced lazily to avoid a circular import at module load time.
+    """
+    from zscaler.zcc.models.webpolicy import WebPolicy
+
+    return WebPolicy.SNAKE_CASE_KEYS
+
+
+class _ZccWireBody(dict):
+    """
+    Marker dict subclass indicating that the body has already been
+    serialized into ZCC wire form by :func:`zcc_to_wire`.
+
+    The request executor checks ``isinstance(body, _ZccWireBody)`` to skip
+    its legacy ``convert_keys_to_camel_case_selective`` step for ZCC
+    endpoints.
+
+    Acts as a regular dict for ``json.dumps`` and downstream consumers.
+    """
+
+
+def _resolve_wire_key(provided_key: str, fmap: "dict[str, str]", wkeys: "set[str]") -> str:
+    """Return the wire-form key for ``provided_key``.
+
+    Resolution order (model first, legacy behaviour as a strict superset):
+
+      1. Snake_case attribute name declared by the model -> use the wire
+         key declared in ``request_format``.
+      2. Wire-form key already declared by the model -> keep as-is.
+      3. Snake_case key listed in the legacy ``WebPolicy.SNAKE_CASE_KEYS``
+         set -> preserve as snake_case. This covers fields the API expects
+         in snake_case but the SDK model has not yet incorporated (e.g.
+         top-level ``allowed_apps``, ``bypass_mms_apps``).
+      4. Otherwise -> fall back to ``to_lower_camel_case`` (which honours
+         the existing ``FIELD_EXCEPTIONS`` table). Already-camelCase keys
+         pass through unchanged because the converter is a no-op for
+         strings without an underscore.
+    """
+    if provided_key in fmap:
+        return fmap[provided_key]
+    if provided_key in wkeys:
+        return provided_key
+    if provided_key in _legacy_snake_preserve_keys():
+        return provided_key
+    return to_lower_camel_case(provided_key)
+
+
+def _resolve_nested_cls(
+    provided_key: str,
+    nested: "dict[str, Type[ZscalerObject]]",
+    fmap: "dict[str, str]",
+) -> "Type[ZscalerObject] | None":
+    """
+    Look up the nested model class for ``provided_key`` (which may be the
+    snake_case attribute name or the wire-form key). Returns ``None`` when
+    the key does not designate a nested structure.
+    """
+    if provided_key in nested:
+        return nested[provided_key]
+    for snake_name, wire_name in fmap.items():
+        if wire_name == provided_key and snake_name in nested:
+            return nested[snake_name]
+    return None
+
+
+def zcc_to_wire(body: Any, schema_cls: Type[ZscalerObject]) -> Any:
+    """
+    Convert ``body`` to the exact wire shape declared by ``schema_cls``.
+
+    Args:
+        body: The user's request body. May be a dict, a list of dicts, a
+            ``ZscalerObject`` instance, or a primitive. Non-dict / non-list
+            primitives are returned unchanged.
+        schema_cls: The ZCC model class that defines the wire shape. Must
+            be a subclass of :class:`ZscalerObject`.
+
+    Returns:
+        A :class:`_ZccWireBody` dict (for dict inputs), a list (for list
+        inputs whose elements are dicts), or the original value otherwise.
+    """
+    if isinstance(body, ZscalerObject):
+        body = body.request_format()
+
+    if isinstance(body, list):
+        return [zcc_to_wire(item, schema_cls) if isinstance(item, dict) else item for item in body]
+
+    if not isinstance(body, dict):
+        return body
+
+    fmap = field_map(schema_cls)
+    nested = nested_types(schema_cls)
+    wkeys = wire_keys(schema_cls)
+
+    snake_preserve = _legacy_snake_preserve_keys()
+
+    out = _ZccWireBody()
+    for raw_key, value in body.items():
+        wire_key = _resolve_wire_key(raw_key, fmap, wkeys)
+        nested_cls = _resolve_nested_cls(raw_key, nested, fmap)
+
+        if nested_cls is not None:
+            # Schema-aware recursion: the model declares a class for this
+            # sub-tree, so use it as the schema for the recursive call.
+            if isinstance(value, dict):
+                value = zcc_to_wire(value, nested_cls)
+            elif isinstance(value, list):
+                value = [zcc_to_wire(item, nested_cls) if isinstance(item, dict) else item for item in value]
+        elif isinstance(value, (dict, list)) and not isinstance(value, _ZccWireBody):
+            # No sub-schema declared. Fall back to the legacy ZCC converter
+            # for this subtree so containers like ``endToEndDiagnostics``,
+            # ``generateCliPasswordContract`` and ``locationRulesetPolicies``
+            # still get their child keys correctly cased (offTrusted,
+            # vpnTrusted, allowZpaDisableWithoutPassword, etc.).
+            value = convert_keys_to_camel_case_selective(value, snake_preserve)
+
+        out[wire_key] = value
+
+    return out

zscaler_sdk_python-1.9.26/zscaler/zcc/application_profiles.py

@@ -0,0 +1,246 @@
+"""
+Copyright (c) 2023, Zscaler Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+"""
+
+from typing import Optional
+from zscaler.api_client import APIClient
+from zscaler.request_executor import RequestExecutor
+from zscaler.zcc.models.application_profiles import ApplicationProfile
+from zscaler.utils import format_url, zcc_param_mapper
+from zscaler.types import APIResult
+
+
+class ApplicationProfilesAPI(APIClient):
+
+    def __init__(self, request_executor: "RequestExecutor") -> None:
+        super().__init__()
+        self._request_executor: RequestExecutor = request_executor
+        self._zcc_base_endpoint = "/zcc/papi/public/v1"
+
+    @zcc_param_mapper
+    def get_application_profiles(self, query_params: Optional[dict] = None) -> APIResult[dict]:
+        """
+        Retrieves the paginated list of application profiles.
+
+        The ``device_type`` filter accepts a friendly OS name (``ios``,
+        ``android``, ``windows``, ``macos``, ``linux``); the
+        :func:`zscaler.utils.zcc_param_mapper` decorator converts it to the
+        numeric ``deviceType`` value the API expects.
+
+        Args:
+            query_params (dict, optional): A dictionary containing supported filters.
+
+                ``[query_params.page]`` {str}: Specifies the page offset.
+
+                ``[query_params.page_size]`` {str}: Specifies the page size. The default size is 50.
+
+                ``[query_params.search]`` {str}: The search string used to match against the policies.
+
+                ``[query_params.search_type]`` {str}: The search string used to match against the search type.
+                    This is enabled only for filename, name, policyToken, ruleset, or groups.
+
+                ``[query_params.device_type]`` {str}: Friendly device type filter.
+                    One of ``ios``, ``android``, ``windows``, ``macos``, ``linux``.
+
+        Returns:
+            :obj:`list`: Retrieves the list of application profile policies.
+
+        Examples:
+            Prints all application profile policies:
+
+            >>> profile_list, _, err = client.zcc.application_profiles.get_application_profiles()
+            >>> if err:
+            ...     print(f"Error listing application profiles: {err}")
+            ...     return
+            ... for profile in profile_list:
+            ...     print(profile.as_dict())
+
+            Filter by device type:
+
+            >>> profile_list, _, err = client.zcc.application_profiles.get_application_profiles(
+            ...     query_params={"device_type": "android"}
+            ... )
+        """
+        http_method = "get".upper()
+        api_url = format_url(f"""
+            {self._zcc_base_endpoint}
+            /application-profiles
+        """)
+
+        query_params = query_params or {}
+        body = {}
+        headers = {}
+
+        request, error = self._request_executor.create_request(http_method, api_url, body, headers, params=query_params)
+
+        if error:
+            return (None, None, error)
+
+        response, error = self._request_executor.execute(request)
+        if error:
+            return (None, response, error)
+
+        try:
+            response_body = response.get_body() or {}
+            items = response_body.get("policies", []) or []
+            result = [ApplicationProfile(item) for item in items if isinstance(item, dict)]
+        except Exception as error:
+            return (None, response, error)
+        return (result, response, None)
+
+    def get_application_profile(self, profile_id: str) -> APIResult[dict]:
+        """
+        Retrieves the list of policies for application profiles.
+
+        Args:
+            profile_id (str): The unique identifier of the application profile.
+
+        Returns:
+            :obj:`list`: Retrieves the list of application profile policies.
+
+        Examples:
+            Prints all application profile policies:
+
+            >>> profile, _, err = client.zcc.application_profiles.get_application_profile('1234567890')
+            >>> if err:
+            ...     print(f"Error listing application profile: {err}")
+            ...     return
+            ... print(profile.as_dict())
+        """
+        http_method = "get".upper()
+        api_url = format_url(f"""
+            {self._zcc_base_endpoint}
+            /application-profiles/{profile_id}
+        """)
+
+        body = {}
+        headers = {}
+
+        request, error = self._request_executor.create_request(http_method, api_url, body, headers)
+        if error:
+            return (None, None, error)
+
+        response, error = self._request_executor.execute(request)
+        if error:
+            return (None, response, error)
+
+        try:
+            result = ApplicationProfile(self.form_response_body(response.get_body()))
+        except Exception as error:
+            return (None, response, error)
+        return (result, response, None)
+
+    @zcc_param_mapper
+    def update_application_profile(self, profile_id: str, **kwargs) -> APIResult[dict]:
+        """
+        Update the properties of the application profile using profile ID.
