API Reference

Create an App

post
https://{region}.api.jamfcloud.com/securitycloud/v1/ztna/apps

Create an App (Access Policy). Returns 201 {id, href} + Location header.

Required fields: categoryName, assignments, routing.

name required when predefinedAppId is absent: If predefinedAppId is not set,
name must be non-blank — returns 400 otherwise. When predefinedAppId is set,
name must be null or omitted.

Full-tunnel restriction: When hostnames contains "*" (wildcard — routes all traffic),
security.riskControls.enabled must be false — returns 400 otherwise.

Required Permissions: ztna:create

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

Request body for creating an App.

string | null

Optional. ID from GET /predefined-apps. Once set, cannot be changed or removed. When set, name must be null or omitted; additional hostnames can be appended. Presence indicates a Predefined (SaaS) App; absence indicates a Custom (Enterprise) App.

string | null

Required (non-null) when predefinedAppId is absent — 400 if missing or null. Must be null or omitted when predefinedAppId is set.

string
required
length ≥ 1

App category name. Must exactly match a displayName returned by GET /v1/categories (e.g. "Business & Industry") — that endpoint is the authoritative source. Unknown values return 409 MISSING_CATEGORY_NAME — the category list is server-owned and may change, so an unrecognized name is a state conflict, not a malformed request.

hostnames
array of strings, unique

Unique set of hostnames/domains. Each entry must be a valid domain name, "*", or "*.domain". Overlapping entries (e.g. ["*.example.com", "sub.example.com"]) return 400. Specifying the same hostname across multiple Apps returns 409. When predefinedAppId is set, additional hostnames extend the template set.

hostnames
bareIps
array of strings, unique

IPv4 CIDR subnets (e.g. 192.168.1.0/24). Duplicating a subnet across Apps returns 409.

bareIps
assignments
object
required

User/group assignment rules for an App.

routing
object
required

Traffic routing configuration for an App.

groupOverrides
object

Per-group routing overrides that take precedence over the App's default routing. Each override's groupIds must be a subset of assignments.inclusions.groups (or allUsers: true); references to unassigned groups return 400.

security
object

Security controls applied to App traffic.

Headers
uuid
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The tenant UUID identifier. Send it to address tenant scope. This API is also published at environment scope — send that scope's header instead. Send exactly one scope header per request.

uuid
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The environment UUID identifier. Send it to address environment scope. This API is also published at tenant scope — send that scope's header instead. Send exactly one scope header per request.

Responses

Updated 12 days ago

Did this page help you?
Language
Credentials
OAuth2
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated 12 days ago

Did this page help you?