# Pulse (Ivanti secure access — Connect Secure, Policy Secure, Neurons for Zero Trust Access)

> Ivanti's secure-access product family, formerly Pulse Secure. Three administrator-facing
> REST APIs configure and observe SSL VPN remote access (Ivanti Connect Secure), network
> access control (Ivanti Policy Secure), and zero trust network access (Ivanti Neurons for
> Zero Trust Access). All three are configuration and management interfaces, not data-plane
> APIs: they change who can reach what on a corporate network.

Generated by the API Evangelist enrichment pipeline on 2026-08-29 from this repo's apis.yml
and artifacts. Ivanti does not publish an llms.txt of its own — probed www.ivanti.com,
help.ivanti.com and docs.ivanti.com on 2026-08-29, all 404.

## What you need to know before calling these APIs

- There is NO OpenAPI, Swagger, GraphQL or AsyncAPI document for any of these APIs. The
  contract is prose HTML documentation with worked curl examples. Do not expect to generate
  a client.
- There is NO official SDK in any language. Ivanti's published integration path is curl, or
  a Postman collection downloaded from the customer software portal.
- Ivanti Connect Secure and Ivanti Policy Secure are APPLIANCES the customer runs. The base
  URL is the customer's own appliance host: https://{ics-appliance-host}/api/v1. There is no
  vendor-hosted endpoint to call.
- Ivanti Neurons for Zero Trust Access is a hosted tenant. The base URL is the customer's
  tenant host: https://{nzta-tenant-host}/api/v1.
- Authentication is an ADMINISTRATOR SESSION, not a machine credential. An agent calling
  these APIs is acting as a named appliance or tenant administrator.
- Almost every operation is a write against live network access control. Read
  conventions/pulse-conventions.yml, especially the reversibility block, before writing.

## APIs

- [Ivanti Connect Secure REST API](https://help.ivanti.com/ps/help/en_US/ICS/22.x/apig/rest_api_soln_guide/landingpage.htm):
  Configuration API for ICS SSL VPN appliances — administrators and admin realms,
  authentication auth-servers (local, AD, LDAP, RADIUS, SAML), host-checker policies and
  ESAP packages, sign-in URLs and realms, user roles and role-mapping rules, web and
  network-connect resource policies and profiles, device certificates and CSRs, licensing,
  clustering, VLANs, syslog and SNMP logging, system maintenance, health check and active
  user sessions. Base https://{ics-appliance-host}/api/v1
- [Ivanti Policy Secure REST API](https://help.ivanti.com/ps/help/en_US/IPS/vNow/pcs-pps-rest-api/landingpage.htm):
  Same guide, same auth, same /api/v1 tree, with the network-access-control branch under
  /api/v1/configuration/uac — admission control clients and policies, infranet enforcer
  connections and auth-table-mapping and resource-access policies, MAC address realms,
  RADIUS clients and attribute policies, TACACS+ network-device-administration clients,
  groups and policies, and SNMP enforcement. Base https://{ips-appliance-host}/api/v1
- [Ivanti Neurons for Zero Trust Access REST API](https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-zta/api/landingpage.htm):
  Tenant API for nZTA — applications and resources, resource groups, user policies, secure
  access policies, role-mapping rules, user rule groups, users, authentication servers,
  gateways and gateway groups and gateway settings, device policy groups and rules,
  hostchecker levels and products, MDM servers, lockdown exceptions, syslog integrations,
  user risk score action configs, licence storage consumption, and a large analytics surface
  (summary ribbon, world map, sankey, top-N widgets, logs search, application access).
  Base https://{nzta-tenant-host}/api/v1

## Authentication

- ICS / IPS, recommended: POST /api/v1/realm_auth with HTTP Basic (admin username and
  password) and body {"realm": "adminrealm"}. Returns {"api_key": "..."}. Use that api_key
  as the Basic-auth USERNAME with an EMPTY password on every subsequent request. Where the
  realm requires secondary authentication the first response returns a resume_id, which is
  posted back to the same endpoint.
- ICS / IPS, deprecated: GET /api/v1/auth. Ivanti states it "will not be supported from
  22.7R2.1 release onwards" and to migrate scripts to /api/v1/realm_auth.
- REST access is OFF by default. The administrator account must have "Allow access to REST
  APIs" enabled in the admin console or at the serial console. The api_key is invalidated
  when the account or that setting is toggled, and expires at the admin role session timeout.
- nZTA: a DSID session cookie, obtained by driving the tenant admin sign-in flow against
  /login/admin and /dana-na/auth/{DSSIGNIN}/login.cgi with realm "zta-admin-users", or read
  by hand from browser devtools. Sent as: curl -v --cookie "DSID=<value>" <api request url>
- No OAuth 2.0, no OpenID Connect, no client-credentials grant, no scopes. Authorization is
  carried by the admin role and realm, in appliance configuration, not in the token.
- Full detail: authentication/pulse-authentication.yml

