zscaler
diff --git a/‎CHANGELOG.md‎
Lines changed: 94 additions & 1 deletion b/‎CHANGELOG.md‎
Lines changed: 94 additions & 1 deletion
diff --git a/‎CLAUDE.md‎
Lines changed: 16 additions & 0 deletions b/‎CLAUDE.md‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 55 additions & 1 deletion b/‎README.md‎
Lines changed: 55 additions & 1 deletion
@@ -1,5 +1,98 @@
 # Zscaler Python SDK Changelog
 
+## 1.9.35 (July 6, 2026)
+
+### Notes
+
+- Python Versions: **v3.9, v3.10, v3.11, v3.12**
+
+### Enhancements
+
+#### Zscaler Cellular (ZCell) New Endpoints
+[PR #542](https://github.com/zscaler/zscaler-sdk-python/pull/542) - Added the following new Zscaler Cellular (ZCell) API Endpoints:
+  - Added `GET /customers/{id}/anomaly-policy` to retrieve the list of anomaly policies.
+  - Added `POST /customers/{id}/anomaly-policy` to create a new anomaly policy.
+  - Added `PATCH /customers/{id}/anomaly-policy/{policyId}` to update an anomaly policy.
+  - Added `DELETE /customers/{id}/anomaly-policy/{policyId}` to delete an anomaly policy.
+  - Added `GET /customers/{id}/anomaly-policy/{policyId}/logs` to retrieve past anomaly policy logs.
+  - Added `PATCH /customers/{id}/anomaly-policy/{policyId}/status` to enable or disable an anomaly policy.
+  - Added `GET /customers/{id}/anomaly-policy/{policyId}/violations` to retrieve anomaly policy violations.
+  - Added `GET /customers/{id}/anomaly-policy/{policyId}/violations/{iccid}` to retrieve anomaly policy violations by ICCID.
+  - Added `GET /customers/{id}/sim-location-groups` to retrieve the list of SIM location groups.
+  - Added `GET /customers/{id}/sim-location-groups/{groupId}` to retrieve a SIM location group.
+  - Added `POST /customers/{id}/sim-location-groups` to create a SIM location group.
+  - Added `PUT /customers/{id}/sim-location-groups/{groupId}` to update a SIM location group.
+  - Added `DELETE /customers/{id}/sim-location-groups/{groupId}` to delete a SIM location group.
+  - Added `POST /customers/{id}/sim/analytics/map` to retrieve SIM analytics map data.
+  - Added `GET /customers/{id}/sim/analytics/summary` to retrieve the SIM analytics summary.
+  - Added `GET /customers/{id}/sim/analytics/usage/countries` to retrieve SIM usage by country.
+  - Added `GET /customers/{id}/sim/analytics/usage/day` to retrieve SIM usage by day.
+  - Added `GET /customers/{id}/sim/analytics/usage/sims` to retrieve SIM usage by SIM.
+  - Added `GET /customers/{id}/regions` to retrieve the list of customer regions.
+  - Added `PUT /customers/{id}/regions` to deploy or update customer regions.
+  - Added `GET /customers/{id}/regions/operational-status` to retrieve the operational status of customer regions.
+  - Added `POST /audit/customers/{id}/search` to search customer audit data.
+  - Added `GET /audit/metadata` to retrieve audit metadata.
+  - Added `POST /network-events/{id}/search/startTime/{startTime}/endTime/{endTime}` to search network events within a time window.
+  - Added `GET /customers/{id}/sims/details` to retrieve SIM details by ICCID.
+  - Added `POST /customers/{id}/sims/download` to download SIM data as a CSV file.
+  - Added `PATCH /customers/{id}/sims/assign/tag` to assign a tag to SIMs.
+  - Added `PATCH /customers/{id}/sims/lock` to lock SIMs.
+  - Added `POST /customers/{id}/sims/search` to search SIM data with filtering and pagination.
+  - Added `PATCH /customers/{id}/sims/status` to update the status of SIMs.
+  - Added `PATCH /customers/{id}/sims/{iccid}/assign` to assign an eSIM and return the activation code.
+  - Added `PATCH /customers/{id}/sims/{iccid}/state` to fetch and refresh the provider eSIM state.
+  - Added `GET /customers/{id}/tag` to retrieve the list of tags.
+  - Added `POST /customers/{id}/tag` to create a new tag.
+  - Added `GET /customers/{id}` to retrieve customer data.
+  - Added `PUT /customers/{id}` to activate an end customer.
+  - Added support for a configurable ZCell customer id via the `zcellCustomerId` config attribute and the `ZCELL_CUSTOMER_ID` environment variable, which is automatically injected into the `/customers/{id}` request path so it does not need to be passed on every call. The explicit `id` argument is still supported and takes precedence. This value is independent from ZPA's `customerId`.
+
+#### Zscaler Private Access (ZPA) New Endpoints
+[PR #542](https://github.com/zscaler/zscaler-sdk-python/pull/542) - Added the following new Zscaler Private Access (ZPA) API Endpoints:
