policy_group_rule¶

The following methods allow for interaction with the ZPA Policy Group Rule API endpoints.

Methods are accessible via zpa.policy_group_rule

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

class PolicyGroupRuleAPI¶

Bases: APIClient

A Client object for the Policy Group Rule resource.

add_rule(group_set_id, group_id, **kwargs)¶

Add a new policy rule for a given policy group.

Parameters:

group_set_id (str) – The group set id.
group_id (str) – The group id.
name (str) – The name of the policy group rule.
**kwargs – Optional keyword args.

Keyword Arguments:

action (str) – The action taken when traffic matches the policy group rule criteria.
action_id (int) – The action id for this policy group rule.
browser_posture_profile_id (str) – The browser posture profile id for this policy group rule.
browser_posture_profile_name (str) – The browser posture profile name for this policy group rule.
button_text (str) – The button text for this policy group rule.
custom_msg (str) – The custom msg for this policy group rule.
default_rule (bool) – A Boolean value indicating whether default rule applies to this policy group rule.
default_rule_name (str) – The default rule name for this policy group rule.
description (str) – Additional information about the policy group rule.
device_posture_failure_notification_enabled (bool) – A Boolean value indicating whether device posture failure notification is enabled for this policy group rule.
disabled (int) – The disabled for this policy group rule.
extranet_enabled (bool) – A Boolean value indicating whether extranet is enabled for this policy group rule.
group_id (int) – The group id for this policy group rule.
name_without_trim (str) – The name without trim for this policy group rule.
operator (str) – The operator for this policy group rule. Accepted values include e.g. AND.
policy_group_name (str) – The policy group name for this policy group rule.
policy_set_id (int) – The policy set id for this policy group rule.
policy_type (int) – The policy type for this policy group rule.
post_actions (dict) – The post actions configuration for this policy group rule.
priority (int) – The priority for this policy group rule.
read_only (bool) – A Boolean value indicating whether read only applies to this policy group rule.
reauth_idle_timeout (int) – The reauth idle timeout for this policy group rule.
reauth_timeout (int) – The reauth timeout for this policy group rule.
restriction_type (str) – The restriction type for this policy group rule.
rule_order (int) – The rule order for this policy group rule.
rule_type (str) – The rule type for this policy group rule. Accepted values include e.g. STANDARD.
microtenant_name (str) – The microtenant name for this policy group rule.
url (str) – The url for this policy group rule.
zpn_isolation_profile_id (int) – The zpn isolation profile id for this policy group rule.
zpn_inspection_profile_id (int) – The zpn inspection profile id for this policy group rule.
zpn_inspection_profile_name (str) – The zpn inspection profile name for this policy group rule.
zscaler_managed (bool) – A Boolean value indicating whether zscaler managed applies to this policy group rule.
app_server_groups (list) – The IDs for the app server groups that this policy group rule applies to.
app_connector_groups (list) – The IDs for the app connector groups that this policy group rule applies to.
conditions (list) – The IDs for the conditions that this policy group rule applies to.
desktop_policy_mappings (list) – The IDs for the desktop policy mappings that this policy group rule applies to.
post_action_types (list) – The list of post action types for this policy group rule.
service_edge_groups (list) – The IDs for the service edge groups that this policy group rule applies to.
credential (dict) – The ID of the credential for this policy group rule, e.g. {'id': 12345}.
credential_pool (dict) – The ID of the credential pool for this policy group rule, e.g. {'id': 12345}.
extranet_dto (dict) – The ID of the extranet dto for this policy group rule, e.g. {'id': 12345}.
inconsistent_config_details (dict) – The inconsistent config details configuration for this policy group rule.
privileged_capabilities (dict) – The privileged capabilities configuration for this policy group rule.
privileged_portal_capabilities (dict) – The privileged portal capabilities configuration for this policy group rule.
microtenant_id (str) – The unique identifier of the Microtenant for the ZPA tenant.

Returns:

A tuple containing the newly added PolicyRule instance, response, and error.