+
+        Only the following allowlisted properties can be updated. For array
+        or comma-separated string values, include existing values along with
+        the new values.
+
+        Args:
+            profile_id (str): The unique identifier of the application profile.
+
+        Keyword Args:
+            packet_tunnel_exclude_list (str): Hosts/IPs excluded from the packet tunnel.
+            packet_tunnel_exclude_list_for_ipv6 (str): IPv6 hosts/IPs excluded.
+            packet_tunnel_include_list (str): Hosts/IPs included in the packet tunnel.
+            packet_tunnel_include_list_for_ipv6 (str): IPv6 hosts/IPs included.
+            vpn_gateways (str): VPN gateways list.
+            source_port_based_bypasses (str): Source-port based bypass list.
+            disable_parallel_ipv4_and_ipv6 (int): Disable parallel IPv4/IPv6.
+            dns_priority_ordering_for_trusted_dns_criteria (int): DNS priority order
+                for trusted DNS criteria.
+            use_default_adapter_for_dns (str): Use default adapter for DNS.
+            update_dns_search_order (int): Update DNS search order.
+            disable_dns_route_exclusion (int): Disable DNS route exclusion.
+            enforce_split_dns (int): Enforce split DNS.
+            bypass_dns_traffic_using_udp_proxy (int): Bypass DNS traffic via UDP proxy.
+            truncate_large_udpdns_response (int): Truncate large UDP DNS responses.
+            prioritize_dns_exclusions (int): Prioritize DNS exclusions.
+            packet_tunnel_dns_exclude_list (str): DNS hosts excluded from packet tunnel.
+            packet_tunnel_dns_include_list (str): DNS hosts included in packet tunnel.
+            dns_priority_ordering (int): DNS priority ordering.
+            custom_dns (str): Custom DNS configuration.
+            app_service_ids (list[str]): App service IDs.
+            bypass_app_ids (list[str]): Bypass app IDs.
+            bypass_custom_app_ids (list[str]): Bypass custom app IDs.
+            groups (list): Group objects associated with the profile.
+            group_all (int): Apply policy to all groups.
+            user_ids (list[str]): User IDs associated with the profile.
+            logout_password (str): Logout password.
+            uninstall_password (str): Uninstall password.
+            disable_password (str): Disable password.
+            exit_password (str): Exit password.
+            zdx_disable_password (str): ZDX disable password.
+            zd_disable_password (str): ZD disable password.
+            zpa_disable_password (str): ZPA disable password.
+            zdp_disable_password (str): ZDP disable password.
+            zcc_revert_password (str): ZCC revert password.
+            zcc_fail_close_settings_exit_uninstall_password (str): ZCC fail-close
+                exit/uninstall password.
+            device_type (str): Device type.
+
+        Returns:
+            tuple: A tuple containing the Update Application Profile, response, and error.
+
+        Examples:
+            Update an existing Application Profile:
+
+            >>> updated_profile, response, error = (
+            ...     client.zcc.application_profiles.update_application_profile(
+            ...         profile_id='1234567890',
+            ...         enforce_split_dns=1,
+            ...         custom_dns='8.8.8.8,1.1.1.1',
+            ...         bypass_app_ids=['111', '222'],
+            ...         group_all=1,
+            ...     )
+            ... )
+            >>> if error:
+            ...     print(f"Error updating application profile: {error}")
+            ...     return
+            ... print(f"Application profile updated successfully: {updated_profile.as_dict()}")
+        """
+        http_method = "patch".upper()
+        api_url = format_url(f"""
+            {self._zcc_base_endpoint}
+            /application-profiles/{profile_id}
+        """)
+
+        body = {}
+        body.update(kwargs)
+
+        # The PATCH endpoint requires the body to identify the policy being
+        # updated. Always inject policyId derived from the URL parameter so
+        # callers cannot omit it by accident.
+        try:
+            body["policyId"] = int(profile_id)
+        except (TypeError, ValueError):
+            body["policyId"] = profile_id
+
+        request, error = self._request_executor.create_request(http_method, api_url, body, {}, {})
+        if error:
+            return (None, None, error)
+
+        response, error = self._request_executor.execute(request)
+        if error:
+            return (None, response, error)
+
+        try:
+            result = ApplicationProfile(self.form_response_body(response.get_body()))
+        except Exception as error:
+            return (None, response, error)
+        return (result, response, None)