Partially update a Grouped Gateway

patch

https://{region}.api.jamfcloud.com/securitycloud/v1/ztna/grouped-gateways/{groupedGatewayId}

Partially update a Grouped Gateway.
All fields are optional — include only what you want to change.

Returns 404 if the grouped gateway does not exist or belongs to a different tenant — never 403.

tenantIds are validated against the caller's organization — 403 on mismatch.

Constraints (applied against the supplied gatewayIds array — which replaces the current set entirely):

All gatewayIds must be dedicated (customer-owned) gateways → 422 SHARED_GATEWAY_MEMBER
All supplied gatewayIds must have the same tunnel type (all IPSec or all non-IPSec) → 422 MIXED_TUNNEL_TYPES. On PATCH, a supplied set that is uniform on its own but conflicts with the group's existing members returns 409 GATEWAYS_TUNNEL_FLAG_MISMATCH instead.
All gatewayIds must have the same dedicatedIps.enabled value → 422 MIXED_DEDICATED_IPS_TYPES

Required Permissions: ztna:update

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

groupedGatewayId

uuid

required

ID of the Grouped Gateway. Format: UUID (e.g. 3fa85f64-5717-4562-b3fc-2c963f66afa6).

Body Params

Merge-patch body (application/merge-patch+json) for partial Grouped Gateway update. All fields optional — include only what you want to change.

name

string

length ≥ 1

New name for the grouped gateway.

gatewayIds

array of strings, unique

length ≥ 2

Replaces the full member gateway list (minimum 2).

gatewayIds

tenantIds

array of strings, unique

length ≥ 1

Replaces the full tenantIds list. Validated against the caller's organization — 403 if mismatched. Setting tenantIds: [] (empty array) returns 400 — minItems: 1 enforced by schema.

tenantIds

routingStrategy

string

enum

ACTIVE_STANDBY — traffic goes to the primary gateway; failover to secondary on failure. RANDOM — traffic is distributed randomly across gateways. NEAREST — traffic routes to the geographically closest gateway.

Allowed:

recoveryDelayInSec

integer

enum

Recovery delay in seconds for the ACTIVE_STANDBY strategy. If provided, must be one of the listed durations. Omit to leave unchanged. Grouped gateways created before this constraint may hold a legacy value; recoveryDelayInSec is unaffected on PATCH operations that omit it.

Allowed:

400Bad request — validation error. Common codes: INVALID_FIELD (schema or constraint violation), IPSEC_SECRET_CLEAR_NOT_SUPPORTED (explicit null sent for ipsec.left.secret), IPSEC_REMOVAL_NOT_SUPPORTED (explicit null sent for ipsec on a gateway that has IPSec configured).

403Forbidden — the caller's organization does not own one or more of the supplied tenantIds. Any mismatch rejects the entire request.

429Rate limit exceeded. Retry after the period indicated by Retry-After.