Zero Trust Network Access

aid: zero-trust-network-access
name: Zero Trust Network Access
description: >-
  Zero Trust Network Access (ZTNA) is a security framework and product
  category that grants access to private applications and resources based on
  identity, device posture, and context, rather than network location. ZTNA
  replaces the implicit trust of legacy VPNs with explicit per-request
  verification, creating one-to-one encrypted tunnels between authenticated
  users and the specific applications they are authorized to use. This topic
  collects the leading ZTNA vendors, the standards bodies that govern the
  underlying primitives, and the data schemas used to describe access
  policies, identities, devices, and resources.
type: Index
url: https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/
tags:
- Access Control
- Cloud Security
- Cybersecurity
- Identity Management
- Network Access
- Network Security
- Security
- VPN Replacement
- Zero Trust
- ZTNA
created: '2025'
modified: '2026-05-03'
specificationVersion: '0.19'
apis:
- aid: zero-trust-network-access:cloudflare-zero-trust
  name: Cloudflare Zero Trust API
  description: >-
    Cloudflare Zero Trust (formerly Cloudflare for Teams / Cloudflare
    Access) provides ZTNA, secure web gateway, browser isolation, CASB,
    and DLP through a single global edge platform. The Cloudflare API
    exposes endpoints for managing Access applications, policies, identity
    providers, device posture, tunnels, and gateway rules.
  humanURL: https://developers.cloudflare.com/cloudflare-one/
  tags:
  - Cloudflare
  - SASE
  - ZTNA
  properties:
  - type: Documentation
    url: https://developers.cloudflare.com/cloudflare-one/
  - type: APIReference
    url: https://developers.cloudflare.com/api/
  - type: Authentication
    url: https://developers.cloudflare.com/fundamentals/api/get-started/keys/
  - url: graphql/zero-trust-network-access-graphql.md
    type: GraphQL
- aid: zero-trust-network-access:zscaler-zpa
  name: Zscaler Private Access (ZPA) API
  description: >-
    Zscaler Private Access is a cloud-native ZTNA service that connects
    authenticated users to private applications without exposing them to
    the internet or placing them on the corporate network. The ZPA Public
    API supports application segments, server groups, policies, posture
    profiles, and connector groups.
  humanURL: https://help.zscaler.com/zpa/api-reference
  tags:
  - SASE
  - Zscaler
  - ZTNA
  properties:
  - type: Documentation
    url: https://help.zscaler.com/zpa
  - type: APIReference
    url: https://help.zscaler.com/zpa/api-reference
- aid: zero-trust-network-access:netskope-private-access
  name: Netskope Private Access API
  description: >-
    Netskope Private Access provides ZTNA as part of the Netskope SASE
    platform, brokering authenticated access to private applications across
    cloud and on-premises. The Netskope REST API surfaces operations on
    private apps, publishers, policies, and risk events.
  humanURL: https://docs.netskope.com/en/netskope-help/admin-console/rest-api/
  tags:
  - Netskope
  - SASE
  - ZTNA
  properties:
  - type: Documentation
    url: https://docs.netskope.com/en/netskope-help/admin-console/rest-api/
- aid: zero-trust-network-access:palo-alto-prisma-access
  name: Palo Alto Prisma Access (Prisma SASE) API
  description: >-
    Palo Alto Networks Prisma Access offers cloud-delivered ZTNA, SWG, and
    FWaaS as part of the Prisma SASE platform. The Prisma Access REST API
    exposes operations on remote networks, mobile users, security policies,
    and decryption rules.
  humanURL: https://docs.paloaltonetworks.com/prisma/prisma-access
  tags:
  - Palo Alto
  - SASE
  - ZTNA
  properties:
  - type: Documentation
    url: https://docs.paloaltonetworks.com/prisma/prisma-access
- aid: zero-trust-network-access:tailscale-api
  name: Tailscale API
  description: >-
    Tailscale is a WireGuard-based mesh-VPN ZTNA platform that exposes a
    REST API for managing devices, ACL policies, tailnet keys, DNS, and
    audit logs. It implements identity-based device-to-device tunnels
    brokered by an identity-aware control plane.
  humanURL: https://tailscale.com/api
  tags:
  - Mesh VPN
  - Tailscale
  - WireGuard
  - ZTNA
  properties:
  - type: Documentation
    url: https://tailscale.com/api
  - type: APIReference
    url: https://tailscale.com/api
  - type: GitHubOrganization
    url: https://github.com/tailscale
- aid: zero-trust-network-access:twingate-api
  name: Twingate API
  description: >-
    Twingate is a software-defined ZTNA platform that exposes a GraphQL
    Admin API for managing remote networks, resources, groups, users,
    service accounts, and connectors.
  humanURL: https://www.twingate.com/docs/api
  tags:
  - Twingate
  - ZTNA
  properties:
  - type: Documentation
    url: https://www.twingate.com/docs/api
  - type: APIReference
    url: https://www.twingate.com/docs/api
common:
- type: Documentation
  title: Cloudflare - What Is Zero Trust
  url: https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/
  description: Cloudflare's reference explainer on Zero Trust security and ZTNA.
