For an SD-WAN partner to automate location and GRE tunnel creation in ZIA, the administrator must first generate and enter an “SD-WAN Partner Key” in the ZIA portal (Administration → Cloud Service API Key Management). The partner appliance later uses this key via the Zscaler SD-WAN API. Without the key, the integration will fail. Editing of locations remains possible, and today the SD-WAN API supports only GRE tunnels, not IPsec. Therefore option C is the sole correct statement.

A. Current SD-WAN API supports GRE only (Integration Guide p.4).

B. API-created locations are fully editable in the ZIA UI.

D. The key is generated by the Zscaler admin, not sent from the partner.

1. Zscaler Internet Access Admin Guide, “Configuring SD-WAN Partner API Integrations,” Step 2, p. 414-415, 2023-07.

2. Zscaler SD-WAN Partner Integration Guide, v1.2, “Tunnel Support”, p. 4, 2022.