Skip to content

fix: add OneAPI gov/govus cloud support; fix ZPA timeout rule reauth keys #534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
willguibr merged 3 commits into from
Jun 23, 2026
Merged

fix: add OneAPI gov/govus cloud support; fix ZPA timeout rule reauth keys #534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
951aba3
fix: add OneAPI gov/govus cloud support; fix ZPA timeout rule reauth …
willguibr Jun 23, 2026
23b439c
fix: Fixed README documentation to include FedRAMP authentication ins…
willguibr Jun 23, 2026
bff6da4
fix: Fixed README documentation to include FedRAMP authentication ins…
willguibr Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,19 @@
# Zscaler Python SDK Changelog

## 1.9.32 (June 3, 2026)

### Notes

- Python Versions: **v3.9, v3.10, v3.11, v3.12**

### Enhancements

* [PR #534](https://github.com/zscaler/zscaler-sdk-python/issues/534) - Added OneAPI (Zidentity) support for the government (FedRAMP) clouds. Setting `cloud=gov` or `cloud=govus` on `ZscalerClient` now routes OAuth to the correct Zidentity identity provider (`https://{vanityDomain}.zidentitygov.net` / `https://{vanityDomain}.zidentitygovus.net`) and API calls to the correct gateway (`https://api.zscalergov.net` / `https://api.zscalergov.us`). Previously these clouds produced non-resolvable hostnames and failed on every call. [Issue #526](https://github.com/zscaler/zscaler-sdk-python/issues/526)

### Bug Fixes

* [PR #534](https://github.com/zscaler/zscaler-sdk-python/issues/534) - Fixed ZPA `add_timeout_rule` (v1) so `re_auth_timeout`/`re_auth_idle_timeout` serialize to the API's `reauthTimeout`/`reauthIdleTimeout` keys instead of the rejected `reAuth*` form.

## 1.9.31 (May 29, 2026)

### Notes
Expand All @@ -21,6 +35,8 @@

* [PR #525](https://github.com/zscaler/zscaler-sdk-python/pull/525) - Fixed resource registration `app_connectors` within the Legacy ZPA Client.

* [Issue #526](https://github.com/zscaler/zscaler-sdk-python/issues/526) - Added OneAPI (Zidentity) support for the government (FedRAMP) clouds. Setting `cloud=gov` or `cloud=govus` on `ZscalerClient` now routes OAuth to the correct Zidentity identity provider (`https://{vanityDomain}.zidentitygov.net` / `https://{vanityDomain}.zidentitygovus.net`) and API calls to the correct gateway (`https://api.zscalergov.net` / `https://api.zscalergov.us`). Previously these clouds produced non-resolvable hostnames and failed on every call.

## 1.9.30 (May 21, 2026)

### Notes
Expand Down
35 changes: 34 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,7 +282,7 @@ dropdown you will see the newly created Role. In the event a newly created role
ZIdentity Admin UI a `Sync Now` button is provided in the API Resources menu which will initiate an
on-demand sync of newly created roles.

**WARNING**: Attention Government customers. OneAPI and Zidentity is not currently supported for the following ZIA clouds: `zscalergov` and `zscalerten` or ZPA `GOV`, and `GOVUS`.
**NOTE**: Attention Government customers. OneAPI and Zidentity now support the government (FedRAMP) clouds via the unified `cloud=gov` and `cloud=govus` values. See the [OneAPI Government (FedRAMP) Cloud Environments](#oneapi-government-fedramp-cloud-environments) section below for details.

### Default Environment Variables

Expand Down Expand Up @@ -319,6 +319,39 @@ export ZSCALER_CLOUD="beta"

**Note 2**: By default this SDK will send the authentication request and subsequent API calls to the default base URL.

### OneAPI Government (FedRAMP) Cloud Environments

OneAPI supports the Zscaler government (FedRAMP) clouds. These are FedRAMP-isolated environments served by a dedicated Zidentity identity provider and API gateway. To authenticate, set the `cloud` attribute (or `ZSCALER_CLOUD` environment variable) to one of the supported government values:

| `cloud` value | OAuth token endpoint | API base URL |
|---------------|----------------------|--------------|
| `gov` | `https://<vanity_domain>.zidentitygov.net/oauth2/v1/token` | `https://api.zscalergov.net` |
| `govus` | `https://<vanity_domain>.zidentitygovus.net/oauth2/v1/token` | `https://api.zscalergov.us` |

For example, authenticating to the GOV environment:

```sh
export ZSCALER_VANITY_DOMAIN="acme"
export ZSCALER_CLOUD="gov"
```

Or inline in the client configuration:

```py
from zscaler import ZscalerClient

config = {
"clientId": '{yourClientId}',
"clientSecret": '{yourClientSecret}',
"vanityDomain": '{yourvanityDomain}',
"cloud": "gov", # or "govus"
"customerId": "", # Optional parameter. Required only when using ZPA
"logging": {"enabled": False, "verbose": False},
}
```

**Note**: The `cloud` value is case-insensitive (`gov`, `GOV`, `govus`, `GOVUS` are all accepted). The `vanityDomain` is still required and is used as the host prefix for the government identity provider.

