Block AI Tools with Zscaler Internet Access (ZIA)

# Create a custom URL category via the ZIA API
# Step 1: Authenticate and obtain a session token

curl -X POST "https://zsapi.zscaler.net/api/v1/authenticatedSession" \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "YOUR_OBFUSCATED_API_KEY",
    "username": "[email protected]",
    "password": "YOUR_PASSWORD",
    "timestamp": "1720483200000"
  }'

# Step 2: Create the custom URL category with AI tool domains

curl -X POST "https://zsapi.zscaler.net/api/v1/urlCategories" \
  -H "Content-Type: application/json" \
  -H "Cookie: JSESSIONID=YOUR_SESSION_ID" \
  -d '{
    "configuredName": "AI Tools Blocklist",
    "customCategory": true,
    "superCategory": "USER_DEFINED",
    "type": "URL_CATEGORY",
    "urls": [
      "openai.com",
      "chat.openai.com",
      "claude.ai",
      "anthropic.com",
      "gemini.google.com",
      "midjourney.com",
      "jasper.ai",
      "copy.ai",
      "writesonic.com",
      "huggingface.co"
    ],
    "dbCategorizedUrls": [],
    "description": "AI tool domains from aitoolsblocklist.com — updated daily"
  }'

# Complete Python script: sync AI Tools Blocklist feed to ZIA custom URL category
# Run daily via cron: 0 3 * * * /usr/bin/python3 /opt/scripts/zia_ai_sync.py

import requests, json, time, hashlib, sys

ZIA_BASE     = "https://zsapi.zscaler.net/api/v1"
ZIA_USERNAME = "[email protected]"
ZIA_PASSWORD = "YOUR_PASSWORD"
ZIA_API_KEY  = "YOUR_API_KEY"
FEED_URL     = "https://feeds.aitoolsblocklist.com/v1/domains?format=json&key=YOUR_FEED_KEY"
CATEGORY_ID  = 12345678  # Your custom URL category ID

def obfuscate_api_key(api_key, timestamp):
    high = timestamp[-6:]
    low = str(int(high) >> 1)
    key = ""
    for i in range(len(high)):
        key += api_key[int(high[i])]
    for i in range(len(low)):
        key += api_key[int(low[i]) + 2]
    return key

# Step 1: Fetch latest AI tool domains from our feed
print("[*] Fetching AI tool domain feed...")
feed = requests.get(FEED_URL).json()
domains = feed["domains"]
print(f"[+] Retrieved {len(domains)} domains")

# Step 2: Authenticate with ZIA API
ts = str(int(time.time() * 1000))
obf_key = obfuscate_api_key(ZIA_API_KEY, ts)
session = requests.Session()
auth_resp = session.post(f"{ZIA_BASE}/authenticatedSession", json={
    "apiKey": obf_key, "username": ZIA_USERNAME,
    "password": ZIA_PASSWORD, "timestamp": ts
})
auth_resp.raise_for_status()
print("[+] Authenticated with ZIA API")

# Step 3: Update the custom URL category with new domains
update_resp = session.put(f"{ZIA_BASE}/urlCategories/{CATEGORY_ID}", json={
    "configuredName": "AI Tools Blocklist",
    "urls": domains,
    "description": f"Updated {time.strftime('%Y-%m-%d')} — {len(domains)} AI tool domains"
})
update_resp.raise_for_status()
print(f"[+] Updated category with {len(domains)} domains")

# Step 4: Activate the configuration change
activate_resp = session.post(f"{ZIA_BASE}/status/activate", json={
    "status": "ACTIVE"
})
activate_resp.raise_for_status()
print("[+] Configuration activated — all ZIA nodes will apply the update")

# Step 5: Clean up session
session.delete(f"{ZIA_BASE}/authenticatedSession")
print("[+] Session closed. Sync complete.")

# ZIA API: Bulk domain upload using the URL lookup endpoint
# Useful for verifying which domains ZIA already categorizes vs. custom additions

curl -X POST "https://zsapi.zscaler.net/api/v1/urlLookup" \
  -H "Content-Type: application/json" \
  -H "Cookie: JSESSIONID=YOUR_SESSION_ID" \
  -d '[
    "openai.com",
    "claude.ai",
    "midjourney.com",
    "newaitool.com",
    "obscure-ai-assistant.io"
  ]'

# Response shows Zscaler's built-in categorization for each domain:
# [
#   {"url":"openai.com", "urlClassifications":["AI/ML Applications"]},
#   {"url":"claude.ai", "urlClassifications":["AI/ML Applications"]},
#   {"url":"newaitool.com", "urlClassifications":["Uncategorized"]},
#   ...
# ]
# Domains classified as "Uncategorized" by Zscaler are exactly why you
# need the custom URL category — they will not be blocked by default.