openapi: 3.2.0 info: title: Mist Orgs Network Templates API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Orgs Network Templates description: 'A Network Template is a configuration template that allows for the consistent and standardized configuration of switches across an organization''s network infrastructure. It includes settings such as RADIUS and ntp servers, shared elements like iot or corporate networks, and port profiles for specific devices. Switch templates can be applied at the site level, and they make the initial setup of switches easy and adaptable to specific site or switch settings.' paths: /api/v1/orgs/{org_id}/networktemplates: parameters: [] get: tags: - Orgs Network Templates summary: listOrgNetworkTemplates description: List organization network templates that provide switch network, port, management, routing, NAC, and service configuration at the organization level. operationId: listOrgNetworkTemplates parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: limit in: query description: Maximum number of results to return per page style: form explode: true schema: minimum: 0 type: integer contentEncoding: int32 default: 100 - name: page in: query description: Select the page number to return when using page-based pagination; starts at `1` style: form explode: true schema: minimum: 1 type: integer contentEncoding: int32 default: 1 responses: '200': description: OK headers: {} content: application/json: schema: type: array items: $ref: '#/components/schemas/network_template' description: List of network templates examples: - - additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - 8.8.8.8 - 4.4.4.4 dns_suffix: - .mist.local - .mist.com extra_routes: 0.0.0.0/0: via: 1.2.3.4 group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6808 import_org_networks: - ap mist_nac: enabled: true network: default modified_time: 0 name: template_name networks: corp: vlan_id: 600 default: subnet: 192.168.1.0/24 vlan_id: 1 guest: vlan_id: 700 mgmt: vlan_id: 500 ntp_servers: - 192.168.1.10 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: ap: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: WAP disable_autoneg: false disabled: false duplex: auto enable_mac_auth: false enable_qos: true mac_auth_only: false mac_auth_protocol: pap mac_limit: 0 mode: trunk networks: - guest - corp persist_mac: false poe_disabled: false port_network: default server_reject_network: null storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string iot: allow_dhcpd: true mode: access port_network: default stp_edge: true uplink: all_networks: true enable_qos: false mode: trunk port_network: default stp_edge: false radius_config: acct_interim_interval: 0 acct_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1813 secret: testing123 auth_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1812 secret: testing123 auth_servers_retries: 3 auth_servers_timeout: 5 coa_enabled: false coa_port: 3799 network: default remote_syslog: archive: files: 20 size: 5m console: contents: - facility: config severity: warning enabled: false files: - archive: files: 10 size: 5m contents: - facility: config severity: warning explicit_priority: true file: file-name match: '!alarm|ntp|errors.crc_error[chan]' structured_data: true network: default send_to_all_servers: false servers: - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: millisecond users: - contents: - facility: config severity: warning match: '"!alarm|ntp|errors.crc_error[chan]"' user: '*' switch_matching: enable: true rules: - additional_config_cmds: - set snmp community public match_model: EX4300 match_name[0:3]: abc name: match by name port_config: ge-0/0/0: usage: uplink ge-0/0/8-16ge-1/0/0-47: usage: ap - additional_config_cmds: - set snmp community public2 match_role: access name: match by role port_config: ge-0/0/0: usage: uplink switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string contentMediaType: application/json examples: Example: value: - additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - 8.8.8.8 - 4.4.4.4 dns_suffix: - .mist.local - .mist.com extra_routes: 0.0.0.0/0: via: 1.2.3.4 group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6808 import_org_networks: - ap mist_nac: enabled: true network: default modified_time: 0 name: template_name networks: corp: vlan_id: 600 default: subnet: 192.168.1.0/24 vlan_id: 1 guest: vlan_id: 700 mgmt: vlan_id: 500 ntp_servers: - 192.168.1.10 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: ap: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: WAP disable_autoneg: false disabled: false duplex: auto enable_mac_auth: false enable_qos: true mac_auth_only: false mac_auth_protocol: pap mac_limit: 0 mode: trunk networks: - guest - corp persist_mac: false poe_disabled: false port_network: default server_reject_network: null storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string iot: allow_dhcpd: true mode: access port_network: default stp_edge: true uplink: all_networks: true enable_qos: false mode: trunk port_network: default stp_edge: false radius_config: acct_interim_interval: 0 acct_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1813 secret: testing123 auth_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1812 secret: testing123 auth_servers_retries: 3 auth_servers_timeout: 5 coa_enabled: false coa_port: 3799 network: default remote_syslog: archive: files: 20 size: 5m console: contents: - facility: config severity: warning enabled: false files: - archive: files: 10 size: 5m contents: - facility: config severity: warning explicit_priority: true file: file-name match: '!alarm|ntp|errors.crc_error[chan]' structured_data: true network: default send_to_all_servers: false servers: - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: millisecond users: - contents: - facility: config severity: warning match: '"!alarm|ntp|errors.crc_error[chan]"' user: '*' switch_matching: enable: true rules: - additional_config_cmds: - set snmp community public match_model: EX4300 match_name[0:3]: abc name: match by name port_config: ge-0/0/0: usage: uplink ge-0/0/8-16ge-1/0/0-47: usage: ap - additional_config_cmds: - set snmp community public2 match_role: access name: match by role port_config: ge-0/0/0: usage: uplink switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string application/vnd.api+json: schema: type: array items: $ref: '#/components/schemas/network_template' description: List of network templates examples: - - additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - 8.8.8.8 - 4.4.4.4 dns_suffix: - .mist.local - .mist.com extra_routes: 0.0.0.0/0: via: 1.2.3.4 group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6808 import_org_networks: - ap mist_nac: enabled: true network: default modified_time: 0 name: template_name networks: corp: vlan_id: 600 default: subnet: 192.168.1.0/24 vlan_id: 1 guest: vlan_id: 700 mgmt: vlan_id: 500 ntp_servers: - 192.168.1.10 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: ap: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: WAP disable_autoneg: false disabled: false duplex: auto enable_mac_auth: false enable_qos: true mac_auth_only: false mac_auth_protocol: pap mac_limit: 0 mode: trunk networks: - guest - corp persist_mac: false poe_disabled: false port_network: default server_reject_network: null storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string iot: allow_dhcpd: true mode: access port_network: default stp_edge: true uplink: all_networks: true enable_qos: false mode: trunk port_network: default stp_edge: false radius_config: acct_interim_interval: 0 acct_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1813 secret: testing123 auth_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1812 secret: testing123 auth_servers_retries: 3 auth_servers_timeout: 5 coa_enabled: false coa_port: 3799 network: default remote_syslog: archive: files: 20 size: 5m console: contents: - facility: config severity: warning enabled: false files: - archive: files: 10 size: 5m contents: - facility: config severity: warning explicit_priority: true file: file-name match: '!alarm|ntp|errors.crc_error[chan]' structured_data: true network: default send_to_all_servers: false servers: - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: millisecond users: - contents: - facility: config severity: warning match: '"!alarm|ntp|errors.crc_error[chan]"' user: '*' switch_matching: enable: true rules: - additional_config_cmds: - set snmp community public match_model: EX4300 match_name[0:3]: abc name: match by name port_config: ge-0/0/0: usage: uplink ge-0/0/8-16ge-1/0/0-47: usage: ap - additional_config_cmds: - set snmp community public2 match_role: access name: match by role port_config: ge-0/0/0: usage: uplink switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string contentMediaType: application/vnd.api+json examples: Example: value: - additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - 8.8.8.8 - 4.4.4.4 dns_suffix: - .mist.local - .mist.com extra_routes: 0.0.0.0/0: via: 1.2.3.4 group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6808 import_org_networks: - ap mist_nac: enabled: true network: default modified_time: 0 name: template_name networks: corp: vlan_id: 600 default: subnet: 192.168.1.0/24 vlan_id: 1 guest: vlan_id: 700 mgmt: vlan_id: 500 ntp_servers: - 192.168.1.10 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: ap: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: WAP disable_autoneg: false disabled: false duplex: auto enable_mac_auth: false enable_qos: true mac_auth_only: false mac_auth_protocol: pap mac_limit: 0 mode: trunk networks: - guest - corp persist_mac: false poe_disabled: false port_network: default server_reject_network: null storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string iot: allow_dhcpd: true mode: access port_network: default stp_edge: true uplink: all_networks: true enable_qos: false mode: trunk port_network: default stp_edge: false radius_config: acct_interim_interval: 0 acct_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1813 secret: testing123 auth_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1812 secret: testing123 auth_servers_retries: 3 auth_servers_timeout: 5 coa_enabled: false coa_port: 3799 network: default remote_syslog: archive: files: 20 size: 5m console: contents: - facility: config severity: warning enabled: false files: - archive: files: 10 size: 5m contents: - facility: config severity: warning explicit_priority: true file: file-name match: '!alarm|ntp|errors.crc_error[chan]' structured_data: true network: default send_to_all_servers: false servers: - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: millisecond users: - contents: - facility: config severity: warning match: '"!alarm|ntp|errors.crc_error[chan]"' user: '*' switch_matching: enable: true rules: - additional_config_cmds: - set snmp community public match_model: EX4300 match_name[0:3]: abc name: match by name port_config: ge-0/0/0: usage: uplink ge-0/0/8-16ge-1/0/0-47: usage: ap - additional_config_cmds: - set snmp community public2 match_role: access name: match by role port_config: ge-0/0/0: usage: uplink switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Orgs Network Templates summary: createOrgNetworkTemplate description: 'Create an organization network template with network, port usage, switch management, routing, NAC, and service configuration at the organization level. Network templates can be applied to multiple sites within the organization to provide consistent network configuration across sites. To assign a network template to a site, use the Update Site endpoint and specify the network template ID in the `networktemplate_id` field of the request body.' operationId: createOrgNetworkTemplate parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/network_template' - description: Request Body examples: - additional_config_cmds: - set snmp community public dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string import_org_networks: - ap mist_nac: enabled: true network: string name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 192.0.2.10 property2: via: 198.51.100.1 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string contentMediaType: application/json examples: Example: value: additional_config_cmds: - set snmp community public dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string import_org_networks: - ap mist_nac: enabled: true network: string name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 192.0.2.10 property2: via: 198.51.100.1 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/network_template' - description: Network template configuration applied to sites or site groups examples: - additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6708 import_org_networks: - ap mist_nac: enabled: true network: string modified_time: 0 name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string contentMediaType: application/json examples: Example: value: additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6708 import_org_networks: - ap mist_nac: enabled: true network: string modified_time: 0 name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/network_template' - description: Network template configuration applied to sites or site groups examples: - additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6708 import_org_networks: - ap mist_nac: enabled: true network: string modified_time: 0 name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string contentMediaType: application/vnd.api+json examples: Example: value: additional_config_cmds: - set snmp community public created_time: 0 dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string group_tags: {} id: 497f6eca-6276-4993-bfeb-53cbbbba6708 import_org_networks: - ap mist_nac: enabled: true network: string modified_time: 0 name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.10 networks: - string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/orgs/{org_id}/networktemplates/{networktemplate_id}: parameters: [] delete: tags: - Orgs Network Templates summary: deleteOrgNetworkTemplate description: Delete an organization network template by template ID so it can no longer be applied to sites or site groups. operationId: deleteOrgNetworkTemplate parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: networktemplate_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false get: tags: - Orgs Network Templates summary: getOrgNetworkTemplate description: Retrieve details for a specific organization network template, including network, port usage, switch management, routing, NAC, and service defaults. operationId: getOrgNetworkTemplate parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: networktemplate_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/network_template' - description: Network template configuration applied to sites or site groups contentMediaType: application/json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false put: tags: - Orgs Network Templates summary: updateOrgNetworkTemplate description: Update an organization network template, including network, port usage, switch management, routing, NAC, and service defaults. operationId: updateOrgNetworkTemplate parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: networktemplate_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/network_template' - description: Request Body examples: - additional_config_cmds: - set snmp community public dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string group_tags: {} import_org_networks: - ap mist_nac: enabled: true network: string name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string contentMediaType: application/json examples: Example: value: additional_config_cmds: - set snmp community public dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string group_tags: {} import_org_networks: - ap mist_nac: enabled: true network: string name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/network_template' - description: Network template configuration applied to sites or site groups examples: - additional_config_cmds: - set snmp community public dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string import_org_networks: - ap mist_nac: enabled: true network: string name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string contentMediaType: application/json examples: Example: value: additional_config_cmds: - set snmp community public dhcp_snooping: all_networks: true enable_arp_spoof_check: true enable_ip_source_guard: true enabled: true networks: - string dns_servers: - string dns_suffix: - string extra_routes: property1: via: string property2: via: string import_org_networks: - ap mist_nac: enabled: true network: string name: string networks: property1: subnet: 192.168.1.0/24 vlan_id: 10 property2: subnet: 192.168.1.0/24 vlan_id: 10 ntp_servers: - string port_usages: dynamic: mode: dynamic reset_default_when: link_down rules: - equals: string equals_any: - string expression: string src: lldp_chassis_id usage: string property1: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_auth: dot1x port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string property2: all_networks: false allow_dhcpd: true bypass_auth_when_server_down: true description: string disable_autoneg: false disabled: false duplex: auto enable_mac_auth: true enable_qos: true guest_network: string mac_auth_only: true mac_auth_protocol: pap mac_limit: 0 mode: access networks: - string persist_mac: false poe_disabled: false port_network: string server_reject_network: null speed: auto storm_control: no_broadcast: false no_multicast: false no_registered_multicast: false no_unknown_unicast: false percentage: 80 stp_edge: true voip_network: string switch_mgmt: config_revert_timer: 10 protect_re: enabled: false root_password: string tacacs: acct_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 enabled: true network: string tacplus_servers: - host: 198.51.100.1 port: '49' secret: string timeout: 10 vrf_config: enabled: false vrf_instances: property1: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string property2: extra_routes: property1: via: 198.51.100.1 property2: via: 198.51.100.2 networks: - string '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: extra_route: title: extra_route type: object properties: discard: type: boolean description: Whether to install a discard route; this takes precedence over next-hop settings default: false metric: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route metric for the IPv4 static route contentEncoding: int32 next_qualified: type: object additionalProperties: $ref: '#/components/schemas/extra_route_next_qualified_properties' description: Qualified next-hop settings keyed by IPv4 next-hop address examples: - 10.3.1.1: metric: null preference: 40 no_resolve: type: boolean description: Whether to prevent recursive next-hop resolution for the IPv4 static route default: false preference: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route preference for the IPv4 static route contentEncoding: int32 examples: - 30 via: oneOf: - type: string - type: array items: type: string description: Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route examples: - 10.2.1.1 - "[\n \"10.2.1.1\",\n \"10.2.1.2\"\n]" description: IPv4 static route settings for a destination prefix snmpv3_config_notify_filter_item: title: snmpv3_config_notify_filter_item type: object properties: categories: type: array items: type: string description: CX only. List of SNMP trap group categories included in this filter profile. See https://www.juniper.net/documentation/software/topics/task/configuration/snmp-trap-groups-configuring-junos-nm.html for valid category names. examples: - - link - authentication contents: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_filter_item_content' description: OID filter rules in this notification filter profile profile_name: type: string description: Notification filter profile name description: SNMPv3 notification filter profile response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response protect_re_custom_protocol2: title: protect_re_custom_protocol2 enum: - any - icmp - tcp - udp type: string description: 'Transport protocol matched by this custom Protect RE ACL. enum: `any`, `icmp`, `tcp`, `udp`.' snmp_vacm_access_item_type2: title: snmp_vacm_access_item_type2 enum: - context_prefix - default_context_prefix type: string description: 'VACM context matching type for this access rule. enum: `context_prefix`, `default_context_prefix`.' response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response switch_radius2: title: switch_radius2 type: object properties: enabled: type: boolean description: Whether RADIUS is enabled for switch management authentication radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config1' - description: RADIUS configuration used when alternate RADIUS settings are required use_different_radius: type: string description: Selector for alternate RADIUS settings instead of the default switch `radius_config` description: Management authentication settings using RADIUS sw_routing_policy_term_matching2: title: sw_routing_policy_term_matching2 type: object properties: as_path: type: array items: $ref: '#/components/schemas/bgp_as' description: AS path values that routes must match community: type: array items: type: string description: BGP communities that routes must match prefix: type: array items: type: string description: Route prefixes that routes must match protocol: type: array items: $ref: '#/components/schemas/sw_routing_policy_term_matching_protocol_enum' description: Routing protocols that routes must match description: Route match criteria that must be satisfied before actions are applied aggregate_route: title: aggregate_route type: object properties: discard: type: boolean description: Whether to install the aggregate route as a discard route default: false metric: maximum: 4294967295 minimum: 0 type: - integer - 'null' description: Routing metric assigned to the aggregate route contentEncoding: int32 preference: maximum: 4294967295 minimum: 0 type: - integer - 'null' description: Route preference assigned to the aggregate route contentEncoding: int32 description: Aggregate route configuration for a network or routing instance vrf_extra_route: title: vrf_extra_route type: object properties: via: type: string description: IPv4 next-hop address for this VRF extra route contentEncoding: ipv4 description: Additional IPv4 static route for a VRF instance ip_type12: title: ip_type12 enum: - dhcp - static type: string description: 'IP assignment mode for out-of-band switch management. enum: `dhcp`, `static`.' examples: - static switch_port_usage_dynamic_rule: title: switch_port_usage_dynamic_rule required: - src type: object properties: description: type: string description: Optional description of the rule equals: type: string description: Exact value that the selected source attribute must match equals_any: type: array items: type: string description: List of values where any match satisfies this dynamic rule expression: type: string description: '"[0:3]":"abcdef" -> "abc" "split(.)[1]": "a.b.c" -> "b" "split(-)[1][0:3]: "a1234-b5678-c90" -> "b56"' src: allOf: - $ref: '#/components/schemas/switch_port_usage_dynamic_rule_src2' - description: 'Source attribute evaluated by this dynamic rule. enum: `link_peermac`, `lldp_chassis_id`, `lldp_hardware_revision`, `lldp_manufacturer_name`, `lldp_oui`, `lldp_serial_number`, `lldp_system_description`, `lldp_system_name`, `radius_dynamicfilter`, `radius_usermac`, `radius_username`.' usage: type: string description: Port usage name to apply when this dynamic rule matches description: Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes remote_syslog_facility3: title: remote_syslog_facility3 enum: - any - authorization - change-log - config - conflict-log - daemon - dfc - external - firewall - ftp - interactive-commands - kernel - ntp - pfe - security - user type: string description: 'Syslog facility to match for this selector. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config snmp_vacm_access_item_prefix_list_item: title: snmp_vacm_access_item_prefix_list_item type: object properties: context_prefix: type: string description: Context prefix for this VACM access rule. Required only if `type`==`context_prefix` examples: - iil notify_view: type: string description: Notify view name referenced by this VACM access rule examples: - all read_view: type: string description: Read view name referenced by this VACM access rule examples: - all security_level: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item_level2' - description: 'Required security level for this VACM access rule. enum: `authentication`, `none`, `privacy`.' security_model: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item_model2' - description: 'Required security model for this VACM access rule. enum: `any`, `usm`, `v1`, `v2c`.' type: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_type2' - description: 'VACM context matching type for this access rule. enum: `context_prefix`, `default_context_prefix`.' write_view: type: string description: Write view name referenced by this VACM access rule examples: - all description: Context prefix rule for a VACM access entry snmp_vacm2: title: snmp_vacm2 type: object properties: access: type: array items: $ref: '#/components/schemas/snmp_vacm_access_item' description: VACM access rules for SNMPv3 security_to_group: allOf: - $ref: '#/components/schemas/snmp_vacm_security_to_group2' - description: VACM security-name to group mappings description: SNMPv3 VACM access control configuration snmpv3_config_notify_type2: title: snmpv3_config_notify_type2 enum: - inform - trap type: string description: Delivery mode for this SNMPv3 notification, such as trap or inform bgp_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` ) examples: - '65000' radius_acct_server: title: radius_acct_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS accounting server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this accounting server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS accounting server secret: type: string description: Shared secret used with this RADIUS accounting server contentEncoding: password examples: - testing123 description: RADIUS accounting server settings switch_port_usage_storm_control2: title: switch_port_usage_storm_control2 type: object properties: disable_port: type: boolean description: Whether to disable the port when storm control is triggered default: false no_broadcast: type: boolean description: Whether to disable storm control on broadcast traffic default: false no_multicast: type: boolean description: Whether to disable storm control on multicast traffic default: false no_registered_multicast: type: boolean description: Whether to disable storm control on registered multicast traffic default: false no_unknown_unicast: type: boolean description: Whether to disable storm control on unknown unicast traffic default: false percentage: maximum: 100 minimum: 0 type: integer description: Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth contentEncoding: int32 default: 80 description: Only if `mode`!=`dynamic`. Storm-control settings for this port usage radius_auth_server: title: radius_auth_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS authentication server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this authentication server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS authentication server require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Shared secret used with this RADIUS authentication server contentEncoding: password examples: - testing123 description: RADIUS authentication server settings switch_port_mirroring_property: title: switch_port_mirroring_property type: object properties: input_networks_ingress: type: array items: type: string description: At least one mirror input source should be specified. Networks whose ingress traffic is mirrored input_port_ids_egress: type: array items: type: string description: At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored input_port_ids_ingress: type: array items: type: string description: At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored output_ip_address: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - 1.2.3.4 output_network: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - analyze output_port_id: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - ge-0/0/5 description: Input and output settings for one switch port mirroring session switch_network_multicast2: title: switch_network_multicast2 type: object properties: enabled: type: boolean description: Whether to enable IGMP snooping on this VLAN default: false igmp_version: allOf: - $ref: '#/components/schemas/switch_network_multicast_igmp_version' - description: IGMP version. '2' (default, ASM/IGMPv2) / '3' (SSM/IGMPv3) description: Multicast (IGMP snooping) settings for this VLAN ip_type11: title: ip_type11 enum: - dhcp - static type: string description: 'IP assignment mode for in-band switch management. enum: `dhcp`, `static`.' examples: - static snmp_vacm_security_to_group_content_item: title: snmp_vacm_security_to_group_content_item type: object properties: group: type: string description: VACM group name referenced by this mapping security_name: type: string description: Name of the SNMP security principal mapped to a VACM group description: VACM security-name to group mapping entry junos_port_config_speed1: title: junos_port_config_speed1 enum: - 10m - 100m - 1g - 2.5g - 5g - 10g - 25g - 40g - 100g - auto type: string description: 'Link speed for this Junos port. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' snmp_usm_user_authentication_type2: title: snmp_usm_user_authentication_type2 enum: - authentication-md5 - authentication-none - authentication-sha - authentication-sha224 - authentication-sha256 - authentication-sha384 - authentication-sha512 type: string description: 'Authentication protocol used by this SNMPv3 USM user. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`.' switch_multicast_config3: title: switch_multicast_config3 type: object properties: anycast_rp: type: boolean description: When `true`, auto-generates a shared RP on `is_l3_border` devices (ERB/IPClos topologies only) default: false rp_ip: type: string description: RP address used when `anycast_rp`==`false`. If the address matches a device SVI, it is configured as a local RP; otherwise a static RP is configured examples: - 10.2.1.10 sbd_subnet: type: string description: SBD IRB subnet; Mist auto-assigns per-device IPs from this range (EVPN eOISM only) examples: - 10.99.0.0/24 sbd_vlan_id: type: integer description: Supplemental Bridge Domain VLAN ID (EVPN topology / eOISM only) contentEncoding: int32 examples: - 3900 description: Multicast configuration for this VRF instance. PIM is automatically enabled when any network in this VRF has `multicast.enabled`==`true` snmp_config_client_list: title: snmp_config_client_list type: object properties: client_list_name: type: string description: Name of the SNMP client list examples: - clist-1 clients: type: array items: type: string description: SNMP client IP addresses or CIDR ranges allowed by this list description: SNMP client allowlist definition snmp_usm_engine_type2: title: snmp_usm_engine_type2 enum: - local_engine - remote_engine type: string description: 'SNMP engine type used for this USM configuration. enum: `local_engine`, `remote_engine`.' sw_routing_policy: title: sw_routing_policy type: object properties: terms: minItems: 1 uniqueItems: true type: array items: $ref: '#/components/schemas/sw_routing_policy_term' description: Ordered terms evaluated by this switch routing policy description: Switch routing policy made of ordered match-action terms snmpv3_config_target_param: title: snmpv3_config_target_param type: object properties: message_processing_model: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_mess_process_model2' - description: 'SNMP message processing model used by this target parameter profile. enum: `v1`, `v2c`, `v3`.' name: type: string description: Target parameter profile name notify_filter: type: string description: Notification filter profile referenced by this target parameter profile security_level: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_security_level2' - description: 'Required security level for this target parameter profile. enum: `authentication`, `none`, `privacy`.' security_model: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_security_model2' - description: 'Required security model for this target parameter profile. enum: `usm`, `v1`, `v2c`.' security_name: type: string description: USM security name referenced by this target parameter profile examples: - m01620 description: SNMPv3 target parameter profile acl_tag_spec: title: acl_tag_spec type: object properties: port_range: type: string description: Matched dst port, "0" means any default: '0' protocol: type: string description: '`tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocol_number` is between 1-254, default is `any` `protocol_number` is between 1-254' default: any description: Layer 4 protocol and destination-port match constraint for an ACL tag snmpv3_config_notify_items: title: snmpv3_config_notify_items type: object properties: name: type: string description: Identifier for this SNMPv3 notification definition tag: type: string description: Notification tag used to select target addresses type: allOf: - $ref: '#/components/schemas/snmpv3_config_notify_type2' - description: Delivery mode for this SNMPv3 notification, such as trap or inform description: SNMPv3 notification definition for traps or informs switch_matching_rule_oob_ip_config2: title: switch_matching_rule_oob_ip_config2 type: object properties: type: allOf: - $ref: '#/components/schemas/ip_type12' - description: 'IP assignment mode for out-of-band switch management. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false description: Out-of-band management IP configuration applied when this matching rule matches snmp_vacm_access_item_prefix_list_item_level2: title: snmp_vacm_access_item_prefix_list_item_level2 enum: - authentication - none - privacy type: string description: 'Required security level for this VACM access rule. enum: `authentication`, `none`, `privacy`.' extra_route_next_qualified_properties: title: extra_route_next_qualified_properties type: object properties: metric: type: - integer - 'null' description: Route metric for this qualified IPv4 next hop contentEncoding: int32 preference: type: - integer - 'null' description: Route preference for this qualified IPv4 next hop contentEncoding: int32 description: Qualified next-hop attributes for an IPv4 static route ospf_area: title: ospf_area type: object properties: include_loopback: type: boolean description: Whether loopback interfaces are included in this OSPF area default: false networks: type: object additionalProperties: $ref: '#/components/schemas/ospf_areas_network' description: OSPF network settings keyed by network name examples: - corp: auth_keys: '1': auth-key-1 auth_type: md5 bfd_minimum_interval: 500 dead_interval: 40 hello_interval: 10 interface_type: nbma metric: 10000 guest: passive: true type: allOf: - $ref: '#/components/schemas/ospf_area_type2' - description: 'Area type for this OSPF area. enum: `default`, `nssa`, `stub`.' examples: - default description: Property key is the OSPF Area (Area should be a number (0-255) / IP address) extra_route6: title: extra_route6 type: object properties: discard: type: boolean description: Whether to install a discard route; this takes precedence over next-hop settings default: false metric: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route metric for the IPv6 static route contentEncoding: int32 next_qualified: type: object additionalProperties: $ref: '#/components/schemas/extra_route6_next_qualified_properties' description: Qualified next-hop settings keyed by IPv6 next-hop address examples: - 2a02:1234:200a::100: metric: null preference: 40 no_resolve: type: boolean description: Whether to prevent recursive next-hop resolution for the IPv6 static route default: false preference: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route preference for the IPv6 static route contentEncoding: int32 examples: - 30 via: oneOf: - type: string - type: array items: type: string description: Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route examples: - 10.2.1.1 - "[\n \"10.2.1.1\",\n \"10.2.1.2\"\n]" description: IPv6 static route settings for a destination prefix switch_mist_nac2: title: switch_mist_nac2 type: object properties: enabled: type: boolean description: Whether Mist NAC RadSec is enabled for the switch network: type: string description: Switch network used for Mist NAC RadSec connectivity description: Mist NAC defaults applied by this network template tacacs_auth_server: title: tacacs_auth_server type: object properties: host: type: string description: Address or hostname of the TACACS+ authentication server port: type: string description: TCP port used by the TACACS+ authentication server secret: type: string description: Shared secret used with this TACACS+ authentication server contentEncoding: password timeout: type: integer description: TACACS+ authentication server timeout, in seconds contentEncoding: int32 default: 10 description: TACACS+ authentication server settings switch_bgp_config: title: switch_bgp_config required: - local_as - type type: object properties: auth_key: type: string description: Authentication key used for BGP neighbor sessions, when configured bfd_minimum_interval: maximum: 255000 minimum: 1 type: integer description: Minimum interval in milliseconds for BFD hello packets. A neighbor is considered failed when the device stops receiving replies after the specified interval. Value must be between 1 and 255000. contentEncoding: int32 export_policy: type: string description: Export policy must match one of the policy names defined in the `routing_policies` property. hold_time: oneOf: - $ref: '#/components/schemas/switch_bgp_config_hold_time_zero' - maximum: 65535 minimum: 3 type: integer contentEncoding: int32 description: 'Default BGP hold time for switch BGP sessions. enum: `0`.' import_policy: type: string description: Import policy must match one of the policy names defined in the `routing_policies` property. local_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Local BGP Autonomous System (AS) number for the switch examples: - '65000' neighbors: type: object additionalProperties: $ref: '#/components/schemas/switch_bgp_config_neighbor' description: BGP neighbor settings keyed by neighbor IP address networks: type: array items: type: string description: Network names used to add BGP groups to the corresponding VRFs type: allOf: - $ref: '#/components/schemas/switch_bgp_config_type2' - description: 'BGP session type for this switch BGP configuration. enum: `external`, `internal`.' description: Switch BGP configuration for a routing instance switch_port_usage_dynamic_reset_default_when2: title: switch_port_usage_dynamic_reset_default_when2 enum: - link_down - none type: string description: 'Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage. enum: `link_down`, `none`.' examples: - link_down protect_re_custom: title: protect_re_custom type: object properties: port_range: type: string description: Matched dst port, "0" means any default: '0' examples: - 80,1035-1040 protocol: allOf: - $ref: '#/components/schemas/protect_re_custom_protocol2' - description: 'Transport protocol matched by this custom Protect RE ACL. enum: `any`, `icmp`, `tcp`, `udp`.' subnets: type: array items: type: string description: Source subnets matched by this custom Protect RE ACL description: Custom Protect RE ACL entry snmp_config_trap_version2: title: snmp_config_trap_version2 enum: - all - v1 - v2 type: string description: 'SNMP trap protocol version used by this group. enum: `all`, `v1`, `v2`.' switch_port_usage_mode2: title: switch_port_usage_mode2 enum: - access - dynamic - inet - trunk type: string description: 'Switching mode for this port usage. enum: `access`, `dynamic`, `inet`, `trunk`.' switch_network: title: switch_network required: - vlan_id type: object properties: gateway: type: string description: Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway gateway6: type: string description: Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway isolation: type: boolean description: 'whether to stop clients to talk to each other, default is false (when enabled, a unique isolation_vlan_id is required). NOTE: this features requires uplink device to also a be Juniper device and `inter_switch_link` to be set. See also `inter_isolation_network_link` and `community_vlan_id` in port_usage' default: false isolation_vlan_id: type: string description: Required when `isolation`==`true`. Unique VLAN ID used for client isolation examples: - '3070' multicast: allOf: - $ref: '#/components/schemas/switch_network_multicast2' - description: Multicast (IGMP snooping) settings for this VLAN subnet: type: string description: Optional for pure switching, required when L3 / routing features are used subnet6: type: string description: Optional for pure switching, required when L3 / routing features are used vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN identifier for this switch network description: A network represents a network segment. It can either represent a VLAN (then usually ties to a L3 subnet), optionally associate it with a subnet which can later be used to create addition routes. Used for ports doing `family ethernet-switching`. It can also be a pure L3-subnet that can then be used against a port that with `family inet`. switch_matching_rule_ip_config2: title: switch_matching_rule_ip_config2 type: object properties: network: type: string description: VLAN Name for the management interface type: allOf: - $ref: '#/components/schemas/ip_type11' - description: 'IP assignment mode for in-band switch management. enum: `dhcp`, `static`.' examples: - static description: In-band management IP configuration applied when this matching rule matches tacacs_default_role2: title: tacacs_default_role2 enum: - admin - helpdesk - none - read type: string description: 'Default switch-management role to use for TACACS+ logins. enum: `admin`, `helpdesk`, `none`, `read`.' acl_tag: title: acl_tag required: - type type: object properties: ether_types: type: array items: type: string description: Layer 2 EtherTypes matched by this ACL tag; defaults to `any` default: - any gbp_tag: type: integer description: "Required if\n - `type`==`dynamic_gbp` (gbp_tag received from RADIUS)\n - `type`==`gbp_resource`\n - `type`==`static_gbp` (applying gbp tag against matching conditions)" contentEncoding: int32 macs: type: array items: type: string description: Client or resource MAC addresses matched by this ACL tag network: type: string description: "If:\n * `type`==`mac` (optional. default is `any`)\n * `type`==`subnet` (optional. default is `any`)\n * `type`==`network`\n * `type`==`resource` (optional. default is `any`)\n * `type`==`static_gbp` if from matching network (vlan)" port_usage: type: string description: Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag radius_group: type: string description: "Required if:\n * `type`==`radius_group`\n * `type`==`aruba_user_role`\n * `type`==`static_gbp`\nif from matching radius_group" specs: type: array items: $ref: '#/components/schemas/acl_tag_spec' description: Layer 4 protocol and destination-port constraints for this ACL tag subnets: type: array items: type: string description: IP subnets matched by this ACL tag type: allOf: - $ref: '#/components/schemas/acl_tag_type2' - description: 'Classifier type that determines which ACL tag fields are evaluated. enum: `any`, `aruba_user_role`, `dynamic_gbp`, `gbp_resource`, `mac`, `network`, `port_usage`, `radius_group`, `resource`, `static_gbp`, `subnet`.' description: Resource tags (`type`==`resource` or `type`==`gbp_resource`) can only be used in `dst_tags` remote_syslog_severity1: title: remote_syslog_severity1 enum: - alert - any - critical - emergency - error - info - notice - warning type: string description: 'Default syslog severity for messages sent to this server. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' switch_radius_config1: title: switch_radius_config1 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS configuration used when alternate RADIUS settings are required snmp_config2: title: snmp_config2 type: object properties: client_list: type: array items: $ref: '#/components/schemas/snmp_config_client_list' description: SNMP client allowlists that can be referenced by communities contact: type: string description: Administrative contact string advertised through SNMP examples: - cns@juniper.net description: type: string description: Device description string advertised through SNMP examples: - Juniper QFX Series Switch - 1K_5LA enabled: type: boolean description: Whether SNMP is enabled default: true engine_id: maxLength: 27 type: string description: SNMP engine ID used for SNMPv3 engine_id_type: allOf: - $ref: '#/components/schemas/snmp_config_engine_id_type2' - description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' location: type: string description: Physical location string advertised through SNMP examples: - Las Vegas, NV name: type: string description: System name advertised through SNMP examples: - TGH-1K-QFX10K network: type: string description: Management network used for SNMP traffic default: default trap_groups: type: array items: $ref: '#/components/schemas/snmp_config_trap_group' description: SNMP trap group definitions v2c_config: type: array items: $ref: '#/components/schemas/snmp_config_v2c_config' description: SNMPv2c community configuration entries for this SNMP profile v3_config: allOf: - $ref: '#/components/schemas/snmpv3_config2' - description: SNMPv3 user, VACM, notify, and target configuration views: type: array items: $ref: '#/components/schemas/snmp_config_view' description: SNMP MIB view definitions description: SNMP defaults provided by this network template snmpv3_config2: title: snmpv3_config2 type: object properties: notify: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_items' description: SNMPv3 notification definitions used for traps and informs notify_filter: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_filter_item' description: SNMPv3 notification filter profiles target_address: type: array items: $ref: '#/components/schemas/snmpv3_config_target_address_item' description: SNMPv3 notification target addresses target_parameters: type: array items: $ref: '#/components/schemas/snmpv3_config_target_param' description: SNMPv3 target parameter profiles usm: type: array items: $ref: '#/components/schemas/snmp_usm' description: SNMPv3 USM engine configurations vacm: allOf: - $ref: '#/components/schemas/snmp_vacm2' - description: SNMPv3 VACM access control configuration description: SNMPv3 user, VACM, notify, and target configuration dhcp_snooping3: title: dhcp_snooping3 type: object properties: all_networks: type: boolean description: Whether DHCP snooping applies to all configured networks enable_arp_spoof_check: type: boolean description: Enable for dynamic ARP inspection check enable_ip_source_guard: type: boolean description: Enable for check for forging source IP address enabled: type: boolean description: Whether DHCP snooping is enabled networks: type: array items: type: string description: Network names with DHCP snooping enabled when `all_networks`==`false` description: DHCP snooping defaults provided by this network template junos_port_config_duplex2: title: junos_port_config_duplex2 enum: - auto - full - half type: string description: 'Link duplex mode for this Junos port. enum: `auto`, `full`, `half`.' poe_priority3: title: poe_priority3 enum: - low - high type: string description: 'Only if `mode`!