Skip to main content

Applications

An application is a single service hosted by a connector: an HTTP server, an SSH target, a database, and so on. Each application has one or more addresses: each address describes where traffic is intercepted (listenAddress / listenPort) and where it is forwarded.

Forwarding for both address and port is independently controlled by a boolean flag plus the destination it implies:

  • forwardAddress: false (default): Forward to a fixed targetAddress. The flag goes with a single string destination.
  • forwardAddress: true: Pass the listened-on address through to the host, constrained to a non-empty allowedAddresses list (IPs, CIDR blocks, or hostnames). The list is required in this mode; an empty list is rejected.
  • forwardPort: false (default): Forward to a fixed targetPort (integer).
  • forwardPort: true: Pass the listened-on port through, constrained to a non-empty allowedPorts list (ports or port ranges). The list is required in this mode; an empty list is rejected.

Fields​

FieldDescriptionExample
idApplication ide2f3a4b5-6c7d-4e8f-9012-3456789abcde
nameApplication nameeast-web-server
zitiIdZiti service id of the primary service backing this application. Response-only; null while the application is disabled (not materialized)681gcYytKz4VDia793pOkN
zitiNameUnique ziti name. Response-only; never accepted as input8b14d4f9-...|f1e2d3c4-...|east-web-server
typeApplication type — must be a standard catalog name or the value customHTTP
protocolTCP, UDP, or TCP/UDPTCP
enabledWhether the application is materialized into a Ziti service. Defaults to true. When false, the definition is persisted but no Ziti services exist. Required on PUT; optional on PATCH (omit to leave unchanged)true
connectorIdParent connectorf1e2d3c4-b5a6-4789-9012-3456789abcde
providerIdDenormalized from the connector's provider8b14d4f9-3a52-4b91-8e7c-d3e44b5c1f2a
connectorModelIdNon-null when the application was inherited from a Connector model9a8b7c6d-5e4f-4321-9876-543210fedcba
addressesA list of entries, each with listenAddress, listenPort, the forwardAddress / forwardPort flags, the corresponding targetAddress / targetPort (when forwarding is off) or allowedAddresses / allowedPorts (when forwarding is on), and zitiId (response-only Ziti service id)
[
  {
    "listenAddress": "10.10.1.1",
    "listenPort": "8080",
    "forwardAddress": false,
    "targetAddress": "127.0.0.1",
    "forwardPort": false,
    "targetPort": 80,
    "zitiId": "IDBdw9ac6mVExaXpHT9uY"
  }
]

Validated, not free-form​

  • type must be either a standard application type name (e.g. HTTP, HTTPS, SSH; case-insensitive, including disabled catalog rows) or the value custom. Anything else is rejected at the API boundary.
  • name must be unique among the explicit applications on the same connector. On update, the application being edited is excluded so re-saving the same name is a no-op.
  • When the connector has a model attached, a non-inherited application cannot take a name that collides with one of the Model's inherited applications.

Inherited vs. explicit​

  • Explicit applications are created directly via POST /connectors/{id}/applications. connectorModelId is null.
  • Inherited applications are materialized when a model is attached to the connector. They carry connectorModelId = <model uuid> and are immutable via the application endpoints. Edit the model to change them.

Neither kind survives a change of model attachment. Attaching, switching, and detaching all clear the connector outright — every application goes, explicit ones included — and the incoming model's are materialized in their place (or none at all, on a detach). An inherited application is never converted into an explicit one either, so if you need an application to outlive a model change, recreate it afterwards. See Attaching a model.

Discovery​

The /providers/{providerId}/application-types endpoint returns both the standard catalog and a row for every non-inherited application on the provider's connectors whose type is custom. The custom boolean on each row distinguishes the two. That lets a provider see, at a glance, every non-standard connectivity offering in use.

More info​