Zscaler

LAST UPDATED: APR 30, 2025

Overview

Zscaler is a cloud-based security service platform that enables fast and secure connections to user devices, irrespective of network, device, or location. The D3 SOAR integration with Zscaler supports operations such as adding URLs to the blacklist or whitelist, removing URLs from these lists, and retrieving entries from the blacklist or whitelist.

D3 SOAR is providing REST operations to function with Zscaler.

Zscaler is available for use in:

D3 SOAR	V12.7.83.0+
Category	Network Security
Deployment Options	Option I, Option II, Option III, Option IV

Known Limitations

D3 Command	Required Source API	Rate Limit
Activate Changes	POST /status/activate	10/min and 40/hr
Add URL To Blacklist	POST /security/advanced/blacklistUrls	1/sec and 400/hr
Add URL To Blacklist	DELETE /authenticatedSession	2/sec and 1000/hr
Add URL To Category	PUT /urlCategories/{categoryId}	1/sec and 400/hr
Add URL To Category	DELETE /authenticatedSession	2/sec and 1000/hr
Add URL To Whitelist	PUT /security	1/sec and 400/hr
Add URL To Whitelist	DELETE /authenticatedSession	2/sec and 1000/hr
Get Blacklist	GET /security/advanced	1/sec and 400/hr
Get Blacklist	DELETE /authenticatedSession	2/sec and 1000/hr
Get Sandbox Report	GET /sandbox/report/{md5Hash}	2/sec, 1000/hr, 1000/day
Get URL Category	POST /urlLookup	1/sec and 400/hr (100 URLs per call)
Get URL Category	DELETE /authenticatedSession	2/sec and 1000/hr
Get Whitelist	GET /security	2/sec and 1000/hr
Get Whitelist	DELETE /authenticatedSession	2/sec and 1000/hr
List All Categories	GET /urlCategories	2/sec and 1000/hr
List All Categories	DELETE /authenticatedSession	2/sec and 1000/hr
Remove URL From Blacklist	POST /security/advanced/blacklistUrls	1/sec and 400/hr
Remove URL From Blacklist	DELETE /authenticatedSession	2/sec and 1000/hr
Remove URL From Whitelist	GET /security	2/sec and 1000/hr
	PUT /security	1/sec and 400/hr
	DELETE /authenticatedSession	2/sec and 1000/hr
Upload File to Sandbox	POST /zscsb/submit	1/sec and 400/hr
Test Connection	POST /authenticatedSession	2/sec and 1000/hr

Refer to the API Rate Limit Summary for more information.

Connection

To connect to Zscaler from D3 SOAR, follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The URL of the Zscaler server.	https://admin.*****.net/
Username	The username to authenticate the connection. The user must be an administrator assigned an admin role. It is highly recommended to create a dedicated admin role and user with restricted functional scope access in the ZIA Admin Portal. This ensures appropriate usage, avoids conflicts between API and ZIA Admin Portal logins, and mitigates misuse.	***@***.zscalerthree.net
Password	The password of the admin user to authenticate the connection.	*****
API Key	The API key to authenticate the connection.	api*****H2g
Sandbox Submission API Token	The Sandbox Submission API token to authenticate the connection.	AQ*****1wY
API Version	The version of the API to use for the connection.	v1

Permission Requirements

Each endpoint in the Zscaler API requires a certain permission scope. The following are the minimum scopes required for the commands in this integration:

Command	Permissions	Functional Scope
Activate Changes	Policy Access: Full Scope: Organization	N/A
Add URL To Blacklist	Policy Access: Full	Security
Add URL To Category	Policy Access: Full	Access Control (Web and Mobile) Custom URL Category Management, Override Existing Categories, AND Policy and Resource Management
Add URL To Whitelist	Policy Access: Full	Security
Get Blacklist	Policy Access: View Only	Security
Get Sandbox Report	N/A	N/A
Get URL Category	Policy Access: Full	Access Control (Web and Mobile) Custom URL Category Management, OR Policy and Resource Management
Get Whitelist	Policy Access: View Only	Security
List All Categories	Policy Access: Full	Access Control (Web and Mobile) Custom URL Category Management, OR Policy and Resource Management
Remove URL From Blacklist	Policy Access: Full	Security
Remove URL From Whitelist	Policy Access: Full	Security
Upload File to sandbox	N/A	N/A
Test Connection	N/A	N/A