=`dynamic`. PoE priority for ports using this port usage. enum: `low`, `high`.' switch_network_multicast_igmp_version: title: switch_network_multicast_igmp_version enum: - '2' - '3' type: string description: IGMP version. '2' (default, ASM/IGMPv2) / '3' (SSM/IGMPv3) remote_syslog_server_protocol2: title: remote_syslog_server_protocol2 enum: - tcp - udp type: string description: 'Transport protocol used for this remote syslog server. enum: `tcp`, `udp`.' snmpv3_config_target_param_mess_process_model2: title: snmpv3_config_target_param_mess_process_model2 enum: - v1 - v2c - v3 type: string description: 'SNMP message processing model used by this target parameter profile. enum: `v1`, `v2c`, `v3`.' switch_vrf_instance: title: switch_vrf_instance type: object properties: aggregate_routes: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: IPv4 aggregate routes configured for this VRF instance examples: - 172.16.3.0/24: discard: false metric: null preference: 30 aggregate_routes6: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: IPv6 aggregate routes configured for this VRF instance examples: - 2a02:1234:420a:10c9::/64: discard: false metric: null preference: 30 evpn_auto_loopback_subnet: type: string description: IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance examples: - 100.101.0.0/24 evpn_auto_loopback_subnet6: type: string description: IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance extra_routes: type: object additionalProperties: $ref: '#/components/schemas/vrf_extra_route' description: Additional IPv4 static routes configured for this VRF instance examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/vrf_extra_route6' description: Additional IPv6 static routes configured for this VRF instance examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 multicast_config: allOf: - $ref: '#/components/schemas/switch_multicast_config3' - description: Multicast configuration for this VRF instance. PIM is automatically enabled when any network in this VRF has `multicast.enabled`==`true` networks: uniqueItems: true type: array items: type: string description: Names of switch networks included in this VRF instance description: Switch VRF instance routing and network membership settings examples: - extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest radius_keywrap_format1: title: radius_keywrap_format1 enum: - ascii - hex type: string description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' snmp_config_v2c_config: title: snmp_config_v2c_config type: object properties: authorization: type: string description: Access level for the SNMPv2c community examples: - read-only client_list_name: type: string description: SNMP client list name referenced by this community examples: - clist-1 community_name: type: string description: SNMPv2c community string name examples: - abc123 view: type: string description: SNMP view name that must be defined in the views list examples: - all description: SNMPv2c community configuration entry ospf_area_type2: title: ospf_area_type2 enum: - default - nssa - stub type: string description: 'Area type for this OSPF area. enum: `default`, `nssa`, `stub`.' examples: - default snmp_usm_user_encryption_type2: title: snmp_usm_user_encryption_type2 enum: - privacy-3des - privacy-aes128 - privacy-des - privacy-none type: string description: 'Privacy protocol used by this SNMPv3 USM user. enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`.' response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response snmpv3_config_target_param_security_level2: title: snmpv3_config_target_param_security_level2 enum: - authentication - none - privacy type: string description: 'Required security level for this target parameter profile. enum: `authentication`, `none`, `privacy`.' ospf_area_network_auth_type2: title: ospf_area_network_auth_type2 enum: - md5 - none - password type: string description: 'Authentication method used by this OSPF network. enum: `md5`, `none`, `password`.' examples: - md5 snmp_vacm_access_item_prefix_list_item_model2: title: snmp_vacm_access_item_prefix_list_item_model2 enum: - any - usm - v1 - v2c type: string description: 'Required security model for this VACM access rule. enum: `any`, `usm`, `v1`, `v2c`.' remote_syslog_content: title: remote_syslog_content type: object properties: facility: allOf: - $ref: '#/components/schemas/remote_syslog_facility3' - description: 'Syslog facility to match for this selector. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config severity: allOf: - $ref: '#/components/schemas/remote_syslog_severity3' - description: 'Syslog severity to match for this selector. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' description: Syslog message content selector for remote logging switch_port_usage_mac_auth_protocol2: title: switch_port_usage_mac_auth_protocol2 enum: - eap-md5 - eap-peap - pap type: string description: 'Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled. enum: `eap-md5`, `eap-peap`, `pap`.' switch_port_usage: title: switch_port_usage type: object properties: all_networks: type: boolean description: Only if `mode`==`trunk`. Whether to trunk all network/vlans default: false allow_dhcpd: type: boolean description: 'Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).' allow_multiple_supplicants: type: boolean description: Only if `mode`!=`dynamic` default: false bypass_auth_when_server_down: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down default: false bypass_auth_when_server_down_for_unknown_client: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down default: false bypass_auth_when_server_down_for_voip: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down default: false community_vlan_id: type: integer description: Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other contentEncoding: int32 description: type: string description: Only if `mode`!=`dynamic` disable_autoneg: type: boolean description: Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation default: false disabled: type: boolean description: Only if `mode`!=`dynamic`. Whether the port is disabled default: false duplex: allOf: - $ref: '#/components/schemas/switch_port_usage_duplex2' - description: 'Only if `mode`!=`dynamic`. Link duplex mode for this port usage. enum: `auto`, `full`, `half`.' dynamic_vlan_networks: type: array items: type: string description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment examples: - - corp - user enable_mac_auth: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Whether to enable MAC Auth default: false enable_qos: type: boolean description: Only if `mode`!=`dynamic` default: false guest_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed) inter_isolation_network_link: type: boolean description: Only if `mode`!=`dynamic`. `inter_isolation_network_link` is used together with `isolation` under networks, signaling that this port connects to isolated networks default: false inter_switch_link: type: boolean description: 'Only if `mode`!=`dynamic`. `inter_switch_link` is used together with `isolation` under networks. NOTE: `inter_switch_link` works only between Juniper devices. This has to be applied to both ports connected together' default: false mac_auth_only: type: boolean description: Only if `mode`!=`dynamic` and `enable_mac_auth`==`true` mac_auth_preferred: type: boolean description: Only if `mode`!=`dynamic` + `enable_mac_auth`==`true` + `mac_auth_only`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer mac_auth over dot1x. mac_auth_protocol: allOf: - $ref: '#/components/schemas/switch_port_usage_mac_auth_protocol2' - description: 'Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled. enum: `eap-md5`, `eap-peap`, `pap`.' mac_limit: anyOf: - maximum: 16383 minimum: 0 type: integer contentEncoding: int32 default: 0 - type: string description: Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited mode: allOf: - $ref: '#/components/schemas/switch_port_usage_mode2' - description: 'Switching mode for this port usage. enum: `access`, `dynamic`, `inet`, `trunk`.' mtu: anyOf: - maximum: 9216 minimum: 256 type: integer contentEncoding: int32 - type: string description: Only if `mode`!=`dynamic`. MTU for ports using this port usage networks: type: array items: type: string description: Only if `mode`==`trunk`. Network or VLAN names to trunk persist_mac: type: boolean description: Only if `mode`==`access` and `port_auth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses default: false poe_disabled: type: boolean description: Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port default: false poe_keep_state_when_reboot: type: boolean description: Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots default: false poe_priority: allOf: - $ref: '#/components/schemas/poe_priority3' - description: 'Only if `mode`!=`dynamic`. PoE priority for ports using this port usage. enum: `low`, `high`.' port_auth: allOf: - oneOf: - {} - $ref: '#/components/schemas/switch_port_usage_dot1x2' - description: 'Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage. enum: `dot1x`.' port_network: type: string description: Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic reauth_interval: anyOf: - maximum: 65535 minimum: 10 type: integer contentEncoding: int32 default: 3600 - type: string description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port reset_default_when: allOf: - $ref: '#/components/schemas/switch_port_usage_dynamic_reset_default_when2' - description: 'Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage. enum: `link_down`, `none`.' examples: - link_down rules: type: array items: $ref: '#/components/schemas/switch_port_usage_dynamic_rule' description: Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply server_fail_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Sets server fail fallback vlan server_fail_retry_interval: maximum: 65535 minimum: 120 type: integer description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Interval, in seconds. Sets the wait time before retrying authentication after RADIUS failure to reduce client flapping. Range 120-65535 contentEncoding: int32 default: 120 server_reject_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails speed: allOf: - $ref: '#/components/schemas/switch_port_usage_speed2' - description: 'Only if `mode`!=`dynamic`. Link speed for this port usage. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' storm_control: allOf: - $ref: '#/components/schemas/switch_port_usage_storm_control2' - description: Only if `mode`!=`dynamic`. Storm-control settings for this port usage stp_disable: type: boolean description: Only if `mode`!=`dynamic` and `stp_required`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface default: false stp_edge: type: boolean description: Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames default: false stp_no_root_port: type: boolean description: Only if `mode`!=`dynamic` default: false stp_p2p: type: boolean description: Only if `mode`!=`dynamic` default: false stp_required: type: boolean description: Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received default: false ui_evpntopo_id: type: string description: Optional for Campus Fabric Core-Distribution ESI-LAG profile. Helper used by the UI to select this port profile as the ESI-Lag between Distribution and Access switches contentEncoding: uuid use_vstp: type: boolean description: If this is connected to a vstp network default: false voip_network: type: - string - 'null' description: Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth description: Junos switch port usage template and authentication settings snmpv3_config_notify_filter_item_content: title: snmpv3_config_notify_filter_item_content type: object properties: include: type: boolean description: Whether the matching OID subtree is included oid: type: string description: Matched OID subtree for this notification filter rule examples: - 1.3.6.1.4.1 description: OID filter rule for an SNMPv3 notification profile remote_syslog_archive1: title: remote_syslog_archive1 type: object properties: files: anyOf: - type: string - type: integer contentEncoding: int32 description: Number of archived syslog files to retain examples: - '20' size: type: string description: Maximum size of each archived syslog file, such as 5m examples: - 5m description: Retention settings for this generated syslog file remote_syslog_user: title: remote_syslog_user type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities logged for this user rule match: type: string description: Expression used to filter user log messages examples: - '"!alarm|ntp|errors.crc_error[chan]"' user: type: string description: Account name or wildcard matched by this syslog rule examples: - '*' description: User-specific syslog logging rule switch_stp_config2: title: switch_stp_config2 type: object properties: bridge_priority: type: string description: Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP. default: 32k examples: - 40k description: Spanning Tree Protocol configuration applied when this matching rule matches snmp_vacm_security_model2: title: snmp_vacm_security_model2 enum: - usm - v1 - v2c type: string description: 'Required security model for these VACM group mappings. enum: `usm`, `v1`, `v2c`.' snmp_usm_user: title: snmp_usm_user type: object properties: authentication_password: minLength: 7 type: string description: Not required if `authentication_type`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters. authentication_type: allOf: - $ref: '#/components/schemas/snmp_usm_user_authentication_type2' - description: 'Authentication protocol used by this SNMPv3 USM user. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`.' encryption_password: minLength: 8 type: string description: Not required if `encryption_type`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters encryption_type: allOf: - $ref: '#/components/schemas/snmp_usm_user_encryption_type2' - description: 'Privacy protocol used by this SNMPv3 USM user. enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`.' name: type: string description: Username for the SNMPv3 USM user description: SNMPv3 USM user definition ospf_area_network_interface_type2: title: ospf_area_network_interface_type2 enum: - broadcast - nbma - p2mp - p2p type: string description: 'OSPF interface type used for this network. enum: `broadcast`, `nbma`, `p2mp`, `p2p`.' remote_syslog_time_format2: title: remote_syslog_time_format2 enum: - millisecond - year - year millisecond type: string description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond switch_mgmt2: title: switch_mgmt2 type: object properties: ap_affinity_threshold: type: integer description: AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used. contentEncoding: int32 default: 10 cli_banner: type: string description: Set Banners for switches. Allows markup formatting examples: - \t\tWELCOME! cli_idle_timeout: maximum: 60 minimum: 1 type: integer description: Sets timeout for switches contentEncoding: int32 config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 dhcp_option_fqdn: type: boolean description: Enable to provide the FQDN with DHCP option 81 default: false disable_oob_down_alarm: type: boolean description: Whether to suppress alarms when the switch out-of-band management interface is down fips_enabled: type: boolean description: Whether FIPS mode is enabled on the switch default: false local_accounts: type: object additionalProperties: $ref: '#/components/schemas/config_switch_local_accounts_user' description: Local switch user accounts keyed by username mxedge_proxy_host: type: string description: IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud mxedge_proxy_port: anyOf: - maximum: 65535 minimum: 1 type: integer contentEncoding: int32 default: 2222 - type: string description: Mist Edge proxy port used for switch management traffic protect_re: allOf: - $ref: '#/components/schemas/protect_re3' - description: Control-plane protection settings for the switch radius: allOf: - $ref: '#/components/schemas/switch_radius2' - description: Management authentication settings using RADIUS remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false root_password: type: string description: Root password for local switch access contentEncoding: password tacacs: allOf: - $ref: '#/components/schemas/tacacs2' - description: Management authentication settings using TACACS+ use_mxedge_proxy: type: boolean description: Whether to use Mist Edge as a proxy for switch management traffic description: Management-plane settings applied when this matching rule matches remote_syslog_facility1: title: remote_syslog_facility1 enum: - any - authorization - change-log - config - conflict-log - daemon - dfc - external - firewall - ftp - interactive-commands - kernel - ntp - pfe - security - user type: string description: 'Default syslog facility for messages sent to this server. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config snmp_vacm_access_item: title: snmp_vacm_access_item type: object properties: group_name: type: string description: SNMP VACM group name prefix_list: type: array items: $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item' description: Context prefix rules for this VACM group description: VACM access rule for an SNMP group protect_re3: title: protect_re3 type: object properties: allowed_services: type: array items: $ref: '#/components/schemas/protect_re_allowed_service' description: Built-in services explicitly allowed by the Protect RE policy examples: - - icmp - ssh custom: type: array items: $ref: '#/components/schemas/protect_re_custom' description: Additional ACL entries allowed by the Protect RE policy enabled: type: boolean description: "When enabled, all traffic that is not essential to our operation will be dropped\ne.g. ntp / dns / traffic to mist will be allowed by default\n if dhcpd is enabled, we'll make sure it works" default: false hit_count: type: boolean description: Whether to enable hit count for Protect_RE policy default: false trusted_hosts: type: array items: type: string description: Trusted host or subnet entries allowed by the Protect RE policy description: Control-plane protection settings for the switch config_switch_local_accounts_user_role2: title: config_switch_local_accounts_user_role2 enum: - admin - helpdesk - none - read type: string description: 'Access role granted to the local switch user account. enum: `admin`, `helpdesk`, `none`, `read`.' allow_deny4: title: allow_deny4 enum: - allow - deny type: string description: Allow or deny decision applied to traffic matching the destination tag remote_syslog_file_config: title: remote_syslog_file_config type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive1' - description: Retention settings for this generated syslog file contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities written to this file enable_tls: type: boolean description: Only if `protocol`==`tcp`, enable TLS for this syslog file destination explicit_priority: type: boolean description: Whether to include explicit syslog priority values in file output file: type: string description: Generated syslog file name examples: - file-name match: type: string description: Expression used to filter log messages written to this file examples: - '!alarm|ntp|errors.crc_error[chan]' structured_data: type: boolean description: Whether to include structured syslog data in file output description: Generated syslog file output settings remote_syslog_server: title: remote_syslog_server type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities sent to this server explicit_priority: type: boolean description: Whether to include explicit syslog priority values in messages sent to this server facility: allOf: - $ref: '#/components/schemas/remote_syslog_facility1' - description: 'Default syslog facility for messages sent to this server. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config host: type: string description: Address or hostname of the remote syslog server examples: - syslogd.internal match: type: string description: Expression used to filter log messages sent to this server examples: - '!alarm|ntp|errors.crc_error[chan]' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 default: 514 - type: string description: Network port used by the remote syslog server protocol: allOf: - $ref: '#/components/schemas/remote_syslog_server_protocol2' - description: 'Transport protocol used for this remote syslog server. enum: `tcp`, `udp`.' routing_instance: type: string description: Routing instance used to reach this remote syslog server examples: - routing-instance-name server_name: type: string description: TLS server name used when verifying the remote syslog server certificate examples: - syslogd.internal severity: allOf: - $ref: '#/components/schemas/remote_syslog_severity1' - description: 'Default syslog severity for messages sent to this server. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' source_address: type: string description: Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip` structured_data: type: boolean description: Whether to include structured syslog data in messages sent to this server tag: type: string description: Syslog tag value added to messages sent to this server description: Remote syslog server destination settings acl_policy: title: acl_policy type: object properties: actions: type: array items: $ref: '#/components/schemas/acl_policy_action' description: Destination tag actions evaluated for sources matching this ACL policy disabled: type: boolean description: Whether this ACL policy is disabled default: false name: type: string description: Display name of the ACL policy examples: - guest access src_tags: type: array items: type: string description: Source ACL tags that select traffic for this ACL policy description: "ACL Policy:\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to" snmp_config_trap_group: title: snmp_config_trap_group type: object properties: categories: type: array items: type: string description: Trap categories included in this SNMP trap group group_name: type: string description: Trap group name for this SNMP trap group examples: - profiler targets: type: array items: type: string description: Trap target addresses for this SNMP trap group version: allOf: - $ref: '#/components/schemas/snmp_config_trap_version2' - description: 'SNMP trap protocol version used by this group. enum: `all`, `v1`, `v2`.' description: SNMP trap group definition switch_mgmt3: title: switch_mgmt3 type: object properties: ap_affinity_threshold: type: integer description: AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used. contentEncoding: int32 default: 10 cli_banner: type: string description: Set Banners for switches. Allows markup formatting examples: - \t\tWELCOME! cli_idle_timeout: maximum: 60 minimum: 1 type: integer description: Sets timeout for switches contentEncoding: int32 config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 dhcp_option_fqdn: type: boolean description: Enable to provide the FQDN with DHCP option 81 default: false disable_oob_down_alarm: type: boolean description: Whether to suppress alarms when the switch out-of-band management interface is down fips_enabled: type: boolean description: Whether FIPS mode is enabled on the switch default: false local_accounts: type: object additionalProperties: $ref: '#/components/schemas/config_switch_local_accounts_user' description: Local switch user accounts keyed by username mxedge_proxy_host: type: string description: IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud mxedge_proxy_port: anyOf: - maximum: 65535 minimum: 1 type: integer contentEncoding: int32 default: 2222 - type: string description: Mist Edge proxy port used for switch management traffic protect_re: allOf: - $ref: '#/components/schemas/protect_re3' - description: Control-plane protection settings for the switch radius: allOf: - $ref: '#/components/schemas/switch_radius2' - description: Management authentication settings using RADIUS remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false root_password: type: string description: Root password for local switch access contentEncoding: password tacacs: allOf: - $ref: '#/components/schemas/tacacs2' - description: Management authentication settings using TACACS+ use_mxedge_proxy: type: boolean description: Whether to use Mist Edge as a proxy for switch management traffic description: Management-plane defaults provided by this network template switch_bgp_config_neighbor: title: switch_bgp_config_neighbor required: - neighbor_as type: object properties: export_policy: type: string description: Export policy must match one of the policy names defined in the `routing_policies` property. hold_time: oneOf: - $ref: '#/components/schemas/switch_bgp_config_hold_time_zero' - maximum: 65535 minimum: 3 type: integer contentEncoding: int32 description: 'BGP hold time for this neighbor. enum: `0`.' import_policy: type: string description: Import policy must match one of the policy names defined in the `routing_policies` property. multihop_ttl: maximum: 255 minimum: 1 type: integer description: Time-to-live value for multihop BGP sessions to this neighbor contentEncoding: int32 neighbor_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Autonomous System (AS) number of the BGP neighbor. For