API Reference

Create a Gateway

post
https://{region}.api.jamfcloud.com/securitycloud/v1/ztna/gateways

Create a dedicated Gateway. Returns 201 {id, href} + Location header.

tenantIds are validated against the caller's organization — returns 400 if any
tenant ID is not resolvable within the caller's organization.

Constraints:

  • Exactly one of dedicatedIps.enabled: true or ipsec must be set — a plain gateway (neither)
    or an availability-zones-only gateway (zones with no ipsec) is rejected → 400.
  • dedicatedIps.enabled: true and non-empty availabilityZones are mutually exclusive → 400
  • An ipsec gateway requires at least one availabilityZones address → 400
  • Only one gateway with dedicatedIps.enabled: true is permitted per tenant (quota = 1).
    A second attempt returns 409 DEDICATED_IPS_LIMIT. Contact your Jamf account team to increase this limit.
  • Sending ipsec.left.secret: null explicitly returns 400 IPSEC_SECRET_CLEAR_NOT_SUPPORTED.

The three rejected shapes above all return 400 INVALID_FIELD; field is the only way to
tell them apart:

Request shapefield
Neither dedicatedIps.enabled: true nor ipsecdedicatedIps
availabilityZones with no ipsecipsec — the fix is to add a tunnel, not remove the zones
ipsec with no availabilityZonesavailabilityZones

No idempotency key. Gateway name is not unique-enforced — a timed-out POST that
succeeded server-side may create a duplicate gateway if retried. Verify via
GET /ztna/gateways before retrying a failed create.

Required Permissions: ztna:create

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

Flat request body for creating a dedicated Gateway.

string
required
length ≥ 1

Human-readable name.

tenantIds
array of strings, unique
required
length ≥ 1

Tenant IDs to grant access. Validated against the caller's organization — 403 if mismatched.

tenantIds*
contact
object
required

Operational contact for this gateway.

string
enum
required
length ≥ 1

Target datacenter identifier (e.g. eu-west-1).

boolean
Defaults to true

Whether the deployment should be active on creation.

availabilityZones
array of strings, unique

Public IPv4 addresses of the availability zone nodes to deploy into
(e.g. 18.202.42.169). Must belong to the gateway's datacenter region.
Must be empty when dedicatedIps.enabled: true. Required (at least one address)
when ipsec is set — an ipsec gateway with no zones is rejected.
Note: despite the field name, values are IPv4 addresses — not zone identifier strings.

For IPsec gateways, these are the source addresses the peer firewall must allow. Valid IPs per datacenter:

DatacenterNameIP 1IP 2
af-south-1Africa - Cape Town13.244.169.18213.246.106.52
ap-east-1Asia - Hong Kong16.163.54.10516.163.15.242
ap-northeast-1Asia - Japan35.76.189.15252.192.166.230
ap-south-1Asia - Mumbai3.109.252.17665.1.247.99
ap-southeast-1Asia - Singapore18.140.158.23552.77.139.71
ap-southeast-2Australia54.66.243.18213.238.46.250
ca-central-1North America - Canada15.222.200.1893.98.80.44
eu-central-1Europe - Germany3.66.107.2083.121.43.105
eu-west-1Europe - Ireland54.220.161.5718.202.42.169
eu-west-2Europe - UK3.9.67.9018.130.213.235
sa-east-1South America - Brazil54.207.180.9454.232.123.56
us-east-1North America - USA East163.123.175.1163.123.175.2
us-west-2North America - USA West163.123.174.1163.123.174.2
availabilityZones
dedicatedIps
object

Dedicated egress IP configuration. dedicatedIps.enabled: true is mutually exclusive with ipsec and with non-empty availabilityZones.

ipsec
object

IPSec tunnel configuration. Exactly one of ipsec or dedicatedIps.enabled: true must be set — a plain gateway (neither) is rejected. Mutually exclusive with dedicatedIps.enabled: true.

Headers
uuid
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The tenant UUID identifier. Send it to address tenant scope. This API is also published at environment scope — send that scope's header instead. Send exactly one scope header per request.

uuid
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The environment UUID identifier. Send it to address environment scope. This API is also published at tenant scope — send that scope's header instead. Send exactly one scope header per request.

Responses

Updated about 1 month ago

Did this page help you?
Language
Credentials
OAuth2
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated about 1 month ago

Did this page help you?