**Note 3**: Authentication to Zscaler Sandbox requires the attribute/parameter `sandboxCloud`.The following cloud environments are supported:

* `zscaler`
Expand Down
4 changes: 2 additions & 2 deletions docsrc/conf.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@
html_title = ""

# The short X.Y version
version = "1.9.31"
version = "1.9.32"
# The full version, including alpha/beta/rc tags
release = "1.9.31"
release = "1.9.32"

# -- General configuration ---------------------------------------------------

Expand Down
44 changes: 44 additions & 0 deletions docsrc/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,50 @@ an alternative Zidentity cloud environment.
**Note 2**: By default this SDK will send the authentication request and
subsequent API calls to the default base URL.

OneAPI Government (FedRAMP) Cloud Environments
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OneAPI supports the Zscaler government (FedRAMP) clouds. These are
FedRAMP-isolated environments served by a dedicated Zidentity identity
provider and API gateway. To authenticate, set the ``cloud`` attribute
(or ``ZSCALER_CLOUD`` environment variable) to one of the supported
government values:

+-------------------+---------------------------------------------------------------+------------------------------+
| ``cloud`` value | OAuth token endpoint | API base URL |
+===================+===============================================================+==============================+
| ``gov`` | ``https://<vanity_domain>.zidentitygov.net/oauth2/v1/token`` | ``https://api.zscalergov.net`` |
+-------------------+---------------------------------------------------------------+------------------------------+
| ``govus`` | ``https://<vanity_domain>.zidentitygovus.net/oauth2/v1/token``| ``https://api.zscalergov.us`` |
+-------------------+---------------------------------------------------------------+------------------------------+

For example, authenticating to the GOV environment:

.. code:: sh

export ZSCALER_VANITY_DOMAIN="acme"
export ZSCALER_CLOUD="gov"

Or inline in the client configuration:

.. code:: py

from zscaler import ZscalerClient

config = {
"clientId": '{yourClientId}',
"clientSecret": '{yourClientSecret}',
"vanityDomain": '{yourvanityDomain}',
"cloud": "gov", # or "govus"
"customerId": "", # Optional parameter. Required only when using ZPA
"logging": {"enabled": False, "verbose": False},
}

**Note**: The ``cloud`` value is case-insensitive (``gov``, ``GOV``,
``govus``, ``GOVUS`` are all accepted). The ``vanityDomain`` is still
required and is used as the host prefix for the government identity
provider.

**Note 3**: Authentication to Zscaler Sandbox requires the attribute/parameter `sandboxCloud`.The following cloud environments are supported:

* `zscaler`
Expand Down
21 changes: 21 additions & 0 deletions docsrc/zs/guides/release_notes.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,25 @@ Release Notes
Zscaler Python SDK Changelog
----------------------------

1.9.32 (June 3, 2026)
---------------------------

Notes
-------

- Python Versions: **v3.9, v3.10, v3.11, v3.12**

Enhancements
-------------

* (`Issue #526 <https://github.com/zscaler/zscaler-sdk-python/issues/526>`_) - Added OneAPI (Zidentity) support for the government (FedRAMP) clouds. Setting ``cloud=gov`` or ``cloud=govus`` on ``ZscalerClient`` now routes OAuth to the correct Zidentity identity provider (``https://{vanityDomain}.zidentitygov.net`` / ``https://{vanityDomain}.zidentitygovus.net``) and API calls to the correct gateway (``https://api.zscalergov.net`` / ``https://api.zscalergov.us``). Previously these clouds produced non-resolvable hostnames and failed on every call.

Bug Fixes
---------

* (`#534 <https://github.com/zscaler/zscaler-sdk-python/pull/534>`_) - Fixed ZPA ``add_timeout_rule`` (v1) so ``re_auth_timeout``/``re_auth_idle_timeout`` serialize to the API's ``reauthTimeout``/``reauthIdleTimeout`` keys instead of the rejected ``reAuth*`` form.


1.9.31 (May 29, 2026)
---------------------------

Expand All @@ -31,6 +50,8 @@ Bug Fixes:

`* (`#525 <https://github.com/zscaler/zscaler-sdk-python/pull/525>`_)` - Fixed resource registration `app_connectors` within the Legacy ZPA Client.

* (`Issue #526 <https://github.com/zscaler/zscaler-sdk-python/issues/526>`_) - Added OneAPI (Zidentity) support for the government (FedRAMP) clouds. Setting ``cloud=gov`` or ``cloud=govus`` on ``ZscalerClient`` now routes OAuth to the correct Zidentity identity provider (``https://{vanityDomain}.zidentitygov.net`` / ``https://{vanityDomain}.zidentitygovus.net``) and API calls to the correct gateway (``https://api.zscalergov.net`` / ``https://api.zscalergov.us``). Previously these clouds produced non-resolvable hostnames and failed on every call.

1.9.30 (May 21, 2026)
---------------------------

Expand Down
Loading
Loading