Zscaler Posture Control

Record your Zscaler Posture Control connection as cspm evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Zscaler Posture Control:

   1. In the ZPC Admin Portal, go to Administration › Authentication & Authorization › API Keys.
   2. Click Create API Key. The Create API Key window appears.
   3. For Name, enter a name for the key (it is shown in the audit logs as the entity performing API actions; symbols like & and * are not supported).
   4. Under Role Groups, select the group and role from the drop-down menu. Choose the least permissive role available, as Zscaler recommends.
   5. Under Revocation Date, choose Never, 7 Days, 15 Days, 1 Month or 3 Months (the default is 7 Days).
   6. Click Save. The API key is displayed: click the View icon to see it, the Copy icon to copy it, or the Download icon to save it as a CSV file. Store it before closing the window.

   Where to find the other values:

   • Base URL (optional): Not shown in the portal; Zscaler documents the ZPC API server as api.zpccloud.net/v1 for organizations in the USA and api.eu.zpccloud.net/v1 for organizations in the EU.

   Zscaler Posture Control shows the secret only once, so copy it before you leave the page.

   Zscaler Posture Control (ZPC) is still documented under its own name on the Zscaler Help Portal. The API key is shown only when created and cannot be retrieved after the window is closed. Up to 100 API keys per organization. The key is sent in the x-api-key request header; the public ZPC API covers cloud alerts. The Role Groups names available depend on the roles defined in the tenant, so no specific read-only role name is given. The ZPC docs do not describe an account or organization identifier for API use. Help Portal pages render client-side; the article text was read from the portal's own content API (help.zscaler.com/zapi/fetch-data) and each article has an official PDF on help.zscaler.com.

   Source: help.zscaler.com, help.zscaler.com, help.zscaler.com, help.zscaler.com, checked 2026-10-07.

2. On Compliance › Connectors, open Zscaler Posture Control, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

Zscaler Posture Control publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks