openapi: 3.2.0 info: title: Mist Orgs Security Policies API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Orgs Security Policies description: 'Security Policy is designed to audit / catch discrepancies between "what''s intended to be running" versus "what''s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs.' paths: /api/v1/orgs/{org_id}/secpolicies: parameters: [] get: tags: - Orgs Security Policies summary: listOrgSecPolicies description: List organization security policies. Security policies define WLAN configuration baselines used to audit intended wireless settings against actual AP configuration. operationId: listOrgSecPolicies parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: limit in: query description: Maximum number of results to return per page style: form explode: true schema: minimum: 0 type: integer contentEncoding: int32 default: 100 - name: page in: query description: Select the page number to return when using page-based pagination; starts at `1` style: form explode: true schema: minimum: 1 type: integer contentEncoding: int32 default: 1 responses: '200': description: OK headers: {} content: application/json: schema: type: array items: $ref: '#/components/schemas/secpolicy' description: Security policies returned by list operations examples: - - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/json examples: Example: value: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest application/vnd.api+json: schema: type: array items: $ref: '#/components/schemas/secpolicy' description: Security policies returned by list operations examples: - - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/vnd.api+json examples: Example: value: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Orgs Security Policies summary: createOrgSecPolicy description: Create an organization security policy containing WLAN configuration baselines for auditing site and AP configuration compliance. operationId: createOrgSecPolicy parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: '' content: application/json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - examples: - name: string wlans: - acct_immediate_update: false acct_interim_interval: 0 acct_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1813 secret: testing123 allow_ipv6_ndp: true allow_mdns: false allow_ssdp: false app_limit: apps: dropbox: 300 netflix: 60 enabled: false wxtag_ids: f99862d9-2726-931f-7559-3dfdf5d070d3: 30 app_qos: apps: skype-business-video: dscp: 32 dst_subnet: 10.2.0.0/16 src_subnet: 10.2.0.0/16 enabled: true others: - dscp: 32 dst_subnet: 10.2.0.0/16 port_ranges: 80,1024-6553 protocol: udp src_subnet: 10.2.0.0/16 arp_filter: false auth: anticlog_threshold: 16 eap_reauth: false enable_mac_auth: false key_idx: 1 keys: - string multi_psk_only: false pairwise: - wpa2-ccmp private_wlan: true psk: foryoureyesonly type: psk wep_as_secondary_auth: true auth_server_selection: ordered auth_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1812 secret: testing123 auth_servers_nas_id: 5c5b350e0101-nas auth_servers_nas_ip: 15.3.1.5 auth_servers_retries: 5 auth_servers_timeout: 5 band: string band_steer: false band_steer_force_band5: false bands: - '24' - '5' block_blacklist_clients: false bonjour: additional_vlan_ids: 10,20 enabled: false services: airplay: radius_groups: - teachers scope: same_ap cisco_cwa: allowed_hostnames: - snapchat.com allowed_subnets: - 63.5.3.0/24 blocked_subnets: - 192.168.0.0/16 enabled: false client_limit_down: 1000 client_limit_down_enabled: false client_limit_up: 512 client_limit_up_enabled: false coa_servers: - disable_event_timestamp_check: false enabled: false ip: 1.2.3.4 port: 3799 secret: testing456 disable_11ax: false disable_ht_vht_rates: false disable_uapsd: false disable_v1_roam_notify: false disable_v2_roam_notify: false disable_wmm: false dns_server_rewrite: enabled: false radius_groups: contractor: 172.1.1.1 guest: 8.8.8.8 dtim: 2 dynamic_psk: default_psk: foryoureyesonly default_vlan_id: 999 enabled: false source: cloud_psks dynamic_vlan: default_vlan_id: 999 enabled: false local_vlan_ids: - 1 type: airespace-interface-name vlans: '131': default '322': fast,video enable_local_keycaching: false enable_wireless_bridging: false enabled: true fast_dot1x_timers: false hide_ssid: false hostname_ie: false hotspot20: domain_name: - mist.com enabled: true nai_realms: - string operators: - google - att rcoi: - 5A03BA0000 venue_name: some_name interface: all isolation: false l2_isolation: false legacy_overds: false limit_bcast: false limit_probe_response: true max_idletime: 1800 mist_nac: enabled: false no_static_dns: false no_static_ip: false portal: amazon_client_id: string amazon_client_secret: string amazon_email_domains: - string amazon_enabled: false auth: none azure_client_id: string azure_client_secret: string azure_enabled: false azure_tenant_id: string broadnet_password: password broadnet_sid: MIST broadnet_user_id: juniper bypass_when_cloud_down: false clickatell_api_key: string cross_site: false email_enabled: true enabled: false expire: 1440 external_portal_url: string facebook_client_id: string facebook_client_secret: string facebook_email_domains: - string facebook_enabled: false forward: false forward_url: https://abc.com/promotions google_client_id: string google_client_secret: string google_email_domains: - mydomain.edu - mydomain.org google_enabled: false gupshup_password: string gupshup_userid: string microsoft_client_id: string microsoft_client_secret: string microsoft_email_domains: - string microsoft_enabled: false passphrase_enabled: false password: let me in predefined_sponsors_enabled: true privacy: true puzzel_password: string puzzel_service_id: string puzzel_username: string smsMessageFormat: string sms_enabled: false sms_provider: twilio sponsor_auto_approve: false sponsor_email_domains: - reserved.net - reserved.org sponsor_enabled: false sponsor_link_validity_duration: '30' sponsor_notify_all: false sponsor_status_notify: false sponsors: sponsor1@company.com: FirstName1 LastName1 sponsor2@company.com: FirstName2 LastName2 sso_default_role: string sso_forced_role: string sso_idp_cert: string sso_idp_sign_algo: sha256 sso_idp_sso_url: string sso_issuer: string sso_nameid_format: email telstra_client_id: string telstra_client_secret: string twilio_auth_token: af9dac44c344a875ab5d31cb7abcdefg twilio_phone_number: '+18548888888' twilio_sid: AC72ec6ba0ec5af30e6731c5e47abcdefgh portal_allowed_hostnames: - snapchat.com - ibm.com portal_allowed_subnets: - 63.5.3.0/24 portal_denied_hostnames: - msg.snapchat.com qos: class: best_effort overwrite: false radsec: enabled: true idle_timeout: 60 mxcluster_ids: - 572586b7-f97b-a22b-526c-8b97a3f609c4 proxy_hosts: - mxedge1.local server_name: radsec.abc.com servers: - host: 1.1.1.1 port: 1812 use_mxedge: true use_site_mxedge: false rateset: '24': ht: 00ff00ff00ff legacy: - '6' - '9' - '12' - '18' - 24b - '36' - '48' - '54' min_rssi: -70 template: custom vht: 03ff03ff03ff01ff '5': ht: 00ff00ff00ff legacy: - '6' - '9' - '12' - '18' - 24b - '36' - '48' - '54' min_rssi: -70 template: custom vht: 03ff03ff03ff01ff roam_mode: NONE schedule: enabled: false hours: fri: 09:00-17:00 mon: 09:00-17:00 sle_excluded: false ssid: corporate use_eapol_v1: false vlan_enabled: false vlan_ids: - 3 - 4 - 5 vlan_pooling: false wxtag_ids: - 497f6eca-6276-4993-bfeb-53e4bbba6f08 wxtunnel_id: string wxtunnel_remote_id: string contentMediaType: application/json examples: Example: value: name: string wlans: - acct_immediate_update: false acct_interim_interval: 0 acct_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1813 secret: testing123 allow_ipv6_ndp: true allow_mdns: false allow_ssdp: false app_limit: apps: dropbox: 300 netflix: 60 enabled: false wxtag_ids: f99862d9-2726-931f-7559-3dfdf5d070d3: 30 app_qos: apps: skype-business-video: dscp: 32 dst_subnet: 10.2.0.0/16 src_subnet: 10.2.0.0/16 enabled: true others: - dscp: 32 dst_subnet: 10.2.0.0/16 port_ranges: 80,1024-6553 protocol: udp src_subnet: 10.2.0.0/16 arp_filter: false auth: anticlog_threshold: 16 eap_reauth: false enable_mac_auth: false key_idx: 1 keys: - string multi_psk_only: false pairwise: - wpa2-ccmp private_wlan: true psk: foryoureyesonly type: psk wep_as_secondary_auth: true auth_server_selection: ordered auth_servers: - host: 1.2.3.4 keywrap_enabled: true keywrap_format: hex keywrap_kek: '1122334455' keywrap_mack: '1122334455' port: 1812 secret: testing123 auth_servers_nas_id: 5c5b350e0101-nas auth_servers_nas_ip: 15.3.1.5 auth_servers_retries: 5 auth_servers_timeout: 5 band: string band_steer: false band_steer_force_band5: false bands: - '24' - '5' block_blacklist_clients: false bonjour: additional_vlan_ids: 10,20 enabled: false services: airplay: radius_groups: - teachers scope: same_ap cisco_cwa: allowed_hostnames: - snapchat.com allowed_subnets: - 63.5.3.0/24 blocked_subnets: - 192.168.0.0/16 enabled: false client_limit_down: 1000 client_limit_down_enabled: false