ICAP Network-Layer DLP API

Base path: /v1/icap Auth: Session token or API key — see Authentication. Entitlement: entitlement.icap_dlp (every route except GET /connectors). Full-content read additionally requires entitlement.icap_full_capture. Permissions: icap:read (list connectors, read events, read captured content), icap:write (create/update connectors, rotate secret).

Network-layer DLP has two distinct planes. This page covers only the operator/admin REST surface. Inline governance happens out-of-band on the raw-TCP ICAP listener (IcapServerService, port 1344) — an SWG never speaks HTTP/JWT to us, it speaks ICAP (RFC 3507). See the Network-Layer DLP product page.

Plane	Transport	Auth	Who calls it
Operator / admin	REST /v1/icap/*	FlexibleAuthGuard + entitlements + permissions	Your operator UI / dashboards
Inline governance	Raw TCP ICAP, port 1344	X-Trinitite-Connector + X-Trinitite-Icap-Secret	The enterprise SWG (Zscaler, Cisco SWA, Squid, …)

Endpoints

GET /v1/icap/connectors — icap:read

List ICAP connectors. The secret is redacted.

POST /v1/icap/connectors — icap:write

Provision one connector per SWG integration. Creation returns a one-time shared secret the SWG presents on every ICAP transaction — store it immediately; it is never re-readable afterward.

{ "label": "zscaler-prod", "mode": "reqmod", "policy_ref": "policy:dlp_v3" }

Response 201 Created:

{ "id": "icp_01J9X…", "label": "zscaler-prod", "mode": "reqmod", "secret": "ics_…ONCE…", "icap_endpoint": "icap://trinitite.example:1344/reqmod" }

PATCH /v1/icap/connectors/:id — icap:write

Update label / mode / policy_ref. The secret is not rotated here.

POST /v1/icap/connectors/:id/rotate-secret — icap:write

Rotate the shared secret. The old secret remains valid for a configurable overlap window (default 24h) so the SWG can roll without an outage.

GET /v1/icap/events — icap:read

The governance audit feed — every ICAP transaction that produced a verdict. Cursor-paginated, filterable by connector_id, verdict, action, time window.

GET /v1/icap/events/:id/content — icap:read + entitlement.icap_full_capture

The captured request/response body for a single event. Requires the full-capture entitlement; deployments without it return 402 entitlement_missing.

Verdict & action vocabulary

verdict	action	Meaning
passed	allow	No findings; traffic forwarded.
corrected	redact	Sensitive fragment masked in the rewritten ICAP response.
blocked	block	ICAP 403 Forbidden returned to the SWG.

Each event carries the standard dlir_receipt_id cross-link and the chain_hash into the per-connector ledger family.

Errors

HTTP	error.code	When
402	entitlement_missing	Missing entitlement.icap_dlp (or icap_full_capture on content read).
404	not_found	Connector or event id does not exist.
409	conflict	Duplicate label for the org.

---

→ Network-Layer DLP — the product overview. → Masking API — the tokenization engine ICAP redact uses. → Errors, rate limits & conventions — shared contract.