# zscaler/terraform-provider-zpa architecture

> Architecture diagram of the GitHub repository zscaler/terraform-provider-zpa, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zscaler/terraform-provider-zpa
- Repository: https://github.com/zscaler/terraform-provider-zpa

## Overview

This is a Terraform provider for managing and reading Zscaler Private Access (ZPA) configuration. The principal workflow is Terraform invoking the provider, whose resource handlers translate configuration into ZPA API operations and reconcile returned state; data sources read existing ZPA objects into Terraform. The tree shows broad application, policy, infrastructure, identity, and privileged-access capabilities. Only selected handlers were sampled, so subsystem links below represent the provider’s documented product surface; detailed registration and client wiring are not asserted.

Main entry points: [`zpa/provider.go`](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/provider.go) (Provider setup), [`main.go`](https://github.com/zscaler/terraform-provider-zpa/blob/master/main.go) (Plugin entry), [`zpa/data_source_zpa_private_cloud_controller.go`](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_private_cloud_controller.go) (ZPA data sources), [`zpa/resource_zpa_application_segment.go`](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_application_segment.go) (Application segments)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Provider runtime"]
  node_entry["Plugin entry<br/>[main.go]"]
  node_provider["Provider setup<br/>[provider.go]"]
  node_client["Client configuration<br/>[config.go]"]
  node_data_sources["ZPA data sources"]
end

subgraph group_apps["Applications and policy"]
  node_app_segments["Application segments"]
  node_app_data["Application lookups"]
  node_policy["Access policies"]
  node_inspection["Inspection controls"]
  node_isolation["Browser isolation"]
end

subgraph group_infra["Connectors and infrastructure"]
  node_connectors["App connectors"]
  node_private_cloud["Private cloud"]
  node_service_edges["Service edges"]
  node_provisioning["Provisioning keys"]
end

subgraph group_access["Identity and portals"]
  node_microtenants["Microtenants"]
  node_idp["Identity providers"]
  node_pra["Privileged access"]
  node_user_portal["User portals"]
end

node_terraform(("Terraform"))
node_zpa_api["ZPA API"]

node_terraform -->|"starts plugin"| node_entry
node_entry -->|"serves provider"| node_provider
node_provider -->|"configures client"| node_client
node_provider -->|"registers resources"| node_app_segments
node_provider -->|"registers resources"| node_policy
node_provider -->|"registers resources"| node_connectors
node_provider -->|"registers resources"| node_microtenants
node_provider -->|"registers sources"| node_data_sources
node_app_segments -->|"manages objects"| node_zpa_api
node_app_data -->|"reads objects"| node_zpa_api
node_policy -->|"manages rules"| node_zpa_api
node_inspection -->|"manages controls"| node_zpa_api
node_isolation -->|"manages profiles"| node_zpa_api
node_connectors -->|"manages groups"| node_zpa_api
node_private_cloud -->|"manages cloud"| node_zpa_api
node_service_edges -->|"manages groups"| node_zpa_api
node_provisioning -->|"manages keys"| node_zpa_api
node_microtenants -->|"manages tenants"| node_zpa_api
node_idp -->|"reads identity"| node_zpa_api
node_pra -->|"manages consoles"| node_zpa_api
node_user_portal -->|"manages portals"| node_zpa_api
node_data_sources -->|"reads objects"| node_zpa_api

click node_entry "https://github.com/zscaler/terraform-provider-zpa/blob/master/main.go"
click node_provider "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/provider.go"
click node_client "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/config.go"
click node_app_segments "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_application_segment.go"
click node_app_data "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_application_segment.go"
click node_policy "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_policy_access_rule.go"
click node_inspection "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_inspection_profile.go"
click node_isolation "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_cloud_browser_isolation_external_profile.go"
click node_connectors "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_app_connector_group.go"
click node_private_cloud "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_private_cloud.go"
click node_service_edges "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_service_edge_group.go"
click node_provisioning "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_provisioning_key.go"
click node_microtenants "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_microtenant_controller.go"
click node_idp "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_idp_controller.go"
click node_pra "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_pra_console_controller.go"
click node_user_portal "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_user_portal_controller.go"
click node_data_sources "https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_private_cloud_controller.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_provider,node_client,node_data_sources toneBlue
class node_app_segments,node_app_data,node_policy,node_inspection,node_isolation toneAmber
class node_connectors,node_private_cloud,node_service_edges,node_provisioning,node_zpa_api toneMint
class node_microtenants,node_idp,node_pra,node_user_portal toneRose
class node_terraform toneIndigo
```

## Components

### Provider runtime

- [Plugin entry](https://github.com/zscaler/terraform-provider-zpa/blob/master/main.go): `main.go`
- [Provider setup](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/provider.go): `zpa/provider.go`
- [Client configuration](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/config.go): `zpa/config.go`
- [ZPA data sources](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_private_cloud_controller.go): `zpa/data_source_zpa_private_cloud_controller.go`

### Applications and policy

- [Application segments](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_application_segment.go): `zpa/resource_zpa_application_segment.go`
- [Application lookups](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_application_segment.go): `zpa/data_source_zpa_application_segment.go`
- [Access policies](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_policy_access_rule.go): `zpa/resource_zpa_policy_access_rule.go`
- [Inspection controls](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_inspection_profile.go): `zpa/resource_zpa_inspection_profile.go`
- [Browser isolation](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_cloud_browser_isolation_external_profile.go): `zpa/resource_zpa_cloud_browser_isolation_external_profile.go`

### Connectors and infrastructure

- [App connectors](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_app_connector_group.go): `zpa/resource_zpa_app_connector_group.go`
- [Private cloud](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_private_cloud.go): `zpa/resource_zpa_private_cloud.go`
- [Service edges](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_service_edge_group.go): `zpa/resource_zpa_service_edge_group.go`
- [Provisioning keys](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_provisioning_key.go): `zpa/resource_zpa_provisioning_key.go`

### Identity and portals

- [Microtenants](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_microtenant_controller.go): `zpa/resource_zpa_microtenant_controller.go`
- [Identity providers](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/data_source_zpa_idp_controller.go): `zpa/data_source_zpa_idp_controller.go`
- [Privileged access](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_pra_console_controller.go): `zpa/resource_zpa_pra_console_controller.go`
- [User portals](https://github.com/zscaler/terraform-provider-zpa/blob/master/zpa/resource_zpa_user_portal_controller.go): `zpa/resource_zpa_user_portal_controller.go`

### Other components

- **Terraform**
- **ZPA API**

## Connections

- Terraform → Plugin entry: starts plugin
- Plugin entry → Provider setup: serves provider
- Provider setup → Client configuration: configures client
- Provider setup → Application segments: registers resources
- Provider setup → Access policies: registers resources
- Provider setup → App connectors: registers resources
- Provider setup → Microtenants: registers resources
- Provider setup → ZPA data sources: registers sources
- Application segments → ZPA API: manages objects
- Application lookups → ZPA API: reads objects
- Access policies → ZPA API: manages rules
- Inspection controls → ZPA API: manages controls
- Browser isolation → ZPA API: manages profiles
- App connectors → ZPA API: manages groups
- Private cloud → ZPA API: manages cloud
- Service edges → ZPA API: manages groups
- Provisioning keys → ZPA API: manages keys
- Microtenants → ZPA API: manages tenants
- Identity providers → ZPA API: reads identity
- Privileged access → ZPA API: manages consoles
- User portals → ZPA API: manages portals
- ZPA data sources → ZPA API: reads objects