client_limit_up: 512 client_limit_up_enabled: false coa_servers: - disable_event_timestamp_check: false enabled: false ip: 1.2.3.4 port: 3799 secret: testing456 disable_11ax: false disable_ht_vht_rates: false disable_uapsd: false disable_v1_roam_notify: false disable_v2_roam_notify: false disable_wmm: false dns_server_rewrite: enabled: false radius_groups: contractor: 172.1.1.1 guest: 8.8.8.8 dtim: 2 dynamic_psk: default_psk: foryoureyesonly default_vlan_id: 999 enabled: false source: cloud_psks dynamic_vlan: default_vlan_id: 999 enabled: false local_vlan_ids: - 1 type: airespace-interface-name vlans: '131': default '322': fast,video enable_local_keycaching: false enable_wireless_bridging: false enabled: true fast_dot1x_timers: false hide_ssid: false hostname_ie: false hotspot20: domain_name: - mist.com enabled: true nai_realms: - string operators: - google - att rcoi: - 5A03BA0000 venue_name: some_name interface: all isolation: false l2_isolation: false legacy_overds: false limit_bcast: false limit_probe_response: true max_idletime: 1800 mist_nac: enabled: false no_static_dns: false no_static_ip: false portal: amazon_client_id: string amazon_client_secret: string amazon_email_domains: - string amazon_enabled: false auth: none azure_client_id: string azure_client_secret: string azure_enabled: false azure_tenant_id: string broadnet_password: password broadnet_sid: MIST broadnet_user_id: juniper bypass_when_cloud_down: false clickatell_api_key: string cross_site: false email_enabled: true enabled: false expire: 1440 external_portal_url: string facebook_client_id: string facebook_client_secret: string facebook_email_domains: - string facebook_enabled: false forward: false forward_url: https://abc.com/promotions google_client_id: string google_client_secret: string google_email_domains: - mydomain.edu - mydomain.org google_enabled: false gupshup_password: string gupshup_userid: string microsoft_client_id: string microsoft_client_secret: string microsoft_email_domains: - string microsoft_enabled: false passphrase_enabled: false password: let me in predefined_sponsors_enabled: true privacy: true puzzel_password: string puzzel_service_id: string puzzel_username: string smsMessageFormat: string sms_enabled: false sms_provider: twilio sponsor_auto_approve: false sponsor_email_domains: - reserved.net - reserved.org sponsor_enabled: false sponsor_link_validity_duration: '30' sponsor_notify_all: false sponsor_status_notify: false sponsors: sponsor1@company.com: FirstName1 LastName1 sponsor2@company.com: FirstName2 LastName2 sso_default_role: string sso_forced_role: string sso_idp_cert: string sso_idp_sign_algo: sha256 sso_idp_sso_url: string sso_issuer: string sso_nameid_format: email telstra_client_id: string telstra_client_secret: string twilio_auth_token: af9dac44c344a875ab5d31cb7abcdefg twilio_phone_number: '+18548888888' twilio_sid: AC72ec6ba0ec5af30e6731c5e47abcdefgh portal_allowed_hostnames: - snapchat.com - ibm.com portal_allowed_subnets: - 63.5.3.0/24 portal_denied_hostnames: - msg.snapchat.com qos: class: best_effort overwrite: false radsec: enabled: true idle_timeout: 60 mxcluster_ids: - 572586b7-f97b-a22b-526c-8b97a3f609c4 proxy_hosts: - mxedge1.local server_name: radsec.abc.com servers: - host: 1.1.1.1 port: 1812 use_mxedge: true use_site_mxedge: false rateset: '24': ht: 00ff00ff00ff legacy: - '6' - '9' - '12' - '18' - 24b - '36' - '48' - '54' min_rssi: -70 template: custom vht: 03ff03ff03ff01ff '5': ht: 00ff00ff00ff legacy: - '6' - '9' - '12' - '18' - 24b - '36' - '48' - '54' min_rssi: -70 template: custom vht: 03ff03ff03ff01ff roam_mode: NONE schedule: enabled: false hours: fri: 09:00-17:00 mon: 09:00-17:00 sle_excluded: false ssid: corporate use_eapol_v1: false vlan_enabled: false vlan_ids: - 3 - 4 - 5 vlan_pooling: false wxtag_ids: - 497f6eca-6276-4993-bfeb-53e4bbba6f08 wxtunnel_id: string wxtunnel_remote_id: string required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. examples: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/json examples: Example: value: name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. examples: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/vnd.api+json examples: Example: value: name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/orgs/{org_id}/secpolicies/{secpolicy_id}: parameters: [] delete: tags: - Orgs Security Policies summary: deleteOrgSecPolicy description: Remove an organization security policy from the set available for assignment and configuration compliance checks. operationId: deleteOrgSecPolicy parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: secpolicy_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false get: tags: - Orgs Security Policies summary: getOrgSecPolicy description: Return an organization security policy, including the WLAN configuration baselines used for compliance auditing. operationId: getOrgSecPolicy parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: secpolicy_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. examples: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/json examples: Example: value: name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. examples: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/vnd.api+json examples: Example: value: name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false put: tags: - Orgs Security Policies summary: updateOrgSecPolicy description: Update an organization security policy, including its name and WLAN configuration baselines for compliance auditing. operationId: updateOrgSecPolicy parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: secpolicy_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Request Body contentMediaType: application/json required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. examples: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/json examples: Example: value: name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/secpolicy' - description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. examples: - name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest contentMediaType: application/vnd.api+json examples: Example: value: name: corporate only wlans: - auth: pairwise: - wpa1-tkip - wpa2-tkip type: psk band: both ssid: office - auth: type: open band: '5' ssid: office-guest '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response wlan_portal_sso_nameid_format2: title: wlan_portal_sso_nameid_format2 enum: - email - unspecified type: string description: 'Optional if `wlan_portal_auth`==`sso`. SAML NameID format expected from the identity provider. enum: `email`, `unspecified`.' dynamic_psk_source1: title: dynamic_psk_source1 enum: - cloud_psks - radius type: string description: 'Origin used to retrieve per-user PSKs. enum: `cloud_psks`, `radius`.' examples: - cloud_psks response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response dot11_band: title: dot11_band enum: - '24' - '5' - 5-dedicated - 5-selectable - '6' - 6-dedicated - 6-selectable type: string description: 'enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`' radsec2: title: radsec2 type: object properties: coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic default: false enabled: type: boolean description: Whether RadSec is enabled idle_timeout: anyOf: - type: integer contentEncoding: int32 default: 60 - type: string description: Idle timeout, in seconds, for RadSec connections mxcluster_ids: type: array items: type: string contentEncoding: uuid description: Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel proxy_hosts: type: array items: type: string description: RadSec proxy hostnames advertised to APs server_name: type: string description: TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge. examples: - radsec.abc.com servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radsec_server' description: External RadSec servers. Only if not Mist Edge. use_mxedge: type: boolean description: Whether to use organization Mist Edge instances as RadSec proxies use_site_mxedge: type: boolean description: Whether to use site Mist Edge instances when this WLAN does not use mxtunnel default: false description: TLS-secured RADIUS transport settings for this WLAN wlan_bonjour_service_properties_scope2: title: wlan_bonjour_service_properties_scope2 enum: - same_ap - same_map - same_site type: string description: 'Discovery scope for this Bonjour service on the WLAN. enum: `same_ap`, `same_map`, `same_site`.' wlan_cisco_cwa2: title: wlan_cisco_cwa2 type: object properties: allowed_hostnames: type: array items: type: string description: Hostnames allowed for Cisco CWA client access before authorization allowed_subnets: type: array items: type: string description: CIDR subnets allowed for Cisco CWA client access before authorization blocked_subnets: type: array items: type: string description: CIDR subnets blocked for Cisco CWA client access enabled: type: boolean description: Whether Cisco CWA is enabled