openapi: 3.2.0 info: title: Mist Sites AP Templates API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Sites AP Templates description: 'AP Templates are defining Wi-Fi and AP settings that can be assigned to Access Points based on different types of rules. Site AP Templates are created and managed at the site level and can only be referenced and used within that particular site.' paths: /api/v1/sites/{site_id}/aptemplates/derived: parameters: [] get: tags: - Sites AP Templates summary: listSiteApTemplatesDerived description: Get the list of derived AP Templates for a site operationId: listSiteApTemplatesDerived parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: resolve in: query description: Whether resolve the site variables style: form explode: true schema: type: boolean responses: '200': description: Example response headers: {} content: application/json: schema: type: array items: $ref: '#/components/schemas/ap_template' description: List of AP templates examples: - - ap_matching: enabled: true rules: - match_model: string name: string port_config: eth1,eth2: disabled: true dynamic_vlan: default_vlan_id: 999 enabled: true port_vlan_id: 1 vlan_id: 9 vlan_ids: 1, 10, 50 created_time: 0 for_site: true id: 497f6eca-6276-4993-bfeb-53cbbbba9f08 modified_time: 0 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b site_id: 72771e6a-6f5e-4de4-a5b9-1266c4197811 wifi: cisco_enabled: true disable_11k: false disable_radios_when_power_constrained: true enable_arp_spoof: true enable_shared_radio_scanning: false enabled: true locate_connected: false locate_unconnected: false mesh_allow_dfs: false mesh_enable_crm: true mesh_enabled: true proxy_arp: false contentMediaType: application/json examples: Example: value: - ap_matching: enabled: true rules: - match_model: string name: string port_config: eth1,eth2: disabled: true dynamic_vlan: default_vlan_id: 999 enabled: true port_vlan_id: 1 vlan_id: 9 vlan_ids: 1, 10, 50 created_time: 0 for_site: true id: 497f6eca-6276-4993-bfeb-53cbbbba9f08 modified_time: 0 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b site_id: 72771e6a-6f5e-4de4-a5b9-1266c4197811 wifi: cisco_enabled: true disable_11k: false disable_radios_when_power_constrained: true enable_arp_spoof: true enable_shared_radio_scanning: false enabled: true locate_connected: false locate_unconnected: false mesh_allow_dfs: false mesh_enable_crm: true mesh_enabled: true proxy_arp: false application/vnd.api+json: schema: type: array items: $ref: '#/components/schemas/ap_template' description: List of AP templates examples: - - ap_matching: enabled: true rules: - match_model: string name: string port_config: eth1,eth2: disabled: true dynamic_vlan: default_vlan_id: 999 enabled: true port_vlan_id: 1 vlan_id: 9 vlan_ids: 1, 10, 50 created_time: 0 for_site: true id: 497f6eca-6276-4993-bfeb-53cbbbba9f08 modified_time: 0 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b site_id: 72771e6a-6f5e-4de4-a5b9-1266c4197811 wifi: cisco_enabled: true disable_11k: false disable_radios_when_power_constrained: true enable_arp_spoof: true enable_shared_radio_scanning: false enabled: true locate_connected: false locate_unconnected: false mesh_allow_dfs: false mesh_enable_crm: true mesh_enabled: true proxy_arp: false contentMediaType: application/vnd.api+json examples: Example: value: - ap_matching: enabled: true rules: - match_model: string name: string port_config: eth1,eth2: disabled: true dynamic_vlan: default_vlan_id: 999 enabled: true port_vlan_id: 1 vlan_id: 9 vlan_ids: 1, 10, 50 created_time: 0 for_site: true id: 497f6eca-6276-4993-bfeb-53cbbbba9f08 modified_time: 0 org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b site_id: 72771e6a-6f5e-4de4-a5b9-1266c4197811 wifi: cisco_enabled: true disable_11k: false disable_radios_when_power_constrained: true enable_arp_spoof: true enable_shared_radio_scanning: false enabled: true locate_connected: false locate_unconnected: false mesh_allow_dfs: false mesh_enable_crm: true mesh_enabled: true proxy_arp: false '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response ap_port_config_dynamic_vlan_type2: title: ap_port_config_dynamic_vlan_type2 enum: - airespace-interface-name - standard type: string description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS. enum: `airespace-interface-name`, `standard`.' ap_port_config_mac_auth_protocol2: title: ap_port_config_mac_auth_protocol2 enum: - eap-md5 - eap-peap - pap type: string description: 'Protocol used for MAC authentication when `enable_mac_auth` is `true`. enum: `eap-md5`, `eap-peap`, `pap`.' ap_port_config_forwarding2: title: ap_port_config_forwarding2 enum: - all - limited - mxtunnel - site_mxedge - wxtunnel type: string description: 'Traffic forwarding mode for this AP Ethernet port. enum: `all`, `limited`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response ap_template_wifi2: title: ap_template_wifi2 type: object properties: cisco_enabled: type: boolean description: Whether Cisco-specific Wi-Fi compatibility behavior is enabled disable_11k: type: boolean description: Whether 802.11k neighbor reports are disabled default: false disable_radios_when_power_constrained: type: boolean description: Whether AP radios are disabled when power is constrained enable_arp_spoof: type: boolean description: Whether ARP spoofing checks are enabled when proxy ARP is used enable_shared_radio_scanning: type: boolean description: Whether shared radio scanning is enabled for AP radio scanning default: false enabled: type: boolean description: Whether Wi-Fi settings in this AP template are enabled default: true locate_connected: type: boolean description: Whether location tracking is enabled for