+  - Added `GET /application/host/{host_id}` - Get federated applications with search, sorting, and pagination
+  - Added `PUT /application/federate` - Federate an application with guest customers
+  - Added `PUT /policySet/rules/policyType/GLOBAL_POLICY/guest/{guest_id}` - Get policy rules created by partner on federated applications
+  - Added `GET /businessContinuitySettings/certificate` - Download SP Certificate
+  - Added `GET /businessContinuitySettings/metadata` - Download SP Metadata information
+  - Added `GET /businessContinuitySettings` - Gets Business Continuity Setting for customer
+  - Added `POST /businessContinuitySettings` - Creates Business Continuity Setting for the customer
+  - Added `GET /businessContinuitySettings/{id}` - Get Business Continuity Setting for the given customer by Id
+  - Added `PUT /businessContinuitySettings/{id}` - Update Business Continuity Setting for the given customer by Id
+  - Added `DELETE /businessContinuitySettings/{id}` - Delete Business Continuity Setting for the Customer
+  - Added `GET /iamidpmapping` Retrieves the IamIdpMapping details for the customer
+  - Added `GET /privateCloud` Retrieves all configured Private clouds for the specified customer.
+  - Added `GET /privateCloud` Retrieves Private cloud details for the specified ID.
+  - Added `POST /privateCloud` Adds a new Private cloud for the specified customer.
+  - Added `PUT /privateCloud` Updates the Private cloud for the specified ID.
+  - Added `DELETE /privateCloud` Deletes the Private cloud for the specified ID.
+  - Added `GET /tenant-federation/partners` Retrieves active federation partners for a customer.
+  - Added `PUT /tenant-federation/approval` Request approval for tenant federation using token.
+  - Added `POST /tenant-federation/token` Create federation token for a customer by microtenant.
+  - Added `POST /tenant-federation/token/verify` Verify federation token.
+  - Added `GET /tenant-federation` Get provisioning requests for a customer with search, sorting, and pagination.
+  - Added `DELETE /tenant-federation/{federation_id}` Delete tenant federation by Federation ID.
+  - Added `PUT /tenant-federation/{federation_id}/provisioning-state/{status}` Update tenant federation provisioning state (APPROVED, DENIED, TERMINATED).
+  - Added `PUT /tenant-federation/{federation_id}/notes` Update notes for tenant federation provisioning. Initiator updates initiatorNotes, partner updates partnerNotes.
+  - Added `PUT /tenant-federation/{federation_id}/federatopm-state/{status}` Update tenant federation status (ACTIVE or INACTIVE).
+
+#### Zscaler Internet Access (ZIA) New Endpoints
+[PR #542](https://github.com/zscaler/zscaler-sdk-python/pull/542) - Added the following new Zscaler Private Access (ZPA) API Endpoints:
+  - `GET /integrationPartners` Retrieves a list of partners and services integrated with the Zscaler service
+  - `GET /integrationPartners/crowdStrike/endpoints` Retrieves the list of CrowdStrike endpoints based on the indicator of compromise (IOC) query, with pagination support
+  - `POST /integrationPartners/crowdStrike/endpoints` Accepts a list of CrowdStrike endpoint or device IDs in the request body and fetches detailed endpoint or device data for those IDs
+  - `GET /integrationPartners/crowdStrike/whitelistedBaseUrls` Retrieves a list of CrowdStrike configured whitelisted base URLs (allowist URLs).
+  - `POST /integrationPartners/microsoftDefender/endpoints` Configures the integration of Microsoft Defender for Endpoint APIs with Zscaler.
+  - `GET /integrationPartners/sandbox/report/{md5}` Retrieves the MD5 hash of the file required to view the Sandbox Detail Report.
+  - `GET /httpHeaderProfile` Retrieves a list of HTTP header profiles.
+  - `POST /httpHeaderProfile` Adds a new HTTP header profile.
+  - `PUT /httpHeaderProfile/{id}` Updates the HTTP header profile based on the specified ID
+  - `DELETE /httpHeaderProfile/{id}` Deletes the HTTP header profile based on the specified ID
+  - `GET /httpHeaderActionProfile` Retrieves a list of HTTP header insertion profiles.
+  - `POST /httpHeaderActionProfile` Adds a new HTTP header insertion profile.
+  - `PUT /httpHeaderActionProfile/{id}` Updates the HTTP header insertion profile based on the specified ID
+  - `DELETE /httpHeaderActionProfile/{id}` Deletes the HTTP header insertion profile based on the specified ID
+
 ## 1.9.34 (July 1, 2026)
 