for this WLAN default: false description: Central web authentication settings for Cisco CWA on this WLAN response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response wlan_interface2: title: wlan_interface2 enum: - all - eth0 - eth1 - eth2 - eth3 - mxtunnel - site_mxedge - wxtunnel type: string description: 'Network interface or tunnel where this WLAN bridges client traffic. enum: `all`, `eth0`, `eth1`, `eth2`, `eth3`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all wlan_auth_owe2: title: wlan_auth_owe2 enum: - disabled - enabled - required type: string description: 'When `type`==`open`, Opportunistic Wireless Encryption mode for this WLAN. enum: `disabled`, `enabled`, `required`.' wlan_datarates: title: wlan_datarates type: object properties: eht: type: - string - 'null' description: If `template`==`custom`. EHT MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit) examples: - 3fff0fff0fff03ff he: type: - string - 'null' description: If `template`==`custom`. HE MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit examples: - 0fff0fff0fff0fff ht: type: - string - 'null' description: If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 00ff 00f0 001f limits HT rates to MCS 0-7 for 1 stream, MCS 4-7 for 2 stream (i.e. MCS 12-15), MCS 1-5 for 3 stream (i.e. MCS 16-20) examples: - 00ff00ff00ff legacy: type: array items: $ref: '#/components/schemas/wlan_datarates_legacy_item' description: If `template`==`custom`, legacy 802.11 data rates allowed on this WLAN examples: - - '6' - '9' - '12' - '18' - 24b - '36' - '48' - '54' min_rssi: type: integer description: Minimum RSSI for client to connect, 0 means not enforcing contentEncoding: int32 default: 0 examples: - -70 template: allOf: - oneOf: - {} - $ref: '#/components/schemas/wlan_datarates_template2' - description: 'Data rate template used to derive WLAN rate settings. enum: `compatible`, `legacy-only`, `custom`, `no-legacy`, `high-density`.' vht: type: - string - 'null' description: If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 03ff 01ff 00ff limits VHT rates to MCS 0-9 for 1 stream, MCS 0-8 for 2 streams, and MCS 0-7 for 3 streams. examples: - 03ff03ff03ff01ff description: Data rates wlan settings wlan_qos2: title: wlan_qos2 type: object properties: class: allOf: - $ref: '#/components/schemas/wlan_qos_class2' - description: 'QoS traffic class applied when WLAN QoS override is enabled. enum: `background`, `best_effort`, `video`, `voice`.' examples: - best_effort overwrite: type: boolean description: Whether to overwrite QoS default: false description: Quality-of-service settings for WLAN client traffic wlan_app_qos_others_item: title: wlan_app_qos_others_item type: object properties: dscp: anyOf: - type: string - maximum: 63 minimum: 0 type: integer contentEncoding: int32 description: Differentiated Services Code Point value applied to matching traffic dst_subnet: type: string description: Destination subnet filter for this custom QoS rule examples: - 10.2.0.0/16 port_ranges: type: string description: TCP or UDP port ranges matched by this custom QoS rule examples: - 80,1024-6553 protocol: type: string description: IP protocol matched by this custom QoS rule examples: - udp src_subnet: type: string description: Source subnet filter for this custom QoS rule examples: - 10.2.0.0/16 description: Custom QoS rewrite rule for traffic not matched by a named application wlan_bonjour_service_properties: title: wlan_bonjour_service_properties type: object properties: disable_local: type: boolean description: Whether to prevent wireless clients to discover bonjour devices on the same WLAN default: false radius_groups: type: array items: type: string description: RADIUS groups allowed to discover this Bonjour service, when restricted scope: allOf: - $ref: '#/components/schemas/wlan_bonjour_service_properties_scope2' - description: 'Discovery scope for this Bonjour service on the WLAN. enum: `same_ap`, `same_map`, `same_site`.' description: Bonjour service discovery settings for one advertised service secpolicy: title: secpolicy type: object properties: created_time: type: number description: Timestamp when the security policy was created, in epoch seconds readOnly: true id: type: string description: Unique value identifying the security policy contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f modified_time: type: number description: Timestamp when the security policy was last modified, in epoch seconds readOnly: true name: type: string description: Display name of the security policy org_id: type: string description: Organization identifier associated with the security policy contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 site_id: type: string description: Site identifier associated with the security policy, when scoped to a site contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 wlans: uniqueItems: true type: array items: $ref: '#/components/schemas/wlan' description: WLAN configurations audited by this security policy description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs. wlan_app_qos_apps_properties: title: wlan_app_qos_apps_properties type: object properties: dscp: anyOf: - type: string - maximum: 63 minimum: 0 type: integer contentEncoding: int32 description: Differentiated Services Code Point value applied to matching application traffic dst_subnet: type: string description: Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load) src_subnet: type: string description: Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load) description: QoS rewrite settings for traffic matching a named application wlan_auth_server_selection2: title: wlan_auth_server_selection2 enum: - ordered - unordered type: string description: 'RADIUS authentication server selection behavior for this WLAN. enum: `ordered`, `unordered`.' examples: - ordered wlan_portal_idp_sign_algo2: title: wlan_portal_idp_sign_algo2 enum: - sha1 - sha256 - sha384 - sha512 type: string description: 'Optional if `wlan_portal_auth`==`sso`. Signing algorithm used for SAML assertions from the identity provider. enum: `sha1`, `sha256`, `sha384`, `sha512`.' wlan: title: wlan required: - ssid type: object properties: acct_immediate_update: type: boolean description: Enable coa-immediate-update and address-change-immediate-update on the access profile. default: false acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 examples: - 0 acct_servers: type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this WLAN airwatch: allOf: - $ref: '#/components/schemas/wlan_airwatch2' - description: Integration settings for AirWatch device compliance on this WLAN allow_ipv6_ndp: type: boolean description: Only applicable when `limit_bcast`==`true`, which allows or disallows ipv6 Neighbor Discovery packets to go through default: true allow_mdns: type: boolean description: Only applicable when `limit_bcast`==`true`, which allows mDNS / Bonjour packets to go through default: false allow_ssdp: type: boolean description: Only applicable when `limit_bcast`==`true`, which allows SSDP default: false ap_ids: type: - array - 'null' items: type: string contentEncoding: uuid description: Access point identifiers used when `apply_to`==`aps` app_limit: allOf: - $ref: '#/components/schemas/wlan_app_limit2' - description: Bandwidth limits for applications on this WLAN app_qos: allOf: - $ref: '#/components/schemas/wlan_app_qos2' - description: QoS rules for application traffic on this WLAN apply_to: allOf: - $ref: '#/components/schemas/wlan_apply_to2' - description: 'Scope that determines where this WLAN is applied. enum: `aps`, `site`, `wxtags`.' arp_filter: type: boolean description: Whether to enable smart arp filter default: false auth: allOf: - $ref: '#/components/schemas/wlan_auth2' - description: Settings that control client authentication for this WLAN auth_server_selection: allOf: - $ref: '#/components/schemas/wlan_auth_server_selection2' - description: 'RADIUS authentication server selection behavior for this WLAN. enum: `ordered`, `unordered`.' examples: - ordered auth_servers: type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this WLAN. Required when `auth.type`==`eap` auth_servers_nas_id: type: - string - 'null' description: Optional, up to 48 bytes, will be dynamically generated if not provided. used only for authentication servers examples: - 5c5b350e0101-nas auth_servers_nas_ip: type: - string - 'null' description: Optional, NAS-IP-ADDRESS to use examples: - 15.3.1.5 auth_servers_retries: type: integer description: RADIUS auth session retries. Following fast timers are set if "fast_dot1x_timers" knob is enabled. ‘retries’ are set to value of auth_servers_retries. ‘max-requests’ is also set when setting auth_servers_retries and is set to default value to 3. contentEncoding: int32 default: 2 examples: - 5 auth_servers_timeout: type: integer description: RADIUS auth session timeout. Following fast timers are set if "fast_dot1x_timers" knob is