connected clients default: false locate_unconnected: type: boolean description: Whether location tracking is enabled for unconnected clients default: false mesh_allow_dfs: type: boolean description: Whether mesh links may use DFS channels, which can add CAC delays during scanning default: false mesh_enable_crm: type: boolean description: Whether CRM is enabled for mesh networking in this AP template mesh_enabled: type: boolean description: Whether mesh networking is enabled by this AP template proxy_arp: type: boolean description: Whether proxy ARP is enabled for Wi-Fi clients default: false description: Wi-Fi and mesh settings applied by this AP template ap_port_config_port_auth2: title: ap_port_config_port_auth2 enum: - dot1x - none type: string description: 'Authentication mode for this AP Ethernet port. enum: `dot1x`, `none`.' examples: - none ap_port_config_dynamic_vlan2: title: ap_port_config_dynamic_vlan2 type: object properties: default_vlan_id: maximum: 4094 minimum: 1 type: integer description: Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match contentEncoding: int32 examples: - 999 enabled: type: boolean description: Whether dynamic VLAN assignment is enabled for this AP port type: allOf: - $ref: '#/components/schemas/ap_port_config_dynamic_vlan_type2' - description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS. enum: `airespace-interface-name`, `standard`.' vlans: type: object additionalProperties: type: string nullable: true description: Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. "guest"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored. examples: - 1-10: null user: 10 description: RADIUS-assigned VLAN settings for AP port authentication radius_acct_server: title: radius_acct_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS accounting server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this accounting server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS accounting server secret: type: string description: Shared secret used with this RADIUS accounting server contentEncoding: password examples: - testing123 description: RADIUS accounting server settings ap_template: title: ap_template required: - ap_matching type: object properties: ap_matching: allOf: - $ref: '#/components/schemas/ap_template_matching2' - description: Rules used to select access points for this AP template created_time: type: number description: Timestamp when the AP template was created readOnly: true for_site: type: boolean description: Whether the AP template is scoped to a site rather than the organization readOnly: true id: type: string description: Unique identifier of the AP template contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f modified_time: type: number description: Timestamp when the AP template was last modified readOnly: true org_id: type: string description: Organization that owns this AP template contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 site_id: type: string description: Site that owns this site-level AP template contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 wifi: allOf: - $ref: '#/components/schemas/ap_template_wifi2' - description: Wi-Fi and mesh settings applied by this AP template description: Access point template configuration radius_auth_server: title: radius_auth_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS authentication server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this authentication server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS authentication server require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Shared secret used with this RADIUS authentication server contentEncoding: password examples: - testing123 description: RADIUS authentication server settings wlan_mist_nac3: title: wlan_mist_nac3 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled. contentEncoding: int32 default: 0 examples: - 60 auth_servers_retries: maximum: 10 minimum: 1 type: integer description: RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3. contentEncoding: int32 default: 2 examples: - 3 auth_servers_timeout: maximum: 30 minimum: 1 type: integer description: RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10. contentEncoding: int32 default: 5 examples: - 5 coa_enabled: type: boolean description: Allows a RADIUS server to dynamically modify the authorization status of a user session. default: false coa_port: maximum: 65535 minimum: 1 type: integer description: the communication port used for “Change of Authorization” (CoA) messages contentEncoding: int32 examples: - 3799 enabled: type: boolean description: "When enabled:\n * `auth_servers` is ignored\n * `acct_servers` is ignored\n * `auth_servers_*` are ignored\n * `coa_servers` is ignored\n * `radsec` is ignored\n * `coa_enabled` is assumed" default: false fast_dot1x_timers: type: boolean description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`. default: false network: type: - string - 'null' description: Which network the mist nac server resides in examples: - default source_ip: type: - string - 'null' description: In case there is a static IP for this network, we can specify it using source ip examples: - 1.2.3.4 description: Juniper Mist NAC settings used by AP port authentication radius_config2: title: radius_config2 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this Junos configuration auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this Junos configuration auth_servers_retries: type: integer description: Number of RADIUS authentication request retries before failover contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS authentication server timeout, in seconds contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: maximum: 65535 minimum: 1 type: integer description: UDP port used for RADIUS Change of Authorization (CoA) contentEncoding: int32 default: 3799 network: type: string description: Use `network` or `source_ip`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS authentication and accounting settings for this AP port ap_template_matching_rule: title: ap_template_matching_rule type: object properties: match_model: minLength: 1 type: string description: Access point model matched by this AP template rule name: minLength: 1 type: string description: Display label for this AP template matching rule port_config: type: object additionalProperties: $ref: '#/components/schemas/ap_port_config' description: Property key is the interface(s) name (e.g. "eth1,eth2") description: Model and name match criteria for an AP template port configuration ap_port_config: title: ap_port_config type: object properties: disabled: type: boolean description: Whether this AP Ethernet port is disabled default: false dynamic_vlan: allOf: - $ref: '#/components/schemas/ap_port_config_dynamic_vlan2' - description: RADIUS-assigned VLAN settings for AP port authentication enable_mac_auth: type: boolean description: Whether MAC authentication is enabled on this AP port default: false forwarding: allOf: - $ref: '#/components/schemas/ap_port_config_forwarding2' - description: 'Traffic forwarding mode for this AP Ethernet port. enum: `all`, `limited`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all mac_auth_preferred: type: boolean description: When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth default: false mac_auth_protocol: allOf: - $ref: '#/components/schemas/ap_port_config_mac_auth_protocol2' - description: 'Protocol used for MAC authentication when `enable_mac_auth` is `true`. enum: `eap-md5`, `eap-peap`, `pap`.' mist_nac: allOf: - $ref: '#/components/schemas/wlan_mist_nac3' - description: Juniper Mist NAC settings used by AP port authentication mx_tunnel_id: type: string description: If `forwarding`==`mxtunnel`, vlan_ids comes from mxtunnel contentEncoding: uuid examples: - 08cd7499-5841-51c8-e663-fb16b6f3b45e mxtunnel_name: type: string description: If `forwarding`==`site_mxedge`, vlan_ids comes from site_mxedge (`mxtunnel` under site setting) port_auth: allOf: - $ref: '#/components/schemas/ap_port_config_port_auth2' - description: 'Authentication mode for this AP Ethernet port. enum: `dot1x`, `none`.' examples: - none port_vlan_id: maximum: 4094 minimum: 1 type: integer description: If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port contentEncoding: int32 examples: - 1 radius_config: allOf: - $ref: '#/components/schemas/radius_config2' - description: RADIUS authentication and accounting settings for this AP port radsec: allOf: - $ref: '#/components/schemas/radsec3' - description: TLS-secured RADIUS settings for this AP port vlan_id: maximum: 4094 minimum: 1 type: integer description: "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnel` under site setting)" contentEncoding: int32 examples: - 9 vlan_ids: type: string description: If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port examples: - 10,20,30 wxtunnel_id: type: string description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session contentEncoding: uuid examples: - 7dae216d-7c98-a51b-e068-dd7d477b7216 wxtunnel_remote_id: type: string description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session examples: - wifiguest description: Ethernet port behavior settings for an access point radsec3: title: radsec3 type: object properties: coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic default: false enabled: type: boolean description: Whether RadSec is enabled idle_timeout: anyOf: - type: integer contentEncoding: int32 default: 60 - type: string description: Idle timeout, in seconds, for RadSec connections mxcluster_ids: type: array items: type: string contentEncoding: uuid description: Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel proxy_hosts: type: array items: type: string description: RadSec proxy hostnames advertised to APs server_name: type: string description: TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge. examples: - radsec.abc.com servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radsec_server' description: External RadSec servers. Only if not Mist Edge. use_mxedge: type: boolean description: Whether to use organization Mist Edge instances as RadSec proxies use_site_mxedge: type: boolean description: Whether to use site Mist Edge instances when this WLAN does not use mxtunnel default: false description: TLS-secured RADIUS settings for this AP port ap_template_matching2: title: ap_template_matching2 type: object properties: enabled: type: boolean description: Whether AP matching is enabled for this AP template rules: uniqueItems: true type: array items: $ref: '#/components/schemas/ap_template_matching_rule' description: AP matching entries that select access points and apply AP port configuration description: Rules used to select access points for this AP template radius_keywrap_format1: title: radius_keywrap_format1 enum: - ascii - hex type: string description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response radsec_server: title: radsec_server type: object properties: host: type: string description: Address or hostname of the RadSec server examples: - 1.1.1.1 port: maximum: 65535 minimum: 1 type: integer description: TCP port used by the RadSec server contentEncoding: int32 examples: - 1812 description: External RadSec server settings securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header