- type: Documentation
  title: Gartner Definition of ZTNA
  url: https://www.gartner.com/en/information-technology/glossary/zero-trust-network-access-ztna-
  description: Gartner glossary entry defining ZTNA as a market category.
- type: Documentation
  title: NIST SP 800-207 (ZTA underpinnings of ZTNA)
  url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
  description: NIST Special Publication 800-207 - the architectural foundation behind ZTNA.
- type: Compliance
  title: CISA Zero Trust Maturity Model
  url: https://www.cisa.gov/zero-trust-maturity-model
  description: CISA Zero Trust Maturity Model that ZTNA deployments are commonly aligned to.
- type: Portal
  title: Cloudflare Zero Trust
  url: https://www.cloudflare.com/zero-trust/
- type: Portal
  title: Zscaler Zero Trust Exchange
  url: https://www.zscaler.com/products-and-solutions/zero-trust-exchange
- type: Portal
  title: Netskope SASE
  url: https://www.netskope.com/platform/sase
- type: Portal
  title: Palo Alto Networks Prisma Access
  url: https://www.paloaltonetworks.com/sase/access
- type: Portal
  title: Tailscale
  url: https://tailscale.com/
- type: Portal
  title: Twingate
  url: https://www.twingate.com/
- type: GitHubOrganization
  title: Tailscale on GitHub
  url: https://github.com/tailscale
- type: GitHubOrganization
  title: WireGuard
  url: https://github.com/WireGuard
- type: JSONSchema
  title: ZTNA Access Policy Schema
  url: json-schema/zero-trust-network-access-policy-schema.json
- type: JSONSchema
  title: ZTNA Application Schema
  url: json-schema/zero-trust-network-access-application-schema.json
- type: JSONSchema
  title: ZTNA Device Posture Schema
  url: json-schema/zero-trust-network-access-device-posture-schema.json
- type: JSONStructure
  title: ZTNA Access Policy Structure
  url: json-structure/zero-trust-network-access-policy-structure.json
- type: JSONLD
  title: ZTNA JSON-LD Context
  url: json-ld/zero-trust-network-access-context.jsonld
- type: CodeExamples
  title: ZTNA Access Policy Example
  url: examples/zero-trust-network-access-policy-example.json
- type: CodeExamples
  title: ZTNA Device Posture Example
  url: examples/zero-trust-network-access-device-posture-example.json
- type: Resources
  title: ZTNA Vocabulary
  url: vocabulary/zero-trust-network-access-vocabulary.yaml
- type: Features
  data:
  - name: Identity-Centric Access
    description: Access decisions are based on user and workload identity rather than network location.
  - name: Application-Level Tunnels
    description: One-to-one encrypted connections between authenticated users and specific applications.
  - name: Device Posture Checks
    description: Continuous evaluation of device health, OS patch level, EDR status, and certificate state.
  - name: Context-Aware Policy
    description: Policies factor in time, location, risk score, and behavior in addition to identity.
  - name: Application Cloaking
    description: Private applications are dark to the public internet and not advertised by IP or DNS.
  - name: SSO and MFA Integration
    description: Native integration with SAML, OIDC, and modern MFA providers.
  - name: Microsegmentation
    description: Lateral movement is prevented by issuing scoped, per-application access.
  - name: Continuous Authorization
    description: Sessions are reauthenticated and reauthorized as conditions change.
- type: UseCases
  data:
  - name: VPN Replacement
    description: Replacing legacy site-to-site and remote-access VPNs with identity-aware brokered access.
  - name: Third-Party Contractor Access
    description: Granting time-bounded, application-scoped access to vendors and contractors.
  - name: M&A Network Integration
    description: Enabling acquired companies to reach internal applications without merging networks.
  - name: BYOD Access
    description: Allowing personal and unmanaged devices to access selected applications under posture rules.
  - name: Privileged Access
    description: Brokering jump-host and bastion access to sensitive infrastructure.
  - name: Multi-Cloud Application Access
    description: Providing consistent ZTNA across applications hosted in AWS, Azure, GCP, and on-premises.
- type: Integrations
  data:
  - name: Okta
    description: Enterprise identity provider used by virtually all ZTNA platforms.
  - name: Microsoft Entra ID
    description: Cloud identity platform integrated as IdP for ZTNA brokers.
  - name: CrowdStrike Falcon
    description: EDR signals fed into ZTNA device-posture rules.
  - name: SentinelOne
    description: EDR signals fed into ZTNA device-posture rules.
  - name: Jamf
    description: macOS / iOS MDM signals integrated into device posture for ZTNA.
  - name: Intune
    description: Microsoft Endpoint Manager signals integrated into device posture for ZTNA.
  - name: Splunk
    description: SIEM destination for ZTNA access and audit logs.
  - name: ServiceNow
    description: ITSM workflow integration for granting and revoking ZTNA access.
- type: Integrations
  url: https://www.cloudflare.com/partners/technology-partners/
integrations:
- name: Google cloud
- name: Cyber Risk-icon
- name: Identity Providers-icon
- name: Mobile Device Management-icon
- name: Threat Intelligence-icon
- name: Network Observability-icon
- name: Edge Database-icon
- name: Workers Observability-icon
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com