enabled. ‘quite-period’ and ‘transmit-period’ are set to half the value of auth_servers_timeout. ‘supplicant-timeout’ is also set when setting auth_servers_timeout and is set to default value of 10. contentEncoding: int32 default: 5 band: type: string description: '`band` is deprecated and kept for backward compatibility. Use `bands` instead' deprecated: true band_steer: type: boolean description: Whether to enable band_steering, this works only when band==both default: false band_steer_force_band5: type: boolean description: Force dual_band capable client to connect to 5G default: false bands: type: array items: $ref: '#/components/schemas/dot11_band' description: Radio bands on which this WLAN is broadcast block_blacklist_clients: type: boolean description: Whether to block the clients in the blacklist (up to first 256 macs) default: false bonjour: allOf: - $ref: '#/components/schemas/wlan_bonjour2' - description: Service discovery gateway settings for Bonjour traffic on this WLAN cisco_cwa: allOf: - $ref: '#/components/schemas/wlan_cisco_cwa2' - description: Central web authentication settings for Cisco CWA on this WLAN client_limit_down: anyOf: - maximum: 999000 minimum: 1 type: integer contentEncoding: int32 - type: string description: Downlink bandwidth limit applied per client client_limit_down_enabled: type: boolean description: If downlink limiting per-client is enabled default: false client_limit_up: anyOf: - maximum: 999000 minimum: 1 type: integer contentEncoding: int32 - type: string description: Uplink bandwidth limit applied per client client_limit_up_enabled: type: boolean description: If uplink limiting per-client is enabled default: false coa_servers: type: array items: $ref: '#/components/schemas/coa_server' description: RADIUS Change of Authorization servers available to this WLAN created_time: type: number description: Time when this WLAN was created, in epoch seconds readOnly: true disable_11ax: type: boolean description: Some old WLAN drivers may not be compatible default: false disable_11be: type: boolean description: To disable Wi-Fi 7 EHT IEs default: false disable_ht_vht_rates: type: boolean description: To disable ht or vht rates default: false disable_message_authenticator_check: type: boolean description: whether to disable Message-Authenticator Check, which is used to verify the integrity of RADIUS messages, default is false (i.e. for better security) default: false disable_uapsd: type: boolean description: Whether to disable U-APSD default: false disable_v1_roam_notify: type: boolean description: Disable sending v2 roam notification messages default: false disable_v2_roam_notify: type: boolean description: Disable sending v2 roam notification messages default: false disable_when_gateway_unreachable: type: boolean description: "When any of the following is true, this WLAN will be disabled\n * cannot get IP\n * cannot obtain default gateway\n * cannot reach default gateway" default: false disable_when_mxtunnel_down: type: boolean description: Whether to disable this WLAN when the configured Mist tunnel is down default: false disable_wmm: type: boolean description: Whether to disable WMM default: false dns_server_rewrite: allOf: - oneOf: - {} - $ref: '#/components/schemas/wlan_dns_server_rewrite2' - description: RADIUS group based DNS server rewrite settings for this WLAN dtim: type: integer description: Delivery Traffic Indication Message interval for this WLAN contentEncoding: int32 default: 2 dynamic_psk: allOf: - oneOf: - {} - $ref: '#/components/schemas/wlan_dynamic_psk2' - description: Per-user PSK selection settings for this WLAN dynamic_vlan: allOf: - oneOf: - {} - $ref: '#/components/schemas/wlan_dynamic_vlan2' - description: VLAN assignment settings for 802.1X dynamic VLANs enable_ftm: type: boolean description: Enable FTM (Fine-Time Measurement, 802.11mc); configures the AP as an FTM Responder (target), allowing clients to perform ranging requests against it default: false enable_local_keycaching: type: boolean description: Enable AP-AP keycaching via multicast default: false enable_wireless_bridging: type: boolean description: By default, we'd inspect all DHCP packets and drop those unrelated to the wireless client itself in the case where client is a wireless bridge (DHCP packets for other MACs will need to be forwarded), wireless_bridging can be enabled default: false enable_wireless_bridging_dhcp_tracking: type: boolean description: If the client bridge is doing DHCP on behalf of other devices (L2-NAT), enable dhcp_tracking will cut down DHCP response packets to be forwarded to wireless default: false enabled: type: boolean description: If this wlan is enabled default: true fast_dot1x_timers: type: boolean description: If set to true, sets default fast-timers with values calculated from ‘auth_servers_timeout’ and ‘auth_server_retries’ . default: false for_site: type: boolean description: Whether this WLAN record is scoped to a site readOnly: true hide_ssid: type: boolean description: Whether to hide SSID in beacon default: false hostname_ie: type: boolean description: Include hostname inside IE in AP beacons / probe responses default: false hotspot20: allOf: - $ref: '#/components/schemas/wlan_hotspot_202' - description: Passpoint and Hotspot 2.0 settings for this WLAN id: type: string description: Unique identifier for this WLAN contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f inject_dhcp_option_82: allOf: - $ref: '#/components/schemas/wlan_inject_dhcp_option_822' - description: DHCP Option 82 insertion settings for this WLAN interface: allOf: - $ref: '#/components/schemas/wlan_interface2' - description: 'Network interface or tunnel where this WLAN bridges client traffic. enum: `all`, `eth0`, `eth1`, `eth2`, `eth3`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all isolation: type: boolean description: Whether to stop clients to talk to each other default: false l2_isolation: type: boolean description: If isolation is enabled, whether to deny clients to talk to L2 on the LAN default: false legacy_overds: type: boolean description: Legacy devices requires the Over-DS (for Fast BSS Transition) bit set (while our chip doesn’t support it). Warning! Enabling this will cause problem for iOS devices. default: false limit_bcast: type: boolean description: Whether to limit broadcast packets going to wireless (i.e. only allow certain bcast packets to go through) default: false limit_probe_response: type: boolean description: Limit probe response base on some heuristic rules default: false max_idletime: maximum: 86400 minimum: 60 type: integer description: Max idle time in seconds contentEncoding: int32 default: 1800 examples: - 1800 max_num_clients: maximum: 128 minimum: 0 type: integer description: Maximum number of client connected to the SSID. `0` means unlimited contentEncoding: int32 default: 0 mist_nac: allOf: - $ref: '#/components/schemas/wlan_mist_nac1' - description: Juniper Mist NAC settings used by this WLAN modified_time: type: number description: Time when this WLAN was last modified, in epoch seconds readOnly: true msp_id: type: string description: Managed service provider identifier associated with this WLAN contentEncoding: uuid readOnly: true examples: - b9d42c2e-88ee-41f8-b798-f009ce7fe909 mxtunnel_id: type: string description: (deprecated, use mxtunnel_ids instead) when `interface`==`mxtunnel`, id of the Mist Tunnel contentEncoding: uuid deprecated: true mxtunnel_ids: type: array items: type: string description: Mist Tunnel identifiers used when `interface`==`mxtunnel` mxtunnel_name: type: array items: type: string description: Mist Tunnel names used when `interface`==`site_mxedge` no_static_dns: type: boolean description: Whether to only allow client to use DNS that we’ve learned from DHCP response default: false no_static_ip: type: boolean description: Whether to only allow client that we’ve learned from DHCP exchange to talk default: false org_id: type: string description: Owning organization associated with this WLAN contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 portal: allOf: - $ref: '#/components/schemas/wlan_portal2' - description: Guest portal settings for this WLAN portal_allowed_hostnames: type: array items: type: string description: Guest portal hostnames that clients may reach before authorization default: [] examples: - - snapchat.com - ibm.com portal_allowed_subnets: type: array items: type: string description: Guest portal CIDR subnets that clients may reach before authorization default: [] examples: - - 63.5.3.0/24 portal_api_secret: type: - string - 'null' description: API secret (auto-generated) that can be used to sign guest authorization requests, only generated when auth is set to `external` examples: - EIfPMOykI3lMlDdNPub2WcbqT6dNOtWwmYHAd6bY portal_denied_hostnames: type: array items: type: string description: Guest portal hostnames denied before authorization, taking precedence over allowed hostnames default: [] examples: - - msg.snapchat.com portal_image: type: - string - 'null' description: Url of portal background image contentEncoding: uri readOnly: true examples: - https://url/to/image.png portal_sso_url: type: - string - 'null' description: URL used in the SSO process, auto-generated when auth is set to `sso` readOnly: true portal_template_url: type: - string - 'null' description: N.B portal_template will be forked out of wlan objects soon. To fetch portal_template, please query portal_template_url. To update portal_template, use Wlan Portal Template. readOnly: true qos: allOf: - $ref: '#/components/schemas/wlan_qos2' - description: Quality-of-service settings for WLAN client traffic radsec: allOf: - $ref: '#/components/schemas/radsec2' - description: TLS-secured RADIUS transport settings for this WLAN rateset: type: object additionalProperties: $ref: '#/components/schemas/wlan_datarates' description: Data rate settings by RF band for this WLAN reconnect_clients_when_roaming_mxcluster: type: boolean description: When different mxcluster is on different subnet, we'd want to disconnect clients (so they'll reconnect and get new IPs) default: false roam_mode: allOf: - $ref: '#/components/schemas/wlan_roam_mode2' - description: 'Fast roaming mode configured for this WLAN. enum: `11r`, `NONE`, `OKC`.' examples: - NONE schedule: allOf: - $ref: '#/components/schemas/wlan_schedule2' - description: Operating schedule controlling when this WLAN is active site_id: type: string description: Mist site associated with this WLAN, when site-scoped contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 sle_excluded: type: boolean description: Whether to exclude this WLAN from SLE metrics default: false ssid: type: string description: Name of the SSID examples: - corporate template_id: type: - string - 'null' description: Identifier of the WLAN template associated with this WLAN contentEncoding: uuid thumbnail: type: - string - 'null' description: Url of portal background image thumbnail contentEncoding: uri readOnly: true use_eapol_v1: type: boolean description: If `auth.type`==`eap` or `auth.type`==`psk`, should only be set for legacy client, such as pre-2004, 802.11b devices default: false vlan_enabled: type: boolean description: If vlan tagging is enabled default: false vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 - {} description: Default VLAN ID, range, or variable used when `vlan_enabled`==`true` vlan_ids: oneOf: - type: string examples: - 1,2 - type: array items: $ref: '#/components/schemas/vlan_id_with_variable' examples: - - 3 - 4 - 5 description: Pool of VLAN IDs used when `vlan_enabled`==`true` and `vlan_pooling`==`true` vlan_pooling: type: boolean description: Requires `vlan_enabled`==`true` to be set to `true`. Vlan pooling allows AP to place client on different VLAN using a deterministic algorithm default: false wlan_limit_down: anyOf: - maximum: 999000 minimum: 1 type: integer contentEncoding: int32 - type: string description: Downlink bandwidth limit applied to the whole WLAN wlan_limit_down_enabled: type: boolean description: If downlink limiting for whole wlan is enabled default: false wlan_limit_up: anyOf: - maximum: 999000 minimum: 1 type: integer contentEncoding: int32 - type: string description: Uplink bandwidth limit applied to the whole WLAN wlan_limit_up_enabled: type: boolean description: If uplink limiting for whole wlan is enabled default: false wxtag_ids: type: - array - 'null' items: type: string contentEncoding: uuid description: Identifiers of WxLAN tags used when `apply_to`==`wxtags` wxtunnel_id: type: - string - 'null' description: When `interface`=`wxtunnel`, id of the WXLAN Tunnel wxtunnel_remote_id: type: - string - 'null' description: When `interface`=`wxtunnel`, remote tunnel identifier description: '**Note**: portal_template will be forked out of wlan objects soon. To fetch portal_template, please query portal_template_url. To update portal_template, use Wlan Portal Template.' wlan_datarates_legacy_item: title: wlan_datarates_legacy_item enum: - '1' - '11' - 11b - '12' - 12b - '18' - 18b - 1b - '2' - '24' - 24b - 2b - '36' - 36b - '48' - 48b - '5.5' - 5.5b - '54' - 54b - '6' - 6b - '9' - 9b type: string description: 'enum: `1`, `11`, `11b`, `12`, `12b`, `18`, `18b`, `1b`, `2`, `24`, `24b`, `2b`, `36`, `36b`, `48`, `48b`, `5.5`, `5.5b`, `54`, `54b`, `6`, `6b`, `9`, `9b`' wlan_hotspot_202: title: wlan_hotspot_202 type: object properties: domain_name: type: array items: type: string description: Advertised domain names for Hotspot 2.0 clients examples: - - mist.com enabled: type: boolean description: Whether to enable hotspot 2.0 config nai_realms: uniqueItems: true type: array items: type: string description: NAI realms advertised for Hotspot 2.0 authentication operators: type: array items: $ref: '#/components/schemas/wlan_hotspot20_operators_item' description: Operator profiles supported by this Hotspot 2.0 configuration examples: - - google - att rcoi: type: array items: type: string description: Roaming Consortium Organization Identifiers advertised for Hotspot 2.0 examples: - - 5A03BA0000 venue_name: type: string description: Venue name, default is site name examples: - some_name description: Passpoint and Hotspot 2.0 settings for this WLAN wlan_auth_type2: title: wlan_auth_type2 enum: - eap - eap192 - open - psk - psk-tkip - psk-wpa2-tkip - wep type: string description: 'Authentication mode used by this WLAN. enum: `eap`, `eap192`, `open`, `psk`, `psk-tkip`, `psk-wpa2-tkip`, `wep`.' examples: - psk radius_acct_server: title: radius_acct_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS accounting server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this accounting server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS accounting server secret: type: string description: Shared secret used with this RADIUS accounting server contentEncoding: password examples: - testing123 description: RADIUS accounting server settings wlan_dynamic_vlan2: title: wlan_dynamic_vlan2 type: object properties: default_vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 default: 999 description: Deprecated default VLAN ID used when no RADIUS VLAN match is returned. Please use `default_vlan_ids` instead, which can support VLAN pools. deprecated: true default_vlan_ids: type: array items: $ref: '#/components/schemas/wlan_dynamic_vlan_default_vlan_id' description: Fallback VLAN IDs, ranges, or variables used when no RADIUS VLAN match is returned enabled: type: boolean description: Requires `vlan_enabled`==`true` to be set to `true`. Whether to enable dynamic vlan default: false local_vlan_ids: type: array items: $ref: '#/components/schemas/vlan_id_with_variable' description: VLAN IDs that should be locally bridged for dynamic VLAN assignment type: allOf: - $ref: '#/components/schemas/wlan_dynamic_vlan_type2' - description: 'Dynamic VLAN mapping method used for RADIUS-provided VLAN attributes. enum: `airespace-interface-name`, `standard`.' examples: - airespace-interface-name vlans: type: object additionalProperties: type: string description: "Map between vlan_id (as string) to airespace interface names (comma-separated) or null for standard mapping\n * if `dynamic_vlan.type`==`standard`, property key is the VLAN ID and property value is \\\"\\\"\n * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the VLAN ID and property value is the Airespace Interface Name" examples: - '131': default '322': fast,video description: VLAN assignment settings for 802.1X dynamic VLANs vlan_id_with_variable: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID, either numeric or expressed as a template variable string wlan_apply_to2: title: wlan_apply_to2 enum: - aps - site - wxtags type: string description: 'Scope that determines where this WLAN is applied. enum: `aps`, `site`, `wxtags`.' radius_auth_server: title: radius_auth_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS authentication server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this authentication server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS authentication server require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Shared secret used with this RADIUS authentication server contentEncoding: password examples: - testing123 description: RADIUS authentication server settings wlan_app_limit2: title: wlan_app_limit2 type: object properties: apps: type: object additionalProperties: type: integer format: int32 description: "Map from app key to bandwidth in kbps. \nProperty key is the app key, defined in Get Application List" default: {} examples: - dropbox: 300 netflix: 60 enabled: type: boolean description: Whether application bandwidth limits are enabled for this WLAN default: false wxtag_ids: type: object additionalProperties: type: integer format: int32 description: Map from wxtag_id of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtag_id` default: {} examples: - f99862d9-2726-931f-7559-3dfdf5d070d3: 