Configuring Zscaler to Work with D3 SOAR

Access the Zscaler platform. Enter the login ID, then click on the Next button.
Enter the password, then click on the Sign In button.
Hover over the Administration navigation menu item, then click on the Role Management submenu item.
Click on the + Add Administrator Role button.
Enter a name for this administrator role, then configure and save the permissions and functional scope relevant to the D3 commands the administrator is allowed to use. See Permission Requirements.

Verify that the role appears in the table.
Hover over the Activation navigation menu item, then click on the Activate button.

READER NOTE *

Activation is required after each modification and save operation to a role or administrator.

Hover over the Administration navigation menu item, then click on the Administrator Management submenu item.
Click on the + Add Administrator button.
Enter the following information within the Add Administrator popover:
1. Login ID – A two-part field consisting of the administrator's username and the organization domain.
2. Email – The administrator's email address.
3. Name – The administrator's name.
4. Role – The administrator role configured in steps 3 through 7.
5. Scope – The organizational boundary (Organization, Department, Location, or Location Group) that determines an admin's management access in ZIA.
Toggle the Password Based Login switch (a) to the on position, then enter and confirm the administrator’s password in the corresponding fields.
Click on the Save button.
Perform the activation step as demonstrated in step 7.
Have the administrator log in to the ZScaler platform, hover over the Administration navigation menu item, then click on the Cloud Service API Security submenu item.
Copy and store the API key for use in step 3i sub-step 4 in the Configuring D3 SOAR to Work with Zscaler section.

Obtaining API key and Sandbox Submission API Token

To obtain the API key and Sandbox Submission API token, see Cloud Service API Key Management from Zscaler's documentation for instructions.

Configuring D3 SOAR to Work with Zscaler

Log in to D3 SOAR.
Find the Zscaler integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Zscaler in the search box to find the integration, then click it to select it.
4. Click + New Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Zscaler.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add a description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, users have the option to choose the specific tenant sites to share the connection with. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the checkbox to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input the domain level Server URL. The default value is https://admin.zscalerthree.net.
  2. Input the Username. This is the Login ID established in step 10a in the Configuring Zscaler to Work with D3 SOAR section.
  3. Input the Password. This is the password set in step 11 in the Configuring Zscaler to Work with D3 SOAR section.
  4. Input the saved API Key.
  5. (Optional) Input the Sandbox Submission API Token if users need to use the Upload File to Sandbox command. Otherwise, it is optional.
  6. Input the API Version. The default value is v1.
10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
Test the connection.
1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
2. Click OK to close the alert window.
3. Click Add to create and add the configured connection.

Commands

Zscaler includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Zscaler API, refer to the Zscaler API reference.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Zscaler to Work with D3 SOAR for details.

Activate Changes

Activates saved configuration changes with status "PENDING" for the current user. If no other administrators are editing, changes are pushed to the CA immediately by the ZScaler service, and the activation status updates to ACTIVE. If multiple administrators are editing, the activation status updates to INPROGRESS until all changes are activated. For more information, see Saving and Activating Changes in the ZIA Admin Portal .

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Activate Changes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: You must have a valid Support account to call this API.

Error Sample Data

Activate Changes failed.

Status Code: 403.

Message: You must have a valid Support account to call this API.

Add URL To Blacklist

Adds URLs to the blacklist.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to add to the blacklist.	JSON `["Hello.com"]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URL To Blacklist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Add URL To Blacklist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Add URL To Category

Adds URLs to a category.

READER NOTE

Category is a required parameter to run this command.

Run the List All Categories command to obtain Category. Category is referring to the Category ID, which can be found from the returned raw data at the path $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to add to the specified category.	JSON `["hello.com"]`
Category	Required	The ID of the category to add URLs. Category IDs can be obtained using the List All Categories command.	MUSIC

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URL To Category failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Category Not Found.