 ### Notes
@@ -4817,4 +4910,4 @@ Refer to the [README](https://github.com/zscaler/zscaler-sdk-python/blob/master/
 
 - Python Versions: **v3.8, v3.9, v3.10, v3.11**
 
-🎉 **Initial Release** 🎉
+🎉 **Initial Release** 🎉
@@ -97,6 +97,22 @@ These shadow `transform_common_id_fields` for those fields (the helper finds not
 
 `add_id_groups` (also in `zscaler/utils.py`) is the original ZPA helper and never coerces. It still exists for backwards compatibility and is kept in `application_segment.py`'s `add_segment_provision` flow and `pra_credential_pool.py`. New code in ZPA should prefer `transform_common_id_fields(..., coerce_ids=False)` so the service converges on a single helper.
 
+## ZCell-Specific Architecture
+
+Every ZCell endpoint is scoped to a customer (`/customers/{id}`). Rather than forcing callers to repeat that id on every call, the SDK resolves it once and auto-injects it — analogous to, but **completely independent from**, ZPA's `customerId`. Never conflate `zcellCustomerId` with ZPA's `customerId`.
+
+### `zcellCustomerId` resolution
+
+- **Config key**: `zcellCustomerId` (declared in `zscaler/config/config_setter.py`'s `_DEFAULT_CONFIG["client"]`). **Env var**: `ZCELL_CUSTOMER_ID`. Both are distinct from ZPA's `customerId` / `ZPA_CUSTOMER_ID`.
+- `zscaler/oneapi_client.py` resolves `zcellCustomerId` (config → `ZCELL_CUSTOMER_ID` env) and writes the resolved value back into `self._config["client"]["zcellCustomerId"]` after `ConfigValidator`, so the env fallback reaches the service clients.
+- `ZCellService.__init__(request_executor, config)` forwards `config` to every ZCell API. Each API `__init__(self, request_executor, config=None)` reads `self._zcell_customer_id = (config or {}).get("client", {}).get("zcellCustomerId")`.
+- Every ZCell method keeps `id: str = None` as its first parameter (for backwards compatibility) and resolves `id = id or self._zcell_customer_id` before building the URL. **Precedence**: explicit `id` arg → config `zcellCustomerId` → `ZCELL_CUSTOMER_ID` env.
+- No client-side validation is done when all three are absent (mirrors ZPA): the request proceeds and the API returns the error. For methods whose path requires additional ids after `id` (`policy_id`, `group_id`, `iccid`, `enabled`), those also default to `None` solely to satisfy Python's "no required-argument-after-default" rule — they are still logically required.
+
+### Pagination
+
+ZCell uses **0-based** `page` numbering (default size 10, max 100). The centralized engine (`oneapi_response.py`) has a dedicated `zcell` branch that decrements its internal 1-based page counter before each request. Do not change other services' paging when touching this branch.
+
 ## Key Conventions
 