30 description: Bandwidth limits for applications on this WLAN wlan_dynamic_vlan_type2: title: wlan_dynamic_vlan_type2 enum: - airespace-interface-name - standard type: string description: 'Dynamic VLAN mapping method used for RADIUS-provided VLAN attributes. enum: `airespace-interface-name`, `standard`.' examples: - airespace-interface-name wlan_datarates_template2: title: wlan_datarates_template2 enum: - compatible - legacy-only - custom - no-legacy - high-density type: string description: 'Data rate template used to derive WLAN rate settings. enum: `compatible`, `legacy-only`, `custom`, `no-legacy`, `high-density`.' wlan_portal_auth2: title: wlan_portal_auth2 enum: - amazon - azure - email - external - facebook - google - microsoft - multi - none - password - sms - sponsor - sso type: string description: 'Guest portal login scheme used by the WLAN. enum: `amazon`, `azure`, `email`, `external`, `facebook`, `google`, `microsoft`, `multi`, `none`, `password`, `sms`, `sponsor`, `sso`.' examples: - none wlan_mist_nac1: title: wlan_mist_nac1 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled. contentEncoding: int32 default: 0 examples: - 60 auth_servers_retries: maximum: 10 minimum: 1 type: integer description: RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3. contentEncoding: int32 default: 2 examples: - 3 auth_servers_timeout: maximum: 30 minimum: 1 type: integer description: RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10. contentEncoding: int32 default: 5 examples: - 5 coa_enabled: type: boolean description: Allows a RADIUS server to dynamically modify the authorization status of a user session. default: false coa_port: maximum: 65535 minimum: 1 type: integer description: the communication port used for “Change of Authorization” (CoA) messages contentEncoding: int32 examples: - 3799 enabled: type: boolean description: "When enabled:\n * `auth_servers` is ignored\n * `acct_servers` is ignored\n * `auth_servers_*` are ignored\n * `coa_servers` is ignored\n * `radsec` is ignored\n * `coa_enabled` is assumed" default: false fast_dot1x_timers: type: boolean description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`. default: false network: type: - string - 'null' description: Which network the mist nac server resides in examples: - default source_ip: type: - string - 'null' description: In case there is a static IP for this network, we can specify it using source ip examples: - 1.2.3.4 description: Juniper Mist NAC settings used by this WLAN wlan_hotspot20_operators_item: title: wlan_hotspot20_operators_item enum: - ameriband - att - boingo - charter - eduroam - global_reach - google - hughes_systique - openroaming_legacy - openroaming_settled - openroaming_settlement_free - single_digits - tmobile - verizon type: string description: 'enum: `ameriband`, `att`, `boingo`, `charter`, `eduroam`, `global_reach`, `google`, `hughes_systique`, `openroaming_legacy`, `openroaming_settled`, `openroaming_settlement_free`, `single_digits`, `tmobile`, `verizon`' wlan_bonjour2: title: wlan_bonjour2 type: object properties: additional_vlan_ids: anyOf: - type: string - type: array items: $ref: '#/components/schemas/vlan_id_with_variable' description: VLAN IDs, beyond the client VLAN, where Bonjour queries and responses are forwarded enabled: type: boolean description: Whether to enable bonjour for this WLAN. Once enabled, limit_bcast is assumed true, allow_mdns is assumed false default: false services: type: object additionalProperties: $ref: '#/components/schemas/wlan_bonjour_service_properties' description: "What services are allowed. \nProperty key is the service name" examples: - airplay: radius_groups: - teachers scope: same_ap description: Service discovery gateway settings for Bonjour traffic on this WLAN wlan_portal2: title: wlan_portal2 type: object properties: allow_wlan_id_roam: type: boolean description: Optional if `amazon_enabled`==`true`. Whether to allow guest to connect to other Guest WLANs (with different `WLAN.ssid`) of same org without reauthentication (disable random_mac for seamless roaming) default: false amazon_client_id: type: - string - 'null' description: Optional if `amazon_enabled`==`true`. Amazon OAuth2 client id. This is optional. If not provided, it will use a default one. amazon_client_secret: type: - string - 'null' description: Optional if `amazon_enabled`==`true`. Amazon OAuth2 client secret. If amazon_client_id was provided, provide a corresponding value. Else leave blank. contentEncoding: password amazon_email_domains: type: array items: type: string description: Optional if `amazon_enabled`==`true`. Email domains allowed for Amazon-authenticated guest users. If null or empty, any authenticated Amazon email domain is allowed. default: [] amazon_enabled: type: boolean description: Whether amazon is enabled as a login method default: false amazon_expire: type: - integer - 'null' description: Optional if `amazon_enabled`==`true`. Interval for which guest remains authorized using amazon auth (in minutes), if not provided, uses expire` contentEncoding: int32 auth: allOf: - $ref: '#/components/schemas/wlan_portal_auth2' - description: 'Guest portal login scheme used by the WLAN. enum: `amazon`, `azure`, `email`, `external`, `facebook`, `google`, `microsoft`, `multi`, `none`, `password`, `sms`, `sponsor`, `sso`.' examples: - none azure_client_id: type: - string - 'null' description: Required if `azure_enabled`==`true`. Azure active directory app client id azure_client_secret: type: - string - 'null' description: Required if `azure_enabled`==`true`. Azure active directory app client secret contentEncoding: password azure_enabled: type: boolean description: Whether Azure Active Directory is enabled as a login method default: false azure_expire: type: - integer - 'null' description: Interval for which guest remains authorized using azure auth (in minutes), if not provided, uses expire` contentEncoding: int32 azure_tenant_id: type: - string - 'null' description: Required if `azure_enabled`==`true`. Azure active directory tenant id. broadnet_password: type: string description: Required if `sms_provider`==`broadnet`. Password for the Broadnet SMS provider account contentEncoding: password examples: - password broadnet_sid: type: string description: Required if `sms_provider`==`broadnet`. SID for the Broadnet SMS provider account examples: - MIST broadnet_user_id: type: string description: Required if `sms_provider`==`broadnet`. User ID for the Broadnet SMS provider account examples: - juniper bypass_when_cloud_down: type: boolean description: Whether to bypass the guest portal when cloud not reachable (and apply the default policies) default: false clickatell_api_key: type: string description: Required if `sms_provider`==`clickatell`. API key for the Clickatell SMS provider account cross_site: type: boolean description: Whether to allow guest to roam between WLANs (with same `WLAN.ssid`, regardless of variables) of different sites of same org without reauthentication (disable random_mac for seamless roaming) default: false email_enabled: type: boolean description: Whether email (access code verification) is enabled as a login method default: false enabled: type: boolean description: Whether guest portal is enabled default: false expire: type: integer description: How long to remain authorized, in minutes contentEncoding: int32 default: 1440 examples: - 1440 external_portal_url: type: string description: Required if `wlan_portal_auth`==`external`. External portal URL (e.g. https://host/url) where we can append our query parameters to facebook_client_id: type: - string - 'null' description: Required if `facebook_enabled`==`true`. Facebook OAuth2 app id. This is optional. If not provided, it will use a default one. facebook_client_secret: type: - string - 'null' description: Required if `facebook_enabled`==`true`. Facebook OAuth2 app secret. If facebook_client_id was provided, provide a corresponding value. Else leave blank. contentEncoding: password facebook_email_domains: type: array items: type: string description: Optional if `facebook_enabled`==`true`. Email domains allowed for Facebook-authenticated guest users. If null or empty, any authenticated Facebook email domain is allowed. default: [] facebook_enabled: type: boolean description: Whether facebook is enabled as a login method default: false facebook_expire: type: - integer - 'null' description: Optional if `facebook_enabled`==`true`. Interval for which guest remains authorized using facebook auth (in minutes), if not provided, uses expire` contentEncoding: int32 forward: type: boolean description: Whether to forward the user to another URL after authorized default: false forward_url: type: - string - 'null' description: URL to forward the user to examples: - https://abc.com/promotions google_client_id: type: - string - 'null' description: Google OAuth2 app id. This is optional. If not provided, it will use