openapi: 3.2.0 info: title: Mist Sites Anomaly API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Sites Anomaly paths: /api/v1/sites/{site_id}/anomaly/client/{client_mac}/{metric}: parameters: [] get: tags: - Sites Anomaly summary: getSiteAnomalyEventsForClient description: Get Client Anomaly Events operationId: getSiteAnomalyEventsForClient parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: client_mac in: path description: '' required: true schema: pattern: ^[0-9a-fA-F]{12}$ type: string examples: - 0000000000ab - name: metric in: path description: See [List Insight Metrics]($e/Constants%20Definitions/listInsightMetrics) for available metrics required: true schema: type: string responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_anomaly_search' - description: Paginated anomaly search response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_anomaly_search' - description: Paginated anomaly search response contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/anomaly/device/{device_mac}/{metric}: parameters: [] get: tags: - Sites Anomaly summary: getSiteAnomalyEventsForDevice description: Get Device Anomaly Events operationId: getSiteAnomalyEventsForDevice parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: metric in: path description: See [List Insight Metrics]($e/Constants%20Definitions/listInsightMetrics) for available metrics required: true schema: type: string - name: device_mac in: path description: '' required: true schema: pattern: ^[0-9a-fA-F]{12}$ type: string examples: - 0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_anomaly_search' - description: Paginated anomaly search response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_anomaly_search' - description: Paginated anomaly search response contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/anomaly/{metric}: parameters: [] get: tags: - Sites Anomaly summary: listSiteAnomalyEvents description: List Site Anomaly Events operationId: listSiteAnomalyEvents parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: metric in: path description: See [List Insight Metrics]($e/Constants%20Definitions/listInsightMetrics) for available metrics required: true schema: type: string responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_anomaly_search' - description: Paginated anomaly search response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_anomaly_search' - description: Paginated anomaly search response contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response response_anomaly_search: title: response_anomaly_search required: - end - limit - page - results - start type: object properties: end: type: integer description: Search window end timestamp for anomaly results, in epoch seconds contentEncoding: int32 examples: - 1711035686 limit: type: integer description: Maximum number of anomaly results requested per page contentEncoding: int32 examples: - 10 page: type: integer description: Current page number in the anomaly search results contentEncoding: int32 examples: - 1 results: uniqueItems: true type: array items: $ref: '#/components/schemas/anomaly' description: Anomaly records returned for this page start: type: integer description: Search window start timestamp for anomaly results, in epoch seconds contentEncoding: int32 examples: - 1710949286 total: type: integer description: Number of anomaly records matching the search contentEncoding: int32 examples: - 232 description: Paginated anomaly search response response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response anomaly: title: anomaly required: - events - sle_baseline - sle_deviation - timestamp type: object properties: events: type: array items: type: string description: Event names contributing to this anomaly readOnly: true since: type: number description: Timestamp when the anomalous period began readOnly: true sle_baseline: type: number description: Expected SLE value used as the anomaly baseline readOnly: true sle_deviation: type: number description: Difference between the observed SLE value and the baseline readOnly: true timestamp: type: number description: Time when this anomaly data point was recorded, in epoch seconds readOnly: true description: SLE anomaly data point with baseline, deviation, and contributing events securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header