internal BGP, this must match `local_as`. For external BGP, this must differ from `local_as`. examples: - '65000' description: Per-neighbor switch BGP session settings remote_syslog2: title: remote_syslog2 type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive3' - description: Retention settings for generated syslog archive files cacerts: type: array items: type: string description: CA certificates used to verify TLS syslog servers examples: - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' - '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----' console: allOf: - $ref: '#/components/schemas/remote_syslog_console2' - description: Log forwarding filters for console messages sent to remote syslog enabled: type: boolean description: Whether remote syslog forwarding is enabled default: false files: type: array items: $ref: '#/components/schemas/remote_syslog_file_config' description: Local syslog file definitions to generate and forward network: type: string description: Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip` examples: - default send_to_all_servers: type: boolean description: Whether each log entry is sent to all configured remote syslog servers default: false servers: type: array items: $ref: '#/components/schemas/remote_syslog_server' description: Remote syslog server destinations examples: - - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: allOf: - $ref: '#/components/schemas/remote_syslog_time_format2' - description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond users: type: array items: $ref: '#/components/schemas/remote_syslog_user' description: User-specific syslog logging rules description: Remote syslog defaults provided by this network template acl_policy_action: title: acl_policy_action required: - dst_tag type: object properties: action: allOf: - $ref: '#/components/schemas/allow_deny4' - description: Allow or deny decision applied to traffic matching the destination tag dst_tag: type: string description: Destination ACL tag matched by this policy action examples: - corp description: Action applied to traffic that matches a destination ACL tag switch_port_usage_duplex2: title: switch_port_usage_duplex2 enum: - auto - full - half type: string description: 'Only if `mode`!=`dynamic`. Link duplex mode for this port usage. enum: `auto`, `full`, `half`.' switch_matching_rule: title: switch_matching_rule type: object properties: additional_config_cmds: type: array items: type: string description: Additional Junos CLI commands applied when this matching rule matches default_port_usage: type: string description: 'Port usage to assign to switch ports without any port usage assigned. Default: `default` to preserve default behavior' default: default ip_config: allOf: - $ref: '#/components/schemas/switch_matching_rule_ip_config2' - description: In-band management IP configuration applied when this matching rule matches name: maxLength: 32 minLength: 1 type: string description: 'Rule name. WARNING: the name `default` is reserved and can only be used for the last rule in the list' oob_ip_config: allOf: - $ref: '#/components/schemas/switch_matching_rule_oob_ip_config2' - description: Out-of-band management IP configuration applied when this matching rule matches port_config: type: object additionalProperties: $ref: '#/components/schemas/junos_port_config' description: Per-port wired configuration applied when this matching rule matches port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Port mirroring configuration applied when this matching rule matches stp_config: allOf: - $ref: '#/components/schemas/switch_stp_config2' - description: Spanning Tree Protocol configuration applied when this matching rule matches switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt2' - description: Management-plane settings applied when this matching rule matches additionalProperties: type: string description: "Property key defines the type of matching, value is the string to match. e.g:\n * `match_name[0:3]`: switch name must match the first 3 letters of the property value\n * `match_name[2:6]`: switch name must match the property value from the 2nd to the 6th letter\n * `match_model[0-8]`: switch model must match the first 8 letters of the property value\n * `match_role`: switch role must match the property value" examples: - match_model: EX4300 match_name[0:3]: abc sw_routing_policy_term_action2: title: sw_routing_policy_term_action2 type: object properties: accept: type: boolean description: Whether to accept routes that match this term community: type: array items: type: string description: BGP communities to set when this term is used as an export policy local_preference: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Preference value to set when this term is used as an import policy prepend_as_path: type: array items: type: string description: AS path values to prepend when this term is used as an export policy description: Policy actions applied when this routing policy term matches junos_port_config: title: junos_port_config required: - usage type: object properties: ae_disable_lacp: type: boolean description: To disable LACP support for the AE interface ae_idx: type: integer description: Users could force to use the designated AE name contentEncoding: int32 ae_lacp_force_up: type: boolean description: 'If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only' default: false ae_lacp_passive: type: boolean description: If `aggregated`==`true`, sets LACP to passive mode on this AE interface; by default, active (fast) mode is used default: false ae_lacp_slow: type: boolean description: To use slow timeout aggregated: type: boolean description: Whether this port is configured as an aggregated Ethernet member default: false critical: type: boolean description: To generate port up/down alarm default: false description: type: string description: Human-readable description for this Junos port disable_autoneg: type: boolean description: If `speed` and `duplex` are specified, whether to disable autonegotiation default: false duplex: allOf: - $ref: '#/components/schemas/junos_port_config_duplex2' - description: 'Link duplex mode for this Junos port. enum: `auto`, `full`, `half`.' dynamic_usage: type: - string - 'null' description: Enable dynamic usage for this port. Set to `dynamic` to enable. esilag: type: boolean description: Whether this Junos port participates in an ESI-LAG mtu: type: integer description: Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation contentEncoding: int32 default: 1514 networks: type: array items: type: string description: List of network names. Required if `usage`==`inet` no_local_overwrite: type: boolean description: Prevent helpdesk to override the port config default: true poe_disabled: type: boolean description: Whether PoE capabilities are disabled for this Junos port default: false port_network: type: string description: Required if `usage`==`vlan_tunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation) speed: allOf: - $ref: '#/components/schemas/junos_port_config_speed1' - description: 'Link speed for this Junos port. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' usage: type: string description: Port usage name. For Q-in-Q, use `vlan_tunnel`. If EVPN is used, use `evpn_uplink`or `evpn_downlink` description: Junos switch port configuration network_template: title: network_template type: object properties: acl_policies: type: array items: $ref: '#/components/schemas/acl_policy' description: ACL policy defaults provided by this network template acl_tags: type: object additionalProperties: $ref: '#/components/schemas/acl_tag' description: ACL tags available to access policies in this network template additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands provided by this network template bgp_config: type: object additionalProperties: $ref: '#/components/schemas/switch_bgp_config' description: BGP routing defaults for this network template. Property key is the BGP session name created_time: type: number description: Timestamp when the network template was created readOnly: true dhcp_snooping: allOf: - $ref: '#/components/schemas/dhcp_snooping3' - description: DHCP snooping defaults provided by this network template dns_servers: type: array items: type: string description: DNS servers provided by this network template dns_suffix: type: array items: type: string description: DNS search suffixes provided by this network template extra_routes: type: object additionalProperties: $ref: '#/components/schemas/extra_route' description: Additional IPv4 route defaults in this network template examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/extra_route6' description: Additional IPv6 route defaults in this network template examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 id: type: string description: Unique identifier of the network template contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f import_org_networks: type: array items: type: string description: Organization network names imported into this network template mist_nac: allOf: - $ref: '#/components/schemas/switch_mist_nac2' - description: Mist NAC defaults applied by this network template modified_time: type: number description: Timestamp when the network template was last modified readOnly: true multicast_config: allOf: - $ref: '#/components/schemas/switch_multicast_config1' - description: Multicast settings for networks in the master VRF (not assigned to any vrf_instances); PIM is automatically enabled when any master-VRF network has `multicast.enabled`==`true` name: type: string description: Display name of the network template networks: type: object additionalProperties: $ref: '#/components/schemas/switch_network' description: Layer 3 networks configured by this network template ntp_servers: type: array items: type: string description: NTP servers provided by this network template org_id: type: string description: Organization that owns this network template contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 ospf_areas: type: object additionalProperties: $ref: '#/components/schemas/ospf_area' description: OSPF area defaults provided by this network template port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Port mirroring defaults provided by this network template port_usages: type: object additionalProperties: $ref: '#/components/schemas/switch_port_usage' description: Reusable switch port usage profiles provided by this network template radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config3' - description: RADIUS authentication and accounting defaults in this network template remote_syslog: allOf: - $ref: '#/components/schemas/remote_syslog2' - description: Remote syslog defaults provided by this network template remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false routing_policies: type: object additionalProperties: $ref: '#/components/schemas/sw_routing_policy' description: Routing policy defaults applied by this network template snmp_config: allOf: - $ref: '#/components/schemas/snmp_config2' - description: SNMP defaults provided by this network template switch_matching: allOf: - $ref: '#/components/schemas/switch_matching3' - description: Matching rules that select switches for this network template switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt3' - description: Management-plane defaults provided by this network template vrf_config: allOf: - $ref: '#/components/schemas/vrf_config5' - description: VRF defaults applied by this network template vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/switch_vrf_instance' description: VRF instances configured by this network template examples: - guest: extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest description: Network template configuration applied to sites or site groups snmpv3_config_target_address_item: title: snmpv3_config_target_address_item type: object properties: address: type: string description: IP address or hostname of the SNMP target examples: - 10.11.0.2 address_mask: type: string description: Mask applied to the SNMP target address examples: - 255.255.255.0 port: type: - string - 'null' description: UDP port used by the SNMP target default: '161' tag_list: type: string description: Set of notification tags for this target address; use spaces between multiple tags target_address_name: type: string description: Name of the SNMP target address entry examples: - target_address_name target_parameters: type: string description: Target parameter profile referenced by this target address description: SNMPv3 notification target address entry extra_route6_next_qualified_properties: title: extra_route6_next_qualified_properties type: object properties: metric: type: - integer - 'null' description: Route metric for this qualified IPv6 next hop contentEncoding: int32 preference: type: - integer - 'null' description: Route preference for this qualified IPv6 next hop contentEncoding: int32 description: Qualified next-hop attributes for an IPv6 static route remote_syslog_archive3: title: remote_syslog_archive3 type: object properties: files: anyOf: - type: string - type: integer contentEncoding: int32 description: Number of archived syslog files to retain examples: - '20' size: type: string description: Maximum size of each archived syslog file, such as 5m examples: - 5m description: Retention settings for generated syslog archive files switch_bgp_config_hold_time_zero: title: switch_bgp_config_hold_time_zero const: 0 type: integer description: BGP hold time value of 0 response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response tacacs_acct_server: title: tacacs_acct_server type: object properties: host: type: string description: Address or hostname of the TACACS+ accounting server port: type: string description: TCP port used by the TACACS+ accounting server secret: type: string description: Shared secret used with this TACACS+ accounting server contentEncoding: password timeout: type: integer description: TACACS+ accounting server timeout, in seconds contentEncoding: int32 default: 10 description: TACACS+ accounting server settings response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response remote_syslog_severity3: title: remote_syslog_severity3 enum: - alert - any - critical - emergency - error - info - notice - warning type: string description: 'Syslog severity to match for this selector. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' vrf_config5: title: vrf_config5 type: object properties: enabled: type: boolean description: Whether to enable VRF (when supported on the device) description: VRF defaults applied by this network template switch_bgp_config_type2: title: switch_bgp_config_type2 enum: - external - internal type: string description: 'BGP session type for this switch BGP configuration. enum: `external`, `internal`.' switch_port_usage_speed2: title: switch_port_usage_speed2 enum: - 10m - 100m - 1g - 2.5g - 5g - 10g - 25g - 40g - 100g - auto type: string description: 'Only if `mode`!=`dynamic`. Link speed for this port usage. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' ospf_areas_network: title: ospf_areas_network type: object properties: auth_keys: type: object additionalProperties: type: string description: Required if `auth_type`==`md5`. Property key is the key number examples: - '1': auth-key-1 auth_password: type: string description: Required if `auth_type`==`password`, the password, max length is 8 examples: - simple auth_type: allOf: - $ref: '#/components/schemas/ospf_area_network_auth_type2' - description: 'Authentication method used by this OSPF network. enum: `md5`, `none`, `password`.' examples: - md5 bfd_minimum_interval: maximum: 255000 minimum: 1 type: integer description: Minimum BFD interval for this OSPF network, in milliseconds contentEncoding: int32 examples: - 500 dead_interval: maximum: 65535 minimum: 1 type: integer description: OSPF dead interval for this network, in seconds contentEncoding: int32 examples: - 40 export_policy: type: string description: Routing policy used to export routes from this OSPF network examples: - export_policy hello_interval: maximum: 255 minimum: 1 type: integer description: OSPF hello interval for this network, in seconds contentEncoding: int32 import_policy: type: string description: Routing policy used to import routes for this OSPF network examples: - import_policy interface_type: allOf: - $ref: '#/components/schemas/ospf_area_network_interface_type2' - description: 'OSPF interface type used for this network. enum: `broadcast`, `nbma`, `p2mp`, `p2p`.' metric: maximum: 65535 minimum: 1 type: - integer - 'null' description: OSPF metric assigned to this network contentEncoding: int32 examples: - 10000 no_readvertise_to_overlay: type: boolean description: By default, we'll re-advertise all learned OSPF routes toward overlay default: false passive: type: boolean description: Whether to send OSPF-Hello default: false description: Property key is the network name. Networks to participate in an OSPF area snmp_vacm_security_to_group2: title: snmp_vacm_security_to_group2 type: object properties: content: type: array items: $ref: '#/components/schemas/snmp_vacm_security_to_group_content_item' description: VACM security-name to group mapping entries security_model: allOf: - $ref: '#/components/schemas/snmp_vacm_security_model2' - description: 'Required security model for these VACM group mappings. enum: `usm`, `v1`, `v2c`.' description: VACM security-name to group mappings vrf_extra_route6: title: vrf_extra_route6 type: object properties: via: type: string description: IPv6 next-hop address for this VRF extra route contentEncoding: ipv6 description: Additional IPv6 static route for a VRF instance tacacs2: title: tacacs2 type: object properties: acct_servers: type: array items: $ref: '#/components/schemas/tacacs_acct_server' description: TACACS+ accounting servers used for switch management sessions default_role: allOf: - $ref: '#/components/schemas/tacacs_default_role2' - description: 'Default switch-management role to use for TACACS+ logins. enum: `admin`, `helpdesk`, `none`, `read`.' enabled: type: boolean description: Whether TACACS+ is enabled for switch management authentication network: type: string description: Source network used for connectivity to the TACACS+ servers tacplus_servers: type: array items: $ref: '#/components/schemas/tacacs_auth_server' description: TACACS+ authentication servers used for switch management logins description: Management authentication settings using TACACS+ snmp_config_engine_id_type2: title: snmp_config_engine_id_type2 enum: - local - use_mac_address type: string description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' switch_port_usage_dynamic_rule_src2: title: switch_port_usage_dynamic_rule_src2 enum: - link_peermac - lldp_chassis_id - lldp_hardware_revision - lldp_manufacturer_name - lldp_oui - lldp_serial_number - lldp_system_description - lldp_system_name - radius_dynamicfilter - radius_usermac - radius_username type: string description: 'Source attribute evaluated by this dynamic rule. enum: `link_peermac`, `lldp_chassis_id`, `lldp_hardware_revision`, `lldp_manufacturer_name`, `lldp_oui`, `lldp_serial_number`, `lldp_system_description`, `lldp_system_name`, `radius_dynamicfilter`, `radius_usermac`, `radius_username`.' switch_radius_config_auth_server_selection2: title: switch_radius_config_auth_server_selection2 enum: - ordered - unordered type: string description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' sw_routing_policy_term_matching_protocol_enum: title: sw_routing_policy_term_matching_protocol_enum enum: - bgp - direct - evpn - ospf - static type: string description: 'enum: `bgp`, `direct`, `evpn`, `ospf`, `static`' switch_radius_config3: title: switch_radius_config3 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS authentication and accounting defaults in this network template sw_routing_policy_term: title: sw_routing_policy_term required: - name type: object properties: actions: allOf: - $ref: '#/components/schemas/sw_routing_policy_term_action2' - description: Policy actions applied when this routing policy term matches matching: allOf: - $ref: '#/components/schemas/sw_routing_policy_term_matching2' - description: Route match criteria that must be satisfied before actions are applied name: type: string description: Display name of the switch routing policy term description: Switch routing policy term with match criteria and actions config_switch_local_accounts_user: title: config_switch_local_accounts_user type: object properties: password: type: string description: Local password for the switch user account contentEncoding: password examples: - Juniper123 role: allOf: - $ref: '#/components/schemas/config_switch_local_accounts_user_role2' - description: 'Access role granted to the local switch user account. enum: `admin`, `helpdesk`, `none`, `read`.' description: Local switch user account credentials and access role switch_multicast_config1: title: switch_multicast_config1 type: object properties: anycast_rp: type: boolean description: When `true`, auto-generates a shared RP on `is_l3_border` devices (ERB/IPClos topologies only) default: false rp_ip: type: string description: RP address used when `anycast_rp`==`false`. If the address matches a device SVI, it is configured as a local RP; otherwise a static RP is configured examples: - 10.2.1.10 sbd_subnet: type: string description: SBD IRB subnet; Mist auto-assigns per-device IPs from this range (EVPN eOISM only) examples: - 10.99.0.0/24 sbd_vlan_id: type: integer description: Supplemental Bridge Domain VLAN ID (EVPN topology / eOISM only) contentEncoding: int32 examples: - 3900 description: Multicast settings for networks in the master VRF (not assigned to any vrf_instances); PIM is automatically enabled when any master-VRF network has `multicast.enabled`==`true` switch_matching3: title: switch_matching3 type: object properties: enable: type: boolean description: Whether custom switch matching rules are enabled rules: uniqueItems: true type: array items: $ref: '#/components/schemas/switch_matching_rule' description: Switch matching rules evaluated to apply custom configuration description: Matching rules that select switches for this network template acl_tag_type2: title: acl_tag_type2 enum: - any - aruba_user_role - dynamic_gbp - gbp_resource - mac - network - port_usage - radius_group - resource - static_gbp - subnet type: string description: 'Classifier type that determines which ACL tag fields are evaluated. enum: `any`, `aruba_user_role`, `dynamic_gbp`, `gbp_resource`, `mac`, `network`, `port_usage`, `radius_group`, `resource`, `static_gbp`, `subnet`.' remote_syslog_console2: title: remote_syslog_console2 type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities forwarded from console logs description: Log forwarding filters for console messages sent to remote syslog snmp_usm: title: snmp_usm type: object properties: engine_type: allOf: - $ref: '#/components/schemas/snmp_usm_engine_type2' - description: 'SNMP engine type used for this USM configuration. enum: `local_engine`, `remote_engine`.' remote_engine_id: type: string description: Required only if `engine_type`==`remote_engine` examples: - 00:00:00:0b:00:00:70:10:6f:08:b6:3f users: type: array items: $ref: '#/components/schemas/snmp_usm_user' description: SNMPv3 USM users for this engine description: SNMPv3 User-based Security Model configuration snmp_config_view: title: snmp_config_view type: object properties: include: type: boolean description: Whether the root OID is included in this SNMP view oid: type: string description: Root OID for this SNMP view examples: - 1.3.6.1 view_name: type: string description: Name of the SNMP MIB view definition examples: - all description: SNMP MIB view definition snmpv3_config_target_param_security_model2: title: snmpv3_config_target_param_security_model2 enum: - usm - v1 - v2c type: string description: 'Required security model for this target parameter profile. enum: `usm`, `v1`, `v2c`.' switch_port_usage_dot1x2: title: switch_port_usage_dot1x2 const: dot1x type: string description: 'Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage. enum: `dot1x`.' protect_re_allowed_service: title: protect_re_allowed_service enum: - icmp - ssh type: string description: 'Services allowed through protect-RE filters. enum: `icmp`, `ssh`' securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header