 | Aspect | Convention |
 
@@ -57,6 +57,7 @@ used in your server-side code to interact with the Zscaler API platform across m
 * [Z-Insights - ZINS](https://help.zscaler.com/zscaler-analytics/getting-started) — GraphQL Analytics API
 * [ZMS - Zscaler Microsegmentation](https://help.zscaler.com/legacy-apis/using-zscaler-microsegmentation-api) — GraphQL Microsegmentation API
 * [Business Insights](https://automate.zscaler.com/docs/docs/api-reference-and-guides/api-reference/bi)
+* [Zscaler Cellular API (ZCell)](https://help.zscaler.com/)
 
 This SDK is designed to support the new Zscaler API framework [OneAPI](https://automate.zscaler.com/docs/getting-started/getting-started)
 via a single OAuth2 HTTP client. The SDK is also backwards compatible with the previous
@@ -234,6 +235,7 @@ In most cases, you won't need to build the SDK from source. If you want to build
 * [ZMS - Zscaler Microsegmentation](https://help.zscaler.com/legacy-apis/using-zscaler-microsegmentation-api) — GraphQL Microsegmentation API
 * [Zscaler AI Guard API](https://help.zscaler.com/ai-guard)
 * [Business Insights](https://automate.zscaler.com/docs/docs/api-reference-and-guides/api-reference/bi)
+* [Zscaler Cellular API (ZCell)](https://help.zscaler.com/)
 
 ## Usage guide
 
@@ -268,6 +270,7 @@ As of the publication of SDK version => 1.7.x, OneAPI is available for programma
 * [ZMS - Zscaler Microsegmentation](https://help.zscaler.com/legacy-apis/using-zscaler-microsegmentation-api) — GraphQL Microsegmentation API
 * [Zscaler AI Guard API](https://help.zscaler.com/ai-guard)
 * [Business Insights](https://automate.zscaler.com/docs/docs/api-reference-and-guides/api-reference/bi)
+* [Zscaler Cellular API (ZCell)](https://help.zscaler.com/)
 
 **NOTE** All other products such as Zscaler Cloud Connector (ZTW) and Zscaler Digital Experience (ZDX) are supported only via the legacy authentication method described in this README.
 
@@ -379,6 +382,56 @@ The authentication to Zscaler Private Access (ZPA) via the OneAPI framework, req
 | `vanityDomain`       | _(String)_ Refers to the domain name used by your organization `https://<vanity_domain>.zslogin.net/oauth2/v1/token` | `ZSCALER_VANITY_DOMAIN` |
 | `cloud`
 