Error Sample Data

Add URL To Category failed.

Status Code: 404.

Message: Category Not Found.

Add URL To Whitelist

Adds URLs to the whitelist.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to add to the whitelist.	JSON `["world.com"]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URL To Whitelist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Add URL To Whitelist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Get Blacklist

Retrieves blacklisted URLs.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Blacklist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Get Blacklist failed.

Status Code: 400.

Message: AUTHENTICATION_FAILED.

Get Sandbox Report

Retrieves a full or summarized report containing details about the MD5 hash of a file analyzed in the sandbox.

READER NOTE

If the selected report type is "Summary", the "Summary" path will provide data on "Summary", "Classification", and "FileProperties". On the other hand, if the selected report type is "Full", the "Full Details" path will include information on "System Summary", "Networking", "Security Bypass", "Stealth", as well as "Summary", "Classification", and "FileProperties". Refer to the sample data for more information.
To use this command, a subscription to the cloud sandbox is required. Without it, the command cannot be executed.

Input

Input Parameter	Required/Optional	Description	Example
MD5 Hash	Required	The MD5 hash of the file analyzed in the sandbox.	b3b13c2fe5710507612106cb11ceced3
Report Type	Optional	The report type (i.e., full or summary) to return. The default setting is Summary.	Full

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Sandbox Report failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Cloud Sandbox subscription is required, but it is currently expired.

Error Sample Data

Get Sandbox Report failed.

Status Code: 403.

Message: Cloud Sandbox subscription is required, but it is currently expired.

Get URL Category

Retrieves the categories of the given URLs. If the total number of URLs exceeds 100, only the first 100 functional URLs will be processed.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Required	The list of URLs to retrieve their respective categories.	JSON `["google.com","youtube.com","facebook.com"]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL Category failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid URL.

Error Sample Data

Get URL Category failed.

Status Code: 400.

Message: Invalid URL.

Get Whitelist

Retrieves whitelisted URLs.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Whitelist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Get Whitelist failed.

Status Code: 400.

Message: AUTHENTICATION_FAILED.

List All Categories

Retrieves a list of all categories.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List All Categories failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

List All Categories failed.

Status Code: 400.

Message: AUTHENTICATION_FAILED.

Remove URL From Blacklist

Removes URLs from the blacklist. Note: After running the command, it will indicate that all URLs are removed successfully without errors; however, only the specified URLs will be removed.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to remove from the blacklist.	JSON `["Hello.com"]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URL From Blacklist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Remove URL From Blacklist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Remove URL From Whitelist

Removes URLs from the whitelist.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to remove from the whitelist.	JSON `["remove.com"]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URL From Whitelist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Remove URL From Whitelist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Upload File to Sandbox

Uploads files to the Zscaler Sandbox.

File ID and File Source

It is not recommended to use the Test Command feature with the <command name> command as it is designed for dynamic input files in Playbooks, Incident Attachments, and Artifact Attachments. There is a simple workaround to test the command:

Navigate to Configuration on the top bar menu.
Click on Utility Commands on the left sidebar menu.
Use the search box to find and select the Create a File from input Text Array command.
Click on the Test tab.
Input the required information for the parameters.
Click on the Test Command button. A D3 File ID will appear in the output data after the file has been successfully created. The D3 File Source of the created file will be Playbook File.

Input

Input Parameter	Required/Optional	Description	Example
File IDs	Required	The file path of the file source. The options for file paths are: Incident Attachment: Incident.file.file ID Playbook File: Task output Artifact File: Incident.Events.file.file ID	JSON `[ "473" ]`
File Source	Required	The file source of the file to send. The options for file sources are: Incident Attachment File: Manually uploaded file from Incident Playbook File: Output from another Task Artifact File: Ingested Artifact in an Event	Playbook File
Force Submit	Required	Enabling this will submit the file(s) to Zscaler sandbox even if found malicious during AV scan and a verdict already exists.	True

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Upload File to sandbox failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: File Not Found.

Error Sample Data

Upload File to sandbox failed.

Status Code: 404.

Message: File Not Found.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 400.

Message: AUTHENTICATION_FAILED.