openapi: 3.2.0
info:
  title: Mist Sites Service Policies API
  description: '> Version: **2607.1.1**

    >

    > Date: **August 17, 2026**


    NOTE:

    Some important API changes will be introduced.'
  contact:
    name: Thomas Munzer
    email: tmunzer@juniper.net
  version: 2607.1.1
servers:
- url: https://api.mist.com
  variables: {}
- url: https://api.gc1.mist.com
  variables: {}
- url: https://api.ac2.mist.com
  variables: {}
- url: https://api.gc2.mist.com
  variables: {}
- url: https://api.gc4.mist.com
  variables: {}
- url: https://api.eu.mist.com
  variables: {}
- url: https://api.gc3.mist.com
  variables: {}
- url: https://api.ac6.mist.com
  variables: {}
- url: https://api.gc6.mist.com
  variables: {}
- url: https://api.ac5.mist.com
  variables: {}
- url: https://api.gc5.mist.com
  variables: {}
- url: https://api.gc7.mist.com
  variables: {}
security:
- apiToken: []
- csrfToken: []
tags:
- name: Sites Service Policies
  description: The API Endpoints for the Service Policies at the site level can be used to get the site derived configuration, meaning the merge between the site level configuration and the org level configuration.
paths:
  /api/v1/sites/{site_id}/servicepolicies/derived:
    parameters: []
    get:
      tags:
      - Sites Service Policies
      summary: listSiteServicePoliciesDerived
      description: Get the list of derived Service Policies for a Site
      operationId: listSiteServicePoliciesDerived
      parameters:
      - name: site_id
        in: path
        description: ''
        required: true
        schema:
          type: string
          contentEncoding: uuid
          examples:
          - 000000ab-00ab-00ab-00ab-0000000000ab
      - name: resolve
        in: query
        description: Whether resolve the site variables
        style: form
        explode: true
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: Example response
          headers: {}
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/org_service_policy'
                description: List of organization-level service policies
                examples:
                - - action: allow
                    created_time: 0
                    id: string
                    modified_time: 0
                    name: string
                    org_id: string
                    services:
                    - string
                    tenants:
                    - string
                contentMediaType: application/json
              examples:
                Example:
                  value:
                  - action: allow
                    created_time: 0
                    id: string
                    modified_time: 0
                    name: string
                    org_id: string
                    services:
                    - string
                    tenants:
                    - string
            application/vnd.api+json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/org_service_policy'
                description: List of organization-level service policies
                examples:
                - - action: allow
                    created_time: 0
                    id: string
                    modified_time: 0
                    name: string
                    org_id: string
                    services:
                    - string
                    tenants:
                    - string
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                  - action: allow
                    created_time: 0
                    id: string
                    modified_time: 0
                    name: string
                    org_id: string
                    services:
                    - string
                    tenants:
                    - string
        '400':
          description: Bad Syntax
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http400'
                - description: Standard HTTP 400 bad request error response
                  examples:
                  - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http400'
                - description: Standard HTTP 400 bad request error response
                  examples:
                  - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
        '401':
          description: Unauthorized
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http401'
                - description: Standard HTTP 401 authentication error response
                  examples:
                  - detail: Authentication credentials were not provided.
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: Authentication credentials were not provided.
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http401'
                - description: Standard HTTP 401 authentication error response
                  examples:
                  - detail: Authentication credentials were not provided.
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: Authentication credentials were not provided.
        '403':
          description: Permission Denied
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http403'
                - description: Standard HTTP 403 permission error response
                  examples:
                  - detail: You do not have permission to perform this action.
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: You do not have permission to perform this action.
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http403'
                - description: Standard HTTP 403 permission error response
                  examples:
                  - detail: You do not have permission to perform this action.
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: You do not have permission to perform this action.
        '404':