Return type:

tuple

Examples

Add a new policy group rule:

>>> added_rule, _, error = client.zpa.policy_group_rule.add_rule(
...     'VALUE', 'VALUE',
...     name=f"NewRule_{random.randint(1000, 10000)}",
...     description=f"NewRule_{random.randint(1000, 10000)}",
...     action='ALLOW',
... )
>>> if error:
...     print(f"Error adding policy group rule: {error}")
...     return
... print(f"Policy group rule added successfully: {added_rule.as_dict()}")

delete_rule(group_set_id, group_id, rule_id, microtenant_id=None)¶

Delete a policy rule within a policy group

Parameters:

group_set_id (str) – The group set id.
group_id (str) – The group id.
rule_id (str) – The unique identifier for the policy group rule.
microtenant_id (str, optional) – The microtenant ID, if applicable.

Returns:

A tuple containing the response object and error (if any).

Return type:

tuple

Examples

Delete a policy group rule:

>>> _, _, error = client.zpa.policy_group_rule.delete_rule('VALUE', 'VALUE', '216196257331370181')
>>> if error:
...     print(f"Error deleting policy group rule: {error}")
...     return
... print(f"Policy group rule deleted successfully.")

get_rule(group_set_id, group_id, rule_id, query_params=None)¶

Get a policy rule within a policy group

Parameters:

group_set_id (str) – The group set id.
group_id (str) – The group id.
rule_id (str) – The unique identifier for the policy group rule.
query_params (dict, optional) – Map of query parameters for the request. [query_params.microtenant_id] {str}: The microtenant ID, if applicable.

Returns:

A tuple containing (PolicyRule instance, Response, error).

Return type:

tuple

Examples

Print a specific policy group rule:

>>> fetched_rule, _, error = client.zpa.policy_group_rule.get_rule('VALUE', 'VALUE', '216196257331370181')
>>> if error:
...     print(f"Error fetching policy group rule by ID: {error}")
...     return
... print(f"Fetched policy group rule by ID: {fetched_rule.as_dict()}")

list_rules(group_set_id, group_id, query_params=None)¶

Get All Policy Groups Rules within a Policy Group with advanced search and pagination.

Parameters:

group_set_id (str) – The group set id.
group_id (str) – The group id.
{dict} (query_params) – Map of query parameters for the request. [query_params.search] {string}: The search string used to support search by features and fields for the API. [query_params.page] {integer}: Specifies the page number. [query_params.pagesize] {integer}: Specifies the page size. If not provided, the default page size is 20. The max page size is 500.

Returns:

A tuple containing (list of PolicyRule instances, Response, error)

Return type:

tuple

Examples

List policy group rules:

>>> rule_list, _, error = client.zpa.policy_group_rule.list_rules('VALUE', 'VALUE')
>>> if error:
...     print(f"Error listing policy group rules: {error}")
...     return
... print(f"Total policy group rules found: {len(rule_list)}")
... for rule in rule_list:
...     print(rule.as_dict())

List policy group rules using filters:

>>> rule_list, _, error = client.zpa.policy_group_rule.list_rules(
...     'VALUE', 'VALUE', query_params={'search': 'Example'})
>>> if error:
...     print(f"Error listing policy group rules: {error}")
...     return
... print(f"Total policy group rules found: {len(rule_list)}")

Client-side filtering with JMESPath:

The response object supports client-side filtering and projection via resp.search(expression). See the JMESPath documentation for expression syntax.

reorder_rule(group_set_id, group_id, rule_id, new_order, microtenant_id=None)¶

Update rule order of a rule within policy group

Parameters:

group_set_id (str) – The group set id.
group_id (str) – The group id.
rule_id (str) – The unique identifier for the policy group rule.
new_order (str) – The new order position for the policy group rule.
microtenant_id (str, optional) – The microtenant ID, if applicable.

Returns:

A tuple containing the response object and error (if any).

Return type:

tuple

Examples

>>> _, _, error = client.zpa.policy_group_rule.reorder_rule('VALUE', 'VALUE', '216196257331370181', '2')
>>> if error:
...     print(f"Error reordering policy group rule: {error}")
...     return
... print(f"Policy group rule reordered successfully.")