openapi: 3.2.0 info: title: Mist MSPs SSO API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: MSPs SSO description: 'MSP SSO, or Single Sign-On, is a method of authentication that allows users to securely log in to multiple applications and websites with a single set of login credentials. It involves integrating the MSP portal with an Identity Provider (IdP) using the Security Assertion Markup Language (SAML) framework. This enables users to authenticate themselves through their corporate IdP, eliminating the need to remember separate passwords or enter credentials each time they access the MSP portal.' paths: /api/v1/msps/{msp_id}/ssos: parameters: [] get: tags: - MSPs SSO summary: listMspSsos description: List SSO identity provider configurations defined for this MSP. operationId: listMspSsos parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: type: array items: $ref: '#/components/schemas/sso' description: List of SSO configurations examples: - - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/json examples: Example: value: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string application/vnd.api+json: schema: type: array items: $ref: '#/components/schemas/sso' description: List of SSO configurations examples: - - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/vnd.api+json examples: Example: value: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - MSPs SSO summary: createMspSso description: Create an MSP SSO identity provider configuration, including provider settings and role-handling behavior. operationId: createMspSso parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Request Body contentMediaType: application/json required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Single sign-on identity provider configuration examples: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/json examples: Example: value: created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Single sign-on identity provider configuration examples: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/vnd.api+json examples: Example: value: created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/msps/{msp_id}/ssos/{sso_id}: parameters: [] delete: tags: - MSPs SSO summary: deleteMspSso description: Delete an MSP SSO identity provider configuration so it can no longer be used for administrator login. operationId: deleteMspSso parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false get: tags: - MSPs SSO summary: getMspSso description: Return one MSP SSO identity provider configuration, including provider settings and generated SSO URLs. operationId: getMspSso parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Single sign-on identity provider configuration examples: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/json examples: Example: value: created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Single sign-on identity provider configuration examples: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/vnd.api+json examples: Example: value: created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false put: tags: - MSPs SSO summary: updateMspSso description: Update an MSP SSO identity provider configuration, such as IdP URLs, certificates, issuer, NameID format, and unmatched-role handling. operationId: updateMspSso parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Request Body examples: - custom_logout_url: string idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string name: string nameid_format: email contentMediaType: application/json examples: Example: value: custom_logout_url: string idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string name: string nameid_format: email required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Single sign-on identity provider configuration examples: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/json examples: Example: value: created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/sso' - description: Single sign-on identity provider configuration examples: - created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string contentMediaType: application/vnd.api+json examples: Example: value: created_time: 0 custom_logout_url: string default_role: string domain: string id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 idp_cert: string idp_sign_algo: sha256 idp_sso_url: string ignore_unmatched_roles: true issuer: string modified_time: 0 msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 name: string nameid_format: email org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1 type: string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/msps/{msp_id}/ssos/{sso_id}/delete_admins: parameters: [] post: tags: - MSPs SSO summary: deleteMspSsoAdmins description: Remove SSO-linked MSP administrator accounts by email for this SSO profile. operationId: deleteMspSsoAdmins parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/sso_delete_admins' - description: Request Body examples: - emails: - john@abc.com - may@abc.com contentMediaType: application/json examples: Example: value: emails: - john@abc.com - may@abc.com required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/sso_delete_admins_response' - description: Result of deleting SSO admin accounts contentMediaType: application/json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/msps/{msp_id}/ssos/{sso_id}/failures: parameters: [] get: tags: - MSPs SSO summary: listMspSsoLatestFailures description: List recent authentication failures for this MSP SSO configuration, including failure details and captured SAML assertion data when available. operationId: listMspSsoLatestFailures parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_sso_failure_search' - description: Response containing recent SSO authentication failure records examples: - results: - detail: string saml_assertion_xml: string timestamp: 0 contentMediaType: application/json examples: Example: value: results: - detail: string saml_assertion_xml: string timestamp: 0 application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_sso_failure_search' - description: Response containing recent SSO authentication failure records examples: - results: - detail: string saml_assertion_xml: string timestamp: 0 contentMediaType: application/vnd.api+json examples: Example: value: results: - detail: string saml_assertion_xml: string timestamp: 0 '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/msps/{msp_id}/ssos/{sso_id}/metadata: parameters: [] get: tags: - MSPs SSO summary: getMspSamlMetadata description: Return generated SAML service provider metadata for this MSP SSO configuration as JSON. operationId: getMspSamlMetadata parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/saml_metadata' - description: Read-only SAML and SCIM metadata generated for an SSO configuration examples: - acs_url: https://api.mist.com/api/v1/saml/llDfa13f/login entity_id: https://api.mist.com/api/v1/saml/llDfa13f/login logout_url: https://api.mist.com/api/v1/saml/llDfa13f/logout metadata: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified contentMediaType: application/json examples: Example: value: acs_url: https://api.mist.com/api/v1/saml/llDfa13f/login entity_id: https://api.mist.com/api/v1/saml/llDfa13f/login logout_url: https://api.mist.com/api/v1/saml/llDfa13f/logout metadata: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/saml_metadata' - description: Read-only SAML and SCIM metadata generated for an SSO configuration examples: - acs_url: https://api.mist.com/api/v1/saml/llDfa13f/login entity_id: https://api.mist.com/api/v1/saml/llDfa13f/login logout_url: https://api.mist.com/api/v1/saml/llDfa13f/logout metadata: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified contentMediaType: application/vnd.api+json examples: Example: value: acs_url: https://api.mist.com/api/v1/saml/llDfa13f/login entity_id: https://api.mist.com/api/v1/saml/llDfa13f/login logout_url: https://api.mist.com/api/v1/saml/llDfa13f/logout metadata: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/msps/{msp_id}/ssos/{sso_id}/metadata.xml: parameters: [] get: tags: - MSPs SSO summary: downloadMspSamlMetadata description: 'Download generated SAML service provider metadata XML for this MSP SSO configuration. Example of metadata.xml: ```xml urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified Mist ```' operationId: downloadMspSamlMetadata parameters: - name: msp_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: sso_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: type: string description: File contentEncoding: base64 contentMediaType: application/json application/vnd.api+json: schema: type: string description: File contentEncoding: base64 contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: sso_ldap_type2: title: sso_ldap_type2 enum: - azure - custom - google - okta type: string description: 'Provider template for LDAP SSO when `idp_type`==`ldap`. enum: `azure`, `custom`, `google`, `okta`.' response_sso_failure_search: title: response_sso_failure_search required: - results type: object properties: results: uniqueItems: true type: array items: $ref: '#/components/schemas/response_sso_failure_search_item' description: SSO authentication failure records returned by the request description: Response containing recent SSO authentication failure records sso_delete_admins: title: sso_delete_admins required: - emails type: object properties: emails: type: array items: type: string description: List of admin email addresses to delete description: Request body listing SSO admin email addresses to delete response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response sso_idp_type2: title: sso_idp_type2 enum: - ldap - mxedge_proxy - oauth - saml - openroaming type: string description: 'Identity provider type for this SSO configuration. enum: `ldap`, `mxedge_proxy`, `oauth`, `saml`, `openroaming`.' oauth_ping_identity_region1: title: oauth_ping_identity_region1 enum: - asia - au - ca - eu - us type: string description: 'Ping Identity region for OAuth SSO when `oauth_type`==`ping_identity`. enum: `asia`, `au`, `ca`, `eu`, `us`.' response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response oauth_provider_domain1: title: oauth_provider_domain1 enum: - okta.com - oktapreview.com - okta-emea.com - okta-gov.com - okta.mil - mtls.okta.com type: string description: 'Provider domain for Okta OAuth SSO when `oauth_type`==`okta`. enum: `okta.com`, `oktapreview.com`, `okta-emea.com`, `okta-gov.com`, `okta.mil`, `mtls.okta.com`.' examples: - okta.com response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response sso_idp_sign_algo2: title: sso_idp_sign_algo2 enum: - sha1 - sha256 - sha384 - sha512 type: string description: 'SAML assertion signing algorithm. Required if `idp_type`==`saml`. enum: `sha1`, `sha256`, `sha384`, `sha512`.' sso_oauth_type2: title: sso_oauth_type2 enum: - azure - azure-gov - okta - ping_identity type: string description: 'Provider type for OAuth SSO when `idp_type`==`oauth`. enum: `azure`, `azure-gov`, `okta`, `ping_identity`.' sso: title: sso required: - name type: object properties: created_time: type: number description: Time when this SSO configuration was created, in epoch seconds readOnly: true custom_logout_url: type: string description: If `idp_type`==`saml`, a URL we will redirect the user after user logout from Mist (for some IdP which supports a custom logout URL that is different from SP-initiated SLO process) default_role: type: string description: If `idp_type`==`saml`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched domain: type: string description: "Random string generated during the SSO creation and used to generate the SAML URLs:\n * ACS URL = `/api/v1/saml/{domain}/login` (e.g. `https://api.mist.com/api/v1/saml/s4t5vwv8/login`)\n * Single Logout URL = `/api/v1/saml/{domain}/logout` (e.g. `https://api.mist.com/api/v1/saml/s4t5vwv8/logout`)" readOnly: true group_filter: type: string description: Required if `ldap_type`==`custom`, LDAP filter that will identify the type of group id: type: string description: Unique identifier for this SSO configuration contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f idp_cert: type: string description: If `idp_type`==`saml`. IDP Cert (used to verify the signed response) idp_sign_algo: allOf: - $ref: '#/components/schemas/sso_idp_sign_algo2' - description: 'SAML assertion signing algorithm. Required if `idp_type`==`saml`. enum: `sha1`, `sha256`, `sha384`, `sha512`.' idp_sso_url: type: string description: Required if `idp_type`==`saml`, IDP Single-Sign-On URL idp_type: allOf: - $ref: '#/components/schemas/sso_idp_type2' - description: 'Identity provider type for this SSO configuration. enum: `ldap`, `mxedge_proxy`, `oauth`, `saml`, `openroaming`.' ignore_unmatched_roles: type: boolean description: If `idp_type`==`saml`, ignore any unmatched roles provided in assertion. By default, an assertion is treated as invalid for any unmatched role issuer: type: string description: If `idp_type`==`saml`. IDP issuer URL ldap_base_dn: type: string description: Required if `idp_type`==`ldap`, whole domain or a specific organization unit (container) in Search base to specify where users and groups are found in the LDAP tree examples: - DC=abc,DC=com ldap_bind_dn: type: string description: Required if `idp_type`==`ldap`, the account used to authenticate against the LDAP examples: - CN=nas,CN=users,DC=abc,DC=com ldap_bind_password: type: string description: Required if `idp_type`==`ldap`, the password used to authenticate against the LDAP examples: - secret ldap_cacerts: type: array items: type: string description: CA certificates used to validate LDAP or LDAPS server certificates. Required if `idp_type`==`ldap` examples: - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' - '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----' ldap_client_cert: type: string description: If `idp_type`==`ldap`, LDAPS Client certificate examples: - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' ldap_client_key: type: string description: If `idp_type`==`ldap`, Key for the `ldap_client_cert` examples: - '-----BEGIN PRI...' ldap_group_attr: type: string description: Group attribute used to resolve LDAP memberships. If `ldap_type`==`custom` default: memberOf ldap_group_dn: type: string description: Group search base used for custom LDAP group lookup. If `ldap_type`==`custom` default: base_dn ldap_resolve_groups: type: boolean description: If `idp_type`==`ldap`, whether to recursively resolve LDAP groups default: false ldap_server_hosts: type: array items: type: string description: Server hostnames or IP addresses for LDAP or LDAPS when `idp_type`==`ldap` examples: - - hostname - 63.1.3.5 ldap_type: allOf: - $ref: '#/components/schemas/sso_ldap_type2' - description: 'Provider template for LDAP SSO when `idp_type`==`ldap`. enum: `azure`, `custom`, `google`, `okta`.' ldap_user_filter: type: string description: Required if `ldap_type`==`custom`, LDAP filter that will identify the type of user examples: - (mail=%s) member_filter: type: string description: Required if `ldap_type`==`custom`,LDAP filter that will identify the type of member examples: - (CN=%s) modified_time: type: number description: Time when this SSO configuration was last modified, in epoch seconds readOnly: true msp_id: type: string description: Owning MSP identifier for this SSO configuration, when MSP-scoped contentEncoding: uuid readOnly: true examples: - b9d42c2e-88ee-41f8-b798-f009ce7fe909 mxedge_proxy: allOf: - $ref: '#/components/schemas/sso_mxedge_proxy2' - description: Mist Edge proxy settings used when `idp_type`==`mxedge_proxy` name: type: string description: Display name of the SSO configuration nameid_format: allOf: - $ref: '#/components/schemas/sso_nameid_format2' - description: 'SAML NameID format used when `idp_type`==`saml`. enum: `email`, `unspecified`.' oauth_cc_client_id: type: string description: Required if `idp_type`==`oauth`, Client Credentials examples: - e60da615-7def-4c5a-8196-43675f45e174 oauth_cc_client_secret: type: string description: Required if `idp_type`==`oauth`, oauth_cc_client_secret is RSA private key, of the form "-----BEGIN RSA PRIVATE KEY--...." contentEncoding: password examples: - REDACTED_AZURE_AD_CLIENT_SECRET oauth_discovery_url: type: string description: OAuth discovery document URL used when `idp_type`==`oauth` oauth_ping_identity_region: allOf: - $ref: '#/components/schemas/oauth_ping_identity_region1' - description: 'Ping Identity region for OAuth SSO when `oauth_type`==`ping_identity`. enum: `asia`, `au`, `ca`, `eu`, `us`.' oauth_provider_domain: allOf: - $ref: '#/components/schemas/oauth_provider_domain1' - description: 'Provider domain for Okta OAuth SSO when `oauth_type`==`okta`. enum: `okta.com`, `oktapreview.com`, `okta-emea.com`, `okta-gov.com`, `okta.mil`, `mtls.okta.com`.' examples: - okta.com oauth_ropc_client_id: type: string description: If `idp_type`==`oauth`, ropc = Resource Owner Password Credentials examples: - 9ce04c97-b5b1-4ec8-af17-f5ed42d2daf7 oauth_ropc_client_secret: type: string description: If `oauth_type`==`azure` or `oauth_type`==`azure-gov`. oauth_ropc_client_secret can be empty contentEncoding: password examples: - blM9R~6kWFMVFYl4TFZ3fi~8cMdyDONi6cj01dqI oauth_tenant_id: type: string description: Required if `idp_type`==`oauth`, oauth_tenant_id examples: - dev-88336535 oauth_type: allOf: - $ref: '#/components/schemas/sso_oauth_type2' - description: 'Provider type for OAuth SSO when `idp_type`==`oauth`. enum: `azure`, `azure-gov`, `okta`, `ping_identity`.' openroaming_ssids: type: array items: type: string description: SSIDs that support OpenRoaming, used when `idp_type`==`openroaming` examples: - - ssid_name1 - ssid_name2 openroaming_wba_client_cert: type: string description: Optional WBA-issued client certificate for OpenRoaming. If not provided, the default WBA-issued certificate for Juniper will be used. contentEncoding: password examples: - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' openroaming_wba_client_key: type: string description: Optional WBA-issued client private key for OpenRoaming. If not provided, the default WBA-issued key for Juniper will be used. contentEncoding: password examples: - REDACTED_PRIVATE_KEY_EXAMPLE org_id: type: string description: Owning organization identifier for this SSO configuration contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 role_attr_extraction: type: string description: If `idp_type`==`saml`, custom role attribute parsing scheme. Supported Role Parsing Schemes
NameScheme
`cn`
  • The expected role attribute format in SAML Assertion is "CN=cn,OU=ou1,OU=ou2,…"
  • CN (the key) is case-insensitive and exactly 1 CN is expected (or the entire entry will be ignored)
E.g. if role attribute is "CN=cn,OU=ou1,OU=ou2" then parsed role value is "cn"
role_attr_from: type: string description: If `idp_type`==`saml`, name of the attribute in SAML Assertion to extract role from default: Role scim_enabled: type: boolean description: If `idp_type`==`oauth`, indicates if SCIM provisioning is enabled for the OAuth IDP default: false scim_secret_token: type: string description: If `idp_type`==`oauth`, scim_secret_token (auto-generated when not provided by caller and `scim_enabled`==`true`, empty string when `scim_enabled`==`false`) is used as the Bearer token in the Authorization header of SCIM provisioning requests by the IDP contentEncoding: password examples: - FBitbKPE1aecSloPGBuqqPxDUrFeZyZk site_id: type: string description: Associated site identifier for this SSO configuration, when site-scoped contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 description: Single sign-on identity provider configuration saml_metadata: title: saml_metadata type: object properties: acs_url: type: string description: If `idp_type`==`saml`, Assertion Consumer Service URL that receives SAML responses for this Mist SSO configuration readOnly: true examples: - https://api.mist.com/api/v1/saml/llDfa13f/login entity_id: type: string description: If `idp_type`==`saml`, service provider entity ID for this Mist SSO configuration readOnly: true examples: - https://api.mist.com/api/v1/saml/llDfa13f/login logout_url: type: string description: If `idp_type`==`saml`, Single Logout URL used by the identity provider to end the Mist SSO session readOnly: true examples: - https://api.mist.com/api/v1/saml/llDfa13f/logout metadata: type: string description: If `idp_type`==`saml`, service provider metadata XML for configuring the identity provider readOnly: true examples: - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified scim_base_url: type: string description: If `idp_type`==`oauth` and `scim_enabled`==`true`, SCIM base URL that the identity provider uses to send provisioning requests to Mist examples: - https://scim.nac-staging.mistsys.com/S_41b2525a-e8b8-4809-8168-f1d8dcbe9735/azure/4d72b1dc-7503-4717-81ea-80d0125b886e description: Read-only SAML and SCIM metadata generated for an SSO configuration sso_delete_admins_response: title: sso_delete_admins_response type: object properties: deleted: type: array items: type: string description: List of email addresses that were successfully deleted errors: type: array items: type: string description: List of error messages for emails that could not be deleted description: Result of deleting SSO admin accounts sso_mxedge_proxy2: title: sso_mxedge_proxy2 type: object properties: acct_servers: type: array items: $ref: '#/components/schemas/sso_mxedge_proxy_acct_server' description: RADIUS accounting servers used by the Mist Edge SSO proxy auth_servers: type: array items: $ref: '#/components/schemas/sso_mxedge_proxy_auth_server' description: RADIUS authentication servers used by the Mist Edge SSO proxy mxcluster_id: type: string description: Mist Edge cluster identifier that provides the SSO proxy contentEncoding: uuid examples: - 572586b7-f97b-a22b-526c-8b97a3f609c4 operator_name: type: string description: Operator name as RADIUS attribute while proxying proxy_hosts: type: array items: type: string description: Public hostnames or IP addresses that clients use to reach the Mist Edge SSO proxy examples: - - mxedge1.corp.com - 63.1.3.5 ssids: type: array items: type: string description: Eduroam SSIDs handled by the Mist Edge SSO proxy examples: - - eduroam_test, eduroam_main description: Mist Edge proxy settings used when `idp_type`==`mxedge_proxy` sso_nameid_format2: title: sso_nameid_format2 enum: - email - unspecified type: string description: 'SAML NameID format used when `idp_type`==`saml`. enum: `email`, `unspecified`.' sso_mxedge_proxy_acct_server: title: sso_mxedge_proxy_acct_server type: object properties: host: type: string description: RADIUS accounting server hostname or IP address examples: - 1.2.3.4 port: type: integer description: UDP port for RADIUS accounting requests contentEncoding: int32 default: 1813 secret: type: string description: Shared secret used with the RADIUS accounting server contentEncoding: password examples: - testing123 description: RADIUS accounting server for the Mist Edge SSO proxy response_sso_failure_search_item: title: response_sso_failure_search_item required: - detail - saml_assertion_xml - timestamp type: object properties: detail: type: string description: Failure details reported for the SSO authentication attempt saml_assertion_xml: type: string description: SAML assertion XML captured for the failed SSO authentication attempt timestamp: type: number description: Epoch timestamp, in seconds, when the SSO authentication failure occurred readOnly: true description: SSO authentication failure record response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response sso_mxedge_proxy_auth_server: title: sso_mxedge_proxy_auth_server type: object properties: host: type: string description: RADIUS authentication server hostname or IP address examples: - 1.2.3.4 port: type: integer description: UDP port for RADIUS authentication requests contentEncoding: int32 default: 1812 require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false retry: type: integer description: Number of retry attempts for RADIUS authentication requests contentEncoding: int32 default: 2 secret: type: string description: Shared secret used with the RADIUS authentication server contentEncoding: password examples: - testing123 timeout: type: integer description: Authentication request timeout, in seconds contentEncoding: int32 default: 5 description: RADIUS authentication server for the Mist Edge SSO proxy securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header