## Conventions

- JSON only. GET, POST, PUT, DELETE. No PATCH.
- GET /api/v1/configuration returns an href link map, so the whole configuration tree is
  walkable from one entry point.
- Resource names are carried IN the path and must be percent-encoded (space %20, # %23,
  $ %24, %% %25, & %26, * %2A, / %2F, @ %40, \ %5C). Policy and user names routinely contain
  spaces; this is the most common way a call fails.
- No pagination. No sparse fieldsets. No Idempotency-Key. No dry-run or validate-only mode.
- No rate limits and no rate-limit headers are published. There is no backpressure signal;
  self-pace.
- Errors are plain HTTP status codes with an unspecified JSON body — not RFC 9457. 422
  Unprocessable Entity is the referential-integrity rejection and must be treated as a
  semantic failure, not a transport one.
- Full detail: conventions/pulse-conventions.yml, errors/pulse-problem-types.yml

## Reversibility — read this before any write

- Take a local backup BEFORE writing: POST /api/v1/system/maintenance/archiving/localbackup
  with {"config-type":"system","operation":"save"}, and record the returned identifier. It is
  the only handle on the pre-change state, and nothing creates one automatically.
- Restore: the same endpoint with {"operation":"restore","identifier":<id>}. List available
  backups with GET on the same path. No retention period or backup count is published.
- Whole-config restore: PUT /api/v1/system/binary-configuration?import=normal|full from a
  file exported with POST /api/v1/system/binary-configuration?export=system_config.
  import=normal excludes IP, network and cluster configuration and is the safer mode.
- Software rollback: POST /api/v1/system/maintenance with {"operation":"rollback"}. Read
  which image it lands on first via GET /api/v1/system/system-information, which returns
  rollback-partition-information.
- nZTA publishes DELETE on its objects but NO backup, snapshot or rollback of any kind.

## Repository artifacts

- authentication/pulse-authentication.yml — auth schemes, flows, token lifetime, the
  enablement gate
- conventions/pulse-conventions.yml — methods, encoding, hypermedia, idempotency,
  reversibility, dry-run
- errors/pulse-problem-types.yml — the published error-code table with remediation
- lifecycle/pulse-lifecycle.yml — versioning, the EOL policy and its milestone windows, the
  /api/v1/auth deprecation, status page
- changelog/pulse-changelog.yml — release history read from the ICS release notes
- conformance/pulse-conformance.yml — what the API conforms to, what the product conforms to,
  and the compliance programs
- rate-limits/pulse-rate-limits.yml — an honest zero, with the evidence
- plans/pulse-plans-pricing.yml — sales-gated, no public plans, with the evidence
- packages/pulse-packages.yml — no first-party SDK in any registry
- mcp/pulse-mcp.yml — no MCP server for these products
- security/pulse-domain-security.yml, security/pulse-vulnerability-disclosure.yml,
  security/pulse-trust-center.yml
- well-known/pulse-well-known.yml, well-known/pulse-security.txt

## Provider links

- Product: https://www.ivanti.com/products/connect-secure-vpn
- API documentation hub: https://www.ivanti.com/support/api
- ICS/IPS REST API Solutions Guide: https://help.ivanti.com/ps/help/en_US/ICS/22.x/apig/rest_api_soln_guide/landingpage.htm
- nZTA API guide: https://help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-zta/api/landingpage.htm
- Postman collection instructions: https://help.ivanti.com/ps/help/en_US/ICS/22.x/apig/rest_api_soln_guide/ics_postman_apis.htm
- Documentation index: https://www.ivanti.com/support/product-documentation
- Community: https://forums.ivanti.com/s/welcome-pulse-secure?language=en_US
- Status: https://status.ivanticloud.com/
- Trust center: https://assurance.ivanti.com/
- Vulnerability disclosure: https://www.ivanti.com/support/contact-security
- Blog: https://www.ivanti.com/blog