          description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http404'
                - description: Standard HTTP 404 not found error response
                contentMediaType: application/json
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http404'
                - description: Standard HTTP 404 not found error response
                contentMediaType: application/vnd.api+json
        '429':
          description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http429'
                - description: Standard HTTP 429 rate limit error response
                  examples:
                  - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http429'
                - description: Standard HTTP 429 rate limit error response
                  examples:
                  - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
      deprecated: false
components:
  schemas:
    service_policy_aamw_profile2:
      title: service_policy_aamw_profile2
      enum:
      - docsonly
      - executables
      - standard
      type: string
      description: 'Built-in advanced anti-malware inspection profile to apply. enum: `docsonly`, `executables`, `standard`.'
    response_http403:
      title: response_http403
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
      description: Standard HTTP 403 permission error response
    service_policy_secintel_profile2:
      title: service_policy_secintel_profile2
      enum:
      - default
      - standard
      - strict
      type: string
      description: 'Protection level applied by SecIntel inspection. enum: `default`, `standard`, `strict`.'
    response_http400:
      title: response_http400
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
      description: Standard HTTP 400 bad request error response
    service_policy_ewf_rule_profile2:
      title: service_policy_ewf_rule_profile2
      enum:
      - critical
      - standard
      - strict
      type: string
      description: 'Enhanced web filtering profile applied by this rule. enum: `critical`, `standard`, `strict`.'
    service_policy_antivirus1:
      title: service_policy_antivirus1
      type: object
      properties:
        avprofile_id:
          type: string
          description: Organization-level antivirus profile ID; takes precedence over inline `profile` settings
          contentEncoding: uuid
        enabled:
          type: boolean
          description: Whether antivirus inspection is enabled for the service policy
          default: false
        profile:
          type: string
          description: Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key
      description: Malware and virus inspection settings applied by this service policy
    allow_deny2:
      title: allow_deny2
      enum:
      - allow
      - deny
      type: string
      description: Allow or deny action for traffic matched by this service policy
    service_policy_appqoe1:
      title: service_policy_appqoe1
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether application QoE is enabled for the service policy
          default: false
      description: Application QoE settings applied by this service policy
    response_http404:
      title: response_http404
      type: object
      properties:
        id:
          type: string
          description: Missing resource identifier, when the API includes one
      description: Standard HTTP 404 not found error response
    idp_config2:
      title: idp_config2
      type: object
      properties:
        alert_only:
          type: boolean
          description: Whether to alert without enforcing IDP prevention actions
        enabled:
          type: boolean
          description: Whether IDP inspection is enabled for the policy
          default: false
        idpprofile_id:
          type: string
          description: org_level IDP Profile can be used, this takes precedence over `profile`
          contentEncoding: uuid
          examples:
          - 89b9d208-84a4-fa8f-af57-78f92c639cf2
        profile:
          type: string
          description: 'enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles'
          default: strict
      description: Intrusion detection and prevention settings applied by this service policy
    service_policy_ewf_rule:
      title: service_policy_ewf_rule
      type: object
      properties:
        alert_only:
          type: boolean
          description: Whether matching enhanced web filtering traffic is logged without being blocked
        block_message:
          type: string
          description: Message returned when enhanced web filtering blocks a request
          examples:
          - Access to this URL Category has been blocked
        enabled:
          type: boolean
          description: Whether this enhanced web filtering rule is enabled
          default: false
        profile:
          allOf:
          - $ref: '#/components/schemas/service_policy_ewf_rule_profile2'
          - description: 'Enhanced web filtering profile applied by this rule. enum: `critical`, `standard`, `strict`.'
      description: Enhanced web filtering rule applied by a service policy
    response_http429:
      title: response_http429
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
      description: Standard HTTP 429 rate limit error response
    service_policy_secintel1:
      title: service_policy_secintel1
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether SecIntel inspection is enabled for the service policy
          default: false
        profile:
          allOf:
          - $ref: '#/components/schemas/service_policy_secintel_profile2'
          - description: 'Protection level applied by SecIntel inspection. enum: `default`, `standard`, `strict`.'
        secintelprofile_id:
