zscaler-sdk-python 1.9.31__tar.gz → 1.9.33__tar.gz

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.9.31
+Version: 1.9.33
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT
@@ -321,7 +321,7 @@ dropdown you will see the newly created Role. In the event a newly created role
 ZIdentity Admin UI a `Sync Now` button is provided in the API Resources menu which will initiate an
 on-demand sync of newly created roles.
 
-**WARNING**: Attention Government customers. OneAPI and Zidentity is not currently supported for the following ZIA clouds: `zscalergov` and `zscalerten` or ZPA `GOV`, and `GOVUS`.
+**NOTE**: Attention Government customers. OneAPI and Zidentity now support the government (FedRAMP) clouds via the unified `cloud=gov` and `cloud=govus` values. See the [OneAPI Government (FedRAMP) Cloud Environments](#oneapi-government-fedramp-cloud-environments) section below for details.
 
 ### Default Environment Variables
 
@@ -358,6 +358,39 @@ export ZSCALER_CLOUD="beta"
 
 **Note 2**: By default this SDK will send the authentication request and subsequent API calls to the default base URL.
 
+### OneAPI Government (FedRAMP) Cloud Environments
+
+OneAPI supports the Zscaler government (FedRAMP) clouds. These are FedRAMP-isolated environments served by a dedicated Zidentity identity provider and API gateway. To authenticate, set the `cloud` attribute (or `ZSCALER_CLOUD` environment variable) to one of the supported government values:
+
+| `cloud` value | OAuth token endpoint | API base URL |
+|---------------|----------------------|--------------|
+| `gov`         | `https://<vanity_domain>.zidentitygov.net/oauth2/v1/token`   | `https://api.zscalergov.net` |
+| `govus`       | `https://<vanity_domain>.zidentitygov.us/oauth2/v1/token` | `https://api.zscalergov.us`  |
+
+For example, authenticating to the GOV environment:
+
+```sh
+export ZSCALER_VANITY_DOMAIN="acme"
+export ZSCALER_CLOUD="gov"
+```
+
+Or inline in the client configuration:
+
+```py
+from zscaler import ZscalerClient
+
+config = {
+    "clientId": '{yourClientId}',
+    "clientSecret": '{yourClientSecret}',
+    "vanityDomain": '{yourvanityDomain}',
+    "cloud": "gov",  # or "govus"
+    "customerId": "",  # Optional parameter. Required only when using ZPA
+    "logging": {"enabled": False, "verbose": False},
+}
+```
+
+**Note**: The `cloud` value is case-insensitive (`gov`, `GOV`, `govus`, `GOVUS` are all accepted). The `vanityDomain` is still required and is used as the host prefix for the government identity provider.
+
 **Note 3**: Authentication to Zscaler Sandbox requires the attribute/parameter `sandboxCloud`.The following cloud environments are supported:
 
 * `zscaler`

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/README.md

@@ -282,7 +282,7 @@ dropdown you will see the newly created Role. In the event a newly created role
 ZIdentity Admin UI a `Sync Now` button is provided in the API Resources menu which will initiate an
 on-demand sync of newly created roles.
 
-**WARNING**: Attention Government customers. OneAPI and Zidentity is not currently supported for the following ZIA clouds: `zscalergov` and `zscalerten` or ZPA `GOV`, and `GOVUS`.
+**NOTE**: Attention Government customers. OneAPI and Zidentity now support the government (FedRAMP) clouds via the unified `cloud=gov` and `cloud=govus` values. See the [OneAPI Government (FedRAMP) Cloud Environments](#oneapi-government-fedramp-cloud-environments) section below for details.
 
 ### Default Environment Variables
 
@@ -319,6 +319,39 @@ export ZSCALER_CLOUD="beta"
 