a default one. google_client_secret: type: - string - 'null' description: Optional if `google_enabled`==`true`. Google OAuth2 app secret. If google_client_id was provided, provide a corresponding value. Else leave blank. contentEncoding: password google_email_domains: type: array items: type: string description: Optional if `google_enabled`==`true`. Email domains allowed for Google-authenticated guest users. If null or empty, any authenticated Google email domain is allowed. default: [] examples: - - mydomain.edu - mydomain.org google_enabled: type: boolean description: Whether Google is enabled as login method default: false google_expire: type: - integer - 'null' description: Optional if `google_enabled`==`true`. Interval for which guest remains authorized using Google Auth (in minutes), if not provided, uses expire` contentEncoding: int32 gupshup_password: type: string description: Required if `sms_provider`==`gupshup`. Password for the Gupshup SMS provider account contentEncoding: password gupshup_userid: type: string description: Required if `sms_provider`==`gupshup`. User ID for the Gupshup SMS provider account microsoft_client_id: type: - string - 'null' description: Optional if `microsoft_enabled`==`true`. Microsoft 365 OAuth2 client id. This is optional. If not provided, it will use a default one. microsoft_client_secret: type: - string - 'null' description: Optional if `microsoft_enabled`==`true`. Microsoft 365 OAuth2 client secret. If microsoft_client_id was provided, provide a corresponding value. Else leave blank. contentEncoding: password microsoft_email_domains: type: array items: type: string description: Optional if `microsoft_enabled`==`true`. Email domains allowed for Microsoft 365-authenticated guest users. If null or empty, any authenticated Microsoft 365 email domain is allowed. default: [] microsoft_enabled: type: boolean description: Whether microsoft 365 is enabled as a login method default: false microsoft_expire: type: - integer - 'null' description: Optional if `microsoft_enabled`==`true`. Interval for which guest remains authorized using microsoft auth (in minutes), if not provided, uses expire` contentEncoding: int32 passphrase_enabled: type: boolean description: Whether password is enabled default: false passphrase_expire: type: - integer - 'null' description: Optional if `passphrase_enabled`==`true`. Interval for which guest remains authorized using passphrase auth (in minutes), if not provided, uses `expire` contentEncoding: int32 password: type: - string - 'null' description: Required if `passphrase_enabled`==`true`. Passphrase guests must enter when passphrase authentication is enabled examples: - let me in predefined_sponsors_enabled: type: boolean description: Whether to show list of sponsor emails mentioned in `sponsors` object as a dropdown. If both `sponsor_notify_all` and `predefined_sponsors_enabled` are false, behavior is acc to `sponsor_email_domains` default: true predefined_sponsors_hide_email: type: boolean description: Whether to hide sponsor’s email from list of sponsors default: false privacy: type: boolean description: Whether to show the privacy policy in the WLAN guest portal default: false puzzel_password: type: string description: Required if `sms_provider`==`puzzel`. Password for the Puzzel SMS provider account contentEncoding: password puzzel_service_id: type: string description: Required if `sms_provider`==`puzzel`. Service ID for the Puzzel SMS provider account puzzel_username: type: string description: Required if `sms_provider`==`puzzel`. Username for the Puzzel SMS provider account smsMessageFormat: type: string description: Optional if `sms_enabled`==`true`. SMS Message format default: Code {{code}} expires in {{duration}} minutes. sms_enabled: type: boolean description: Whether sms is enabled as a login method default: false sms_expire: type: - integer - 'null' description: Optional if `sms_enabled`==`true`. Interval for which guest remains authorized using sms auth (in minutes), if not provided, uses expire` contentEncoding: int32 sms_provider: allOf: - $ref: '#/components/schemas/wlan_portal_sms_provider2' - description: 'Optional if `sms_enabled`==`true`. SMS provider used to deliver guest portal access codes. enum: `broadnet`, `clickatell`, `gupshup`, `manual`, `puzzel`, `telstra`, `twilio`, `smsglobal`.' examples: - twilio smsglobal_api_key: type: string description: Required if `sms_provider`==`smsglobal`, Client API Key smsglobal_api_secret: type: string description: Required if `sms_provider`==`smsglobal`, Client secret contentEncoding: password smsglobal_sender: type: string description: Optional sender's number or sender ID for SMSGlobal. If not provided, uses the default number associated with the account sponsor_auto_approve: type: boolean description: Optional if `sponsor_enabled`==`true`. Whether to automatically approve guest and allow sponsor to revoke guest access, needs predefined_sponsors_enabled enabled and sponsor_notify_all disabled default: false sponsor_email_domains: type: array items: type: string description: Email domains allowed for sponsor email addresses. Required if `sponsor_enabled` is `true` and `sponsors` is empty. examples: - - reserved.net - reserved.org sponsor_enabled: type: boolean description: Whether sponsor is enabled default: false sponsor_expire: type: - integer - 'null' description: Optional if `sponsor_enabled`==`true`. Interval for which guest remains authorized using sponsor auth (in minutes), if not provided, uses expire` contentEncoding: int32 sponsor_link_validity_duration: anyOf: - maximum: 60 minimum: 5 type: integer contentEncoding: int32 default: 60 - type: string description: Optional if `sponsor_enabled`==`true`. Validity duration, in minutes, for approve or deny links in sponsor emails. Valid values are 5 to 60. sponsor_notify_all: type: boolean description: Optional if `sponsor_enabled`==`true`. whether to notify all sponsors that are mentioned in `sponsors` object. Both `sponsor_notify_all` and `predefined_sponsors_enabled` should be true in order to notify sponsors. If true, email sent to 10 sponsors in no particular order. default: false sponsor_status_notify: type: boolean description: Optional if `sponsor_enabled`==`true`. If enabled, guest will get email about sponsor's action (approve/deny) default: false sponsors: oneOf: - type: array items: type: string - type: object additionalProperties: type: string examples: - sponsor1@company.com: FirstName1 LastName1 sponsor2@company.com: FirstName2 LastName2 description: Allowed sponsor email addresses and display names. Required if `sponsor_enabled` is `true` and `sponsor_email_domains` is empty. sso_default_role: type: string description: Optional if `wlan_portal_auth`==`sso`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched sso_forced_role: type: string description: Optional if `wlan_portal_auth`==`sso`. Role assigned to authenticated users when guest SSO is used sso_idp_cert: type: string description: Required if `wlan_portal_auth`==`sso`. IDP Cert (used to verify the signed response) sso_idp_sign_algo: allOf: - $ref: '#/components/schemas/wlan_portal_idp_sign_algo2' - description: 'Optional if `wlan_portal_auth`==`sso`. Signing algorithm used for SAML assertions from the identity provider. enum: `sha1`, `sha256`, `sha384`, `sha512`.' sso_idp_sso_url: type: string description: Required if `wlan_portal_auth`==`sso`, IDP Single-Sign-On URL sso_issuer: type: string description: Required if `wlan_portal_auth`==`sso`, IDP issuer URL sso_nameid_format: allOf: - $ref: '#/components/schemas/wlan_portal_sso_nameid_format2' - description: 'Optional if `wlan_portal_auth`==`sso`. SAML NameID format expected from the identity provider. enum: `email`, `unspecified`.' telstra_client_id: type: string description: Required if `sms_provider`==`telstra`, Client ID provided by Telstra telstra_client_secret: type: string description: Required if `sms_provider`==`telstra`, Client secret provided by Telstra contentEncoding: password twilio_auth_token: type: - string - 'null' description: Required if `sms_provider`==`twilio`, Auth token account with twilio account contentEncoding: password examples: - af9dac44c344a875ab5d31cb7abcdefg twilio_phone_number: type: - string - 'null' description: Required if `sms_provider`==`twilio`, Twilio phone number associated with the account. See example for accepted format. examples: - '+18548888888' twilio_sid: type: - string - 'null' description: Required if `sms_provider`==`twilio`, Account SID provided by Twilio examples: - af9dac44c344a875ab5d31cb7abcdefg description: Guest portal settings for this WLAN wlan_schedule2: title: wlan_schedule2 type: object properties: enabled: type: boolean description: Whether the WLAN operating schedule is enabled default: false hours: allOf: - $ref: '#/components/schemas/hours2' - description: Time ranges when the WLAN is scheduled to operate description: Operating schedule