          type: string
          description: Organization-level SecIntel profile ID; takes precedence over inline `profile` settings
      description: Juniper SecIntel threat intelligence settings applied by this service policy
    response_http401:
      title: response_http401
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
      description: Standard HTTP 401 authentication error response
    ssl_proxy_ciphers_category2:
      title: ssl_proxy_ciphers_category2
      enum:
      - medium
      - strong
      - weak
      type: string
      description: 'Allowed cipher strength category for SSL proxy inspection. enum: `medium`, `strong`, `weak`.'
    org_service_policy:
      title: org_service_policy
      type: object
      properties:
        aamw:
          allOf:
          - $ref: '#/components/schemas/service_policy_aamw2'
          - description: Advanced anti-malware settings applied by this service policy
        action:
          allOf:
          - $ref: '#/components/schemas/allow_deny2'
          - description: Allow or deny action for traffic matched by this service policy
        antivirus:
          allOf:
          - $ref: '#/components/schemas/service_policy_antivirus1'
          - description: Malware and virus inspection settings applied by this service policy
        appqoe:
          allOf:
          - $ref: '#/components/schemas/service_policy_appqoe1'
          - description: Application QoE settings applied by this service policy
        created_time:
          type: number
          description: Epoch timestamp when the service policy was created
          readOnly: true
        ewf:
          type: array
          items:
            $ref: '#/components/schemas/service_policy_ewf_rule'
          description: Enhanced web filtering rules applied by this service policy
        id:
          type: string
          description: Unique identifier of the service policy
          contentEncoding: uuid
          readOnly: true
          examples:
          - 53f10664-3ce8-4c27-b382-0ef66432349f
        idp:
          allOf:
          - $ref: '#/components/schemas/idp_config2'
          - description: Intrusion detection and prevention settings applied by this service policy
        local_routing:
          type: boolean
          description: Whether the policy permits access within the same VRF
        modified_time:
          type: number
          description: Epoch timestamp when the service policy was last modified
          readOnly: true
        name:
          type: string
          description: Display name of the service policy
        org_id:
          type: string
          description: Organization that owns this service policy
          contentEncoding: uuid
          readOnly: true
          examples:
          - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
        path_preference:
          type: string
          description: By default, we derive all paths available and use them, optionally, you can customize by using `path_preference`
        secintel:
          allOf:
          - $ref: '#/components/schemas/service_policy_secintel1'
          - description: Juniper SecIntel threat intelligence settings applied by this service policy
        services:
          uniqueItems: true
          type: array
          items:
            type: string
          description: Application services or groups matched by this policy
        ssl_proxy:
          allOf:
          - $ref: '#/components/schemas/service_policy_ssl_proxy1'
          - description: SSL proxy inspection settings applied by this service policy
        tenants:
          uniqueItems: true
          type: array
          items:
            type: string
          description: Tenant names matched by this service policy
      description: Organization-level service policy that allows or denies traffic for tenants and services
    service_policy_ssl_proxy1:
      title: service_policy_ssl_proxy1
      type: object
      properties:
        ciphers_category:
          allOf:
          - $ref: '#/components/schemas/ssl_proxy_ciphers_category2'
          - description: 'Allowed cipher strength category for SSL proxy inspection. enum: `medium`, `strong`, `weak`.'
        enabled:
          type: boolean
          description: Whether SSL proxy inspection is enabled for the service policy
          default: false
      description: SSL proxy inspection settings applied by this service policy
    service_policy_aamw2:
      title: service_policy_aamw2
      type: object
      properties:
        aamwprofile_id:
          type: string
          description: Organization-level advanced anti-malware profile ID; takes precedence over inline `profile` settings
          contentEncoding: uuid
        enabled:
          type: boolean
          description: Whether advanced anti-malware inspection is enabled for the service policy
          default: false
        profile:
          allOf:
          - $ref: '#/components/schemas/service_policy_aamw_profile2'
          - description: 'Built-in advanced anti-malware inspection profile to apply. enum: `docsonly`, `executables`, `standard`.'
      description: Advanced anti-malware settings applied by this service policy
  securitySchemes:
    apiToken:
      type: apiKey
      description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n  `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
      name: Authorization
      in: header
    csrfToken:
      type: apiKey
      description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.


        **Format**:

        ```

        X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx

        ```


        For automation, API Token authentication is preferred.'
      name: X-CSRFToken
      in: header