 **Note 2**: By default this SDK will send the authentication request and subsequent API calls to the default base URL.
 
+### OneAPI Government (FedRAMP) Cloud Environments
+
+OneAPI supports the Zscaler government (FedRAMP) clouds. These are FedRAMP-isolated environments served by a dedicated Zidentity identity provider and API gateway. To authenticate, set the `cloud` attribute (or `ZSCALER_CLOUD` environment variable) to one of the supported government values:
+
+| `cloud` value | OAuth token endpoint | API base URL |
+|---------------|----------------------|--------------|
+| `gov`         | `https://<vanity_domain>.zidentitygov.net/oauth2/v1/token`   | `https://api.zscalergov.net` |
+| `govus`       | `https://<vanity_domain>.zidentitygov.us/oauth2/v1/token` | `https://api.zscalergov.us`  |
+
+For example, authenticating to the GOV environment:
+
+```sh
+export ZSCALER_VANITY_DOMAIN="acme"
+export ZSCALER_CLOUD="gov"
+```
+
+Or inline in the client configuration:
+
+```py
+from zscaler import ZscalerClient
+
+config = {
+    "clientId": '{yourClientId}',
+    "clientSecret": '{yourClientSecret}',
+    "vanityDomain": '{yourvanityDomain}',
+    "cloud": "gov",  # or "govus"
+    "customerId": "",  # Optional parameter. Required only when using ZPA
+    "logging": {"enabled": False, "verbose": False},
+}
+```
+
+**Note**: The `cloud` value is case-insensitive (`gov`, `GOV`, `govus`, `GOVUS` are all accepted). The `vanityDomain` is still required and is used as the host prefix for the government identity provider.
+
 **Note 3**: Authentication to Zscaler Sandbox requires the attribute/parameter `sandboxCloud`.The following cloud environments are supported:
 
 * `zscaler`

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.9.31"
+version = "1.9.33"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.9.31"
+__version__ = "1.9.33"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/zscaler/constants.py

@@ -14,6 +14,20 @@ ZPA_BASE_URLS = {
 
 DEV_AUTH_URL = "https://authn1.dev.zpath.net/authn/v1/oauth/token"
 
+# OneAPI (Zidentity) government cloud endpoints.
+# These environments are FedRAMP-isolated and use a completely different
+# identity provider and API gateway than the commercial clouds. The OneAPI
+# client selects them via the lowercased ``cloud`` parameter (``gov``/``govus``).
+ONEAPI_GOV_AUTH_DOMAINS = {
+    "gov": "zidentitygov.net",
+    "govus": "zidentitygov.us",
+}
+
+ONEAPI_GOV_API_BASE_URLS = {
+    "gov": "https://api.zscalergov.net",
+    "govus": "https://api.zscalergov.us",
+}
+
 
 RETRYABLE_STATUS_CODES = {429, 500, 502, 503, 504}
 MAX_RETRIES = 5
@@ -23,17 +37,17 @@ BACKOFF_BASE_DURATION = 2
 ZSCALER_ONE_API_DEV = "https://help.zscaler.com/oneapi"
 ZID_DEV = "https://help.zscaler.com/zidentity"
 
-GET_ZSCALER_CLIENT_ID = f"{ZID_DEV}" "/about-api-clients"
+GET_ZSCALER_CLIENT_ID = f"{ZID_DEV}/about-api-clients"
 
-GET_ZSCALER_CLIENT_SECRET = f"{ZID_DEV}" "/about-api-clients"
+GET_ZSCALER_CLIENT_SECRET = f"{ZID_DEV}/about-api-clients"
 
-GET_ZSCALER_VANITY_DOMAIN = f"{ZID_DEV}" "/migrating-zscaler-service-admins-zidentity"
+GET_ZSCALER_VANITY_DOMAIN = f"{ZID_DEV}/migrating-zscaler-service-admins-zidentity"
 
-GET_ZSCALER_CLOUD = f"{ZID_DEV}" "/migrating-zscaler-service-admins-zidentity"
+GET_ZSCALER_CLOUD = f"{ZID_DEV}/migrating-zscaler-service-admins-zidentity"
 
-GET_ZPA_CUSTOMER_ID = f"{ZSCALER_ONE_API_DEV}" "/getting-started#ZPA-customerId-ZSLogin-admin-portal"
+GET_ZPA_CUSTOMER_ID = f"{ZSCALER_ONE_API_DEV}/getting-started#ZPA-customerId-ZSLogin-admin-portal"
 
-GET_ZPA_MICROTENANT_ID = f"{ZSCALER_ONE_API_DEV}" "/getting-started#ZPA-customerId-ZSLogin-admin-portal"
+GET_ZPA_MICROTENANT_ID = f"{ZSCALER_ONE_API_DEV}/getting-started#ZPA-customerId-ZSLogin-admin-portal"
 
 EPOCH_YEAR = 1970
 EPOCH_MONTH = 1

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/zscaler/helpers.py

@@ -285,6 +285,13 @@ def to_lower_camel_case(string):
         "location_dto": "locationDTO",
         "runtime_os": "runtimeOS",
         "default_csp": "defaultCSP",
+        # ZPA Timeout Policy: the API treats "reauth" as a single token. The
+        # default heuristic would split "re_auth_*" into "reAuth*", which the
+        # API rejects. Map both the "re_auth_*" and "reauth_*" spellings.
+        "re_auth_timeout": "reauthTimeout",
+        "re_auth_idle_timeout": "reauthIdleTimeout",
+        "reauth_timeout": "reauthTimeout",
+        "reauth_idle_timeout": "reauthIdleTimeout",
         # ZCC WebPolicy: API expects this top-level key in snake_case.
         "exit_password": "exit_password",
         # ZCC WebPolicy / PolicyExtension: keys with embedded uppercase