controlling when this WLAN is active wlan_app_qos2: title: wlan_app_qos2 type: object properties: apps: type: object additionalProperties: $ref: '#/components/schemas/wlan_app_qos_apps_properties' description: Map of application keys to QoS rewrite settings examples: - skype-business-video: dscp: 32 dst_subnet: 10.2.0.0/16 src_subnet: 10.2.0.0/16 enabled: type: boolean description: Whether application QoS rewrite rules are enabled for this WLAN default: false others: uniqueItems: true type: array items: $ref: '#/components/schemas/wlan_app_qos_others_item' description: Custom traffic QoS rules that are not tied to named applications description: QoS rules for application traffic on this WLAN hours2: title: hours2 type: object properties: fri: type: string description: Operating hour range for Friday examples: - 09:00-17:00 mon: type: string description: Operating hour range for Monday examples: - 09:00-17:00 sat: type: string description: Operating hour range for Saturday examples: - 09:00-17:00 sun: type: string description: Operating hour range for Sunday examples: - 09:00-17:00 thu: type: string description: Operating hour range for Thursday examples: - 09:00-17:00 tue: type: string description: Operating hour range for Tuesday examples: - 09:00-17:00 wed: type: string description: Operating hour range for Wednesday examples: - 09:00-17:00 description: Time ranges when the WLAN is scheduled to operate wlan_airwatch2: title: wlan_airwatch2 type: object properties: api_key: type: string description: API key used to authenticate to the AirWatch service examples: - aHhlbGxvYXNkZmFzZGZhc2Rmc2RmCg==" console_url: type: string description: Base console URL of the AirWatch deployment examples: - https://hs1.airwatchportals.com enabled: type: boolean description: Whether AirWatch integration is enabled for the WLAN default: false password: type: string description: AirWatch integration account password for this WLAN contentEncoding: password examples: - user1 username: type: string description: AirWatch integration account username for this WLAN examples: - test123 description: Integration settings for AirWatch device compliance on this WLAN wlan_portal_sms_provider2: title: wlan_portal_sms_provider2 enum: - broadnet - clickatell - gupshup - manual - puzzel - telstra - twilio - smsglobal type: string description: 'Optional if `sms_enabled`==`true`. SMS provider used to deliver guest portal access codes. enum: `broadnet`, `clickatell`, `gupshup`, `manual`, `puzzel`, `telstra`, `twilio`, `smsglobal`.' examples: - twilio radius_keywrap_format1: title: radius_keywrap_format1 enum: - ascii - hex type: string description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' wlan_auth2: title: wlan_auth2 required: - type type: object properties: anticlog_threshold: maximum: 32 minimum: 16 type: integer description: SAE anti-clogging token threshold contentEncoding: int32 default: 16 examples: - 16 eap_reauth: type: boolean description: Whether to trigger EAP reauth when the session ends default: false enable_beacon_protection: type: boolean description: Enable Beacon Protection; default is false for better compatibility default: false enable_gcmp256: type: boolean description: Enable GCMP-256 encryption suite; default is false for better compatibility default: false enable_mac_auth: type: boolean description: Whether to enable MAC Auth, uses the same auth_servers default: false key_idx: maximum: 4 minimum: 1 type: integer description: When `type`==`wep`, index of the WEP key used as the default transmit key contentEncoding: int32 default: 1 keys: type: array items: type: - string - 'null' description: When `type`==`wep`, WEP keys configured for this WLAN default: [] multi_psk_only: type: boolean description: When `type`==`psk`, whether to only use multi_psk default: false owe: allOf: - $ref: '#/components/schemas/wlan_auth_owe2' - description: 'When `type`==`open`, Opportunistic Wireless Encryption mode for this WLAN. enum: `disabled`, `enabled`, `required`.' pairwise: type: array items: oneOf: - {} - $ref: '#/components/schemas/wlan_auth_pairwise_item' description: When `type`==`psk` or `type`==`eap`, pairwise cipher suites allowed for this WLAN private_wlan: type: boolean description: When `multi_psk_only`==`true`, whether private wlan is enabled default: false psk: maxLength: 64 minLength: 8 type: - string - 'null' description: When `type`==`psk`, 8-64 characters, or 64 hex characters examples: - foryoureyesonly type: allOf: - $ref: '#/components/schemas/wlan_auth_type2' - description: 'Authentication mode used by this WLAN. enum: `eap`, `eap192`, `open`, `psk`, `psk-tkip`, `psk-wpa2-tkip`, `wep`.' examples: - psk wep_as_secondary_auth: type: boolean description: Enable WEP as secondary auth default: false description: Settings that control client authentication for this WLAN response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response wlan_roam_mode2: title: wlan_roam_mode2 enum: - 11r - NONE - OKC type: string description: 'Fast roaming mode configured for this WLAN. enum: `11r`, `NONE`, `OKC`.' examples: - NONE wlan_dns_server_rewrite2: title: wlan_dns_server_rewrite2 type: object properties: enabled: type: boolean description: Whether DNS server rewrite by RADIUS group is enabled for this WLAN default: false radius_groups: type: object additionalProperties: type: string description: Map between radius_group and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server examples: - contractor: 172.1.1.1 guest: 8.8.8.8 description: RADIUS group based DNS server rewrite settings for this WLAN response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response radsec_server: title: radsec_server type: object properties: host: type: string description: Address or hostname of the RadSec server examples: - 1.1.1.1 port: maximum: 65535 minimum: 1 type: integer description: TCP port used by the RadSec server contentEncoding: int32 examples: - 1812 description: External RadSec server settings wlan_auth_pairwise_item: title: wlan_auth_pairwise_item enum: - wpa1-ccmp - wpa1-tkip - wpa2-ccmp - wpa2-tkip - wpa3 type: string description: 'enum: `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`' examples: - wpa3 wlan_dynamic_vlan_default_vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 default: 999 description: VLAN ID, VLAN range or variable to use when there’s no match from RADIUS wlan_inject_dhcp_option_822: title: wlan_inject_dhcp_option_822 type: object properties: circuit_id: type: string description: "Information to set in the `circuit_id` field of the DHCP Option 82. It is possible to use static string or the following variables (e.g. `{{SSID}}:{{AP_MAC}}`):\n * {{AP_MAC}}\n * {{AP_MAC_DASHED}}\n * {{AP_MODEL}}\n * {{AP_NAME}}\n * {{SITE_NAME}}\n * {{SSID}}" examples: - '{{SSID}}:{{AP_MAC}}' enabled: type: boolean description: Whether to inject option 82 when forwarding DHCP packets default: false description: DHCP Option 82 insertion settings for this WLAN wlan_dynamic_psk2: title: wlan_dynamic_psk2 type: object properties: default_psk: maxLength: 63 minLength: 8 type: string description: Default PSK to use if cloud WLC is not available, 8-63 characters examples: - foryoureyesonly default_vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Default VLAN ID used when dynamic PSK lookup does not return a VLAN enabled: type: boolean description: Whether dynamic PSK is enabled for this WLAN default: false force_lookup: type: boolean description: When 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto default: false local_vlan_ids: type: array items: $ref: '#/components/schemas/vlan_id_with_variable' description: VLANs to be bridged locally when forwarding to mxtunnel or site mxedge source: allOf: - $ref: '#/components/schemas/dynamic_psk_source1' - description: 'Origin used to retrieve per-user PSKs. enum: `cloud_psks`, `radius`.' examples: - cloud_psks description: Per-user PSK selection settings for this WLAN coa_server: title: coa_server required: - ip - secret type: object properties: disable_event_timestamp_check: type: boolean description: Whether to disable Event-Timestamp Check default: false enabled: type: boolean description: Whether this RADIUS CoA server is enabled default: false ip: type: string description: Server IPv4 address for RADIUS CoA messages contentEncoding: ipv4 examples: - 1.2.3.4 port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used to send RADIUS CoA messages to the server secret: type: string description: Shared secret used to authenticate RADIUS CoA messages examples: - testing456 description: RADIUS Change of Authorization (CoA) server settings wlan_qos_class2: title: wlan_qos_class2 enum: - background - best_effort - video - voice type: string description: 'QoS traffic class applied when WLAN QoS override is enabled. enum: `background`, `best_effort`, `video`, `voice`.' examples: - best_effort securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header