+### Authenticating to Zscaler Cellular (ZCell)
+
+The authentication to Zscaler Cellular (ZCell) via the OneAPI framework uses the same Zidentity OAuth2 credentials (`clientId`, `clientSecret`/`privateKey`, `vanityDomain`, `cloud`) as the other products. ZCell API endpoints are scoped to a specific customer (`/customers/{id}`), so the SDK provides a dedicated `zcellCustomerId` attribute — and the `ZCELL_CUSTOMER_ID` environment variable — which is automatically injected into the request path. This value is completely independent from ZPA's `customerId`.
+
+You can supply the ZCell customer id in any of three ways (highest precedence first):
+
+1. Explicitly, as the `id` argument on any ZCell method call.
+2. Via the `zcellCustomerId` attribute in the client configuration.
+3. Via the `ZCELL_CUSTOMER_ID` environment variable.
+
+| Argument     | Description | Environment variable |
+|--------------|-------------|-------------------|
+| `clientId`       | _(String)_ Zscaler API Client ID, used with `clientSecret` or `privateKey` OAuth auth mode.| `ZSCALER_CLIENT_ID` |
+| `clientSecret`       | _(String)_ A string that contains the password for the API admin.| `ZSCALER_CLIENT_SECRET` |
+| `privateKey`       | _(String)_ A string Private key value.| `ZSCALER_PRIVATE_KEY` |
+| `vanityDomain`       | _(String)_ Refers to the domain name used by your organization `https://<vanity_domain>.zslogin.net/oauth2/v1/token` | `ZSCALER_VANITY_DOMAIN` |
+| `cloud`       | _(String)_ The host and basePath for the cloud services API is `$api.<cloud_name>.zsapi.net`.| `ZSCALER_CLOUD` |
+| `zcellCustomerId`       | _(String)_ The ZCell customer ID automatically scoped into the `/customers/{id}` request path. Independent from ZPA's `customerId`.| `ZCELL_CUSTOMER_ID` |
+
+Initialize the client with `zcellCustomerId` and call any ZCell service without repeating the customer id on every method:
+
+```py
+from zscaler import ZscalerClient
+
+config = {
+    "clientId": '{yourClientId}',
+    "clientSecret": '{yourClientSecret}',
+    "vanityDomain": '{yourvanityDomain}',
+    "cloud": "beta",                          # Optional when authenticating to an alternative cloud environment
+    "zcellCustomerId": "72058304855015424",   # ZCell customer id (independent from ZPA's customerId)
+    "logging": {"enabled": False, "verbose": False},
+}
+
+def main():
+    with ZscalerClient(config) as client:
+        # zcellCustomerId is injected automatically — no id argument needed
+        tags, resp, err = client.zcell.tag_handling.list_tag()
+        if err:
+            print(f"Error listing ZCell tags: {err}")
+            return
+        for tag in tags:
+            print(tag)
+
+        # You can still override the customer id explicitly per call
+        tags, resp, err = client.zcell.tag_handling.list_tag(id="another-customer-id")
+
+if __name__ == "__main__":
+    main()
+```
+
 ### Initialize OneAPI OAuth 2.0 Client
 
 #### OneAPI Client ID and Client Secret Authentication
@@ -626,7 +679,7 @@ The header `x-ratelimit-reset` is returned in the API response for each API call
 
 ## Pagination
 
-The pagination system in this SDK is unified across `ZCC`, `ZTW`, `ZDX`, `ZIA`, `ZPA`, `ZWA`
+The pagination system in this SDK is unified across `ZCC`, `ZTW`, `ZDX`, `ZIA`, `ZPA`, `ZWA`, `ZCell`
 and is applied transparently whether you're using the Legacy API Client or the new OneAPI OAuth2 Client.
 
 ✅ This means no code changes are needed when transitioning from the legacy API framework to OneAPI framework.
@@ -765,6 +818,7 @@ Each Zscaler service has its own pagination requirements and limits. The SDK aut
 | ZPA     | 20                    | 500           | Uses `page`, `pagesize`                         |
 | ZTW     | 100                   | Varies        | Uses `page`, `pageSize`                         |
 | ZWA     | Varies by endpoint    | Varies        | Uses `page`, `pageSize`                         |
+| ZCell   | 10                    | 100           | Uses `page` (0-based) + `pageSize`              |
 
 **Important Notes:**
 - ✅ The SDK automatically uses each API's default page size when no `page_size` is specified