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/zscaler/oneapi_oauth_client.py

@@ -15,6 +15,7 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from jwcrypto.jwk import JWK
 
+from zscaler.constants import ONEAPI_GOV_AUTH_DOMAINS
 from zscaler.errors.response_checker import check_response_for_error
 from zscaler.user_agent import UserAgent
 
@@ -490,8 +491,14 @@ class OAuth:
         # logging.debug(f"Constructing auth URL for cloud: {cloud}.")
         if cloud == "production":
             return f"https://{vanity_domain}.zslogin.net/oauth2/v1/token"
-        else:
-            return f"https://{vanity_domain}.zslogin{cloud}.net/oauth2/v1/token"
+
+        # Government (FedRAMP) clouds use a dedicated Zidentity identity provider
+        # rather than the commercial ``zslogin{cloud}.net`` family.
+        gov_auth_domain = ONEAPI_GOV_AUTH_DOMAINS.get(cloud)
+        if gov_auth_domain:
+            return f"https://{vanity_domain}.{gov_auth_domain}/oauth2/v1/token"
+
+        return f"https://{vanity_domain}.zslogin{cloud}.net/oauth2/v1/token"
 
     def clear_access_token(self) -> None:
         """

{zscaler_sdk_python-1.9.31 → zscaler_sdk_python-1.9.33}/zscaler/request_executor.py

@@ -4,6 +4,7 @@ import uuid
 from http import HTTPStatus
 from typing import Any, Dict, Optional, Tuple
 
+from zscaler.constants import ONEAPI_GOV_API_BASE_URLS
 from zscaler.error_messages import ERROR_MESSAGE_429_MISSING_DATE_X_RESET
 from zscaler.errors.response_checker import check_response_for_error
 from zscaler.exceptions import exceptions
@@ -156,21 +157,32 @@ class RequestExecutor:
 
         # Special handling for Z-Insights (zins) GraphQL API
         if "/zins" in endpoint:
-            if self.cloud and self.cloud != "production":
-                return f"https://api.{self.cloud}.zsapi.net"
-            return self.BASE_URL
+            return self._resolve_api_base_url()
 
         # Special handling for ZMS (Microsegmentation) GraphQL API
         if "/zms" in endpoint:
-            if self.cloud and self.cloud != "production":
-                return f"https://api.{self.cloud}.zsapi.net"
-            return self.BASE_URL
+            return self._resolve_api_base_url()
 
         # Special handling for Business Insights (ZBI) API
         if "/bi" in endpoint:
-            if self.cloud and self.cloud != "production":
-                return f"https://api.{self.cloud}.zsapi.net"
-            return self.BASE_URL
+            return self._resolve_api_base_url()
+
+        return self._resolve_api_base_url()
+
+    def _resolve_api_base_url(self) -> str:
+        """
+        Resolves the OneAPI gateway base URL for the configured cloud.
+
+        Government (FedRAMP) clouds are isolated environments served by
+        dedicated gateways (``api.zscalergov.net`` / ``api.zscalergov.us``)
+        and do not follow the commercial ``api.{cloud}.zsapi.net`` pattern.
+
+        Returns:
+            str: The base URL for the configured cloud.
+        """
+        gov_base_url = ONEAPI_GOV_API_BASE_URLS.get(self.cloud)
+        if gov_base_url:
+            return gov_base_url
 
         if self.cloud and self.cloud != "production":
             return f"https://api.{self.cloud}.zsapi.net"
@@ -722,8 +734,7 @@ class RequestExecutor:
                 return None, response, response.text, Exception(ERROR_MESSAGE_429_MISSING_DATE_X_RESET)
 
             logger.info(
-                f"Hit rate limit or retryable status {response.status_code}. "
-                f"Retrying request in {backoff_seconds} seconds."
+                f"Hit rate limit or retryable status {response.status_code}. Retrying request in {backoff_seconds} seconds."
             )
             time.sleep(backoff_seconds)
             attempts += 1
@@ -869,7 +880,7 @@ class RequestExecutor:
             # but only when mutations (POST/PUT/DELETE) have occurred during the session
             if service_type.lower() in ["zia", "ztw"]:
                 logger.debug(
-                    f"{service_type.upper()} service requires explicit deauthentication to activate " f"staged configurations"
+                    f"{service_type.upper()} service requires explicit deauthentication to activate staged configurations"
                 )
 
             # Send DELETE request to deauthenticate