openapi: 3.2.0 info: title: Mist Sites Setting API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Sites Setting description: 'Site settings refer to the configuration and management of of site within a Mist Organization. These settings include access point settings, firmware upgrade schedules, and various features such as location services, occupancy analytics, and engagement analytics.' paths: /api/v1/sites/{site_id}/setting: parameters: [] get: tags: - Sites Setting summary: getSiteSetting description: Get the Site Settings operationId: getSiteSetting parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/site_setting' - description: Configuration settings applied at the site level contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/site_setting' - description: Configuration settings applied at the site level contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false put: tags: - Sites Setting summary: updateSiteSettings description: Update Site Settings operationId: updateSiteSettings parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/site_setting' - description: Request Body contentMediaType: application/json required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/site_setting' - description: Configuration settings applied at the site level contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/site_setting' - description: Configuration settings applied at the site level contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/setting/blacklist: parameters: [] delete: tags: - Sites Setting summary: deleteSiteWirelessClientsBlocklist description: Delete Site Blacklist Station Clients operationId: deleteSiteWirelessClientsBlocklist parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Sites Setting summary: createSiteWirelessClientsBlocklist description: 'This endpoint is to provide list of client macs for annotation blacklist. Retrieve the current clients list `blacklist_url` under Site:Setting' operationId: createSiteWirelessClientsBlocklist parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request Body examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request containing one or more MAC addresses examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request containing one or more MAC addresses examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/vnd.api+json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/setting/derived: parameters: [] get: tags: - Sites Setting summary: getSiteSettingDerived description: Get the Derived Site Settings, generated by merging the Org level templates (network templates, gateway templates) and the Site level configuration. If the same parameter is defined in both scopes, the Site level one is used. In addition, the Zoom and Teams accounts are also merged into the derived settings. operationId: getSiteSettingDerived parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/site_setting_derived' - description: Site settings with derived OAuth account integration data contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/site_setting_derived' - description: Site settings with derived OAuth account integration data contentMediaType: application/vnd.api+json '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/setting/watched_station: parameters: [] delete: tags: - Sites Setting summary: deleteSiteWatchedStations description: Delete Site Watched Station Clients operationId: deleteSiteWatchedStations parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Sites Setting summary: createSiteWatchedStations description: 'This endpoint is to provide list of client macs for annotation as watched station. Retrieve the current clients list from `watched_station_url` under Site:Setting' operationId: createSiteWatchedStations parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request Body examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request containing one or more MAC addresses examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request containing one or more MAC addresses examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/vnd.api+json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/setting/whitelist: parameters: [] delete: tags: - Sites Setting summary: deleteSiteWirelessClientsAllowlist description: Delete Site Whitelist Station Clients operationId: deleteSiteWirelessClientsAllowlist parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Sites Setting summary: createSiteWirelessClientsAllowlist description: 'This endpoint is to provide list of client macs for annotation as whitelist. Retrieve the current clients list from `whitelist_url` under Site:Setting' operationId: createSiteWirelessClientsAllowlist parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request Body contentMediaType: application/json required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request containing one or more MAC addresses examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/mac_addresses' - description: Request containing one or more MAC addresses examples: - macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d contentMediaType: application/vnd.api+json examples: Example: value: macs: - 18-65-90-de-f4-c6 - 84-89-ad-5d-69-0d '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: tunnel_config_ike_dh_group2: title: tunnel_config_ike_dh_group2 enum: - '1' - '14' - '15' - '16' - '19' - '2' - '20' - '21' - '24' - '5' type: string description: 'Diffie-Hellman group used by this IKE proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' radio_band_antenna_mode1: title: radio_band_antenna_mode1 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Radio chain mode for the 5 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default extra_route: title: extra_route type: object properties: discard: type: boolean description: Whether to install a discard route; this takes precedence over next-hop settings default: false metric: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route metric for the IPv4 static route contentEncoding: int32 next_qualified: type: object additionalProperties: $ref: '#/components/schemas/extra_route_next_qualified_properties' description: Qualified next-hop settings keyed by IPv4 next-hop address examples: - 10.3.1.1: metric: null preference: 40 no_resolve: type: boolean description: Whether to prevent recursive next-hop resolution for the IPv4 static route default: false preference: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route preference for the IPv4 static route contentEncoding: int32 examples: - 30 via: oneOf: - type: string - type: array items: type: string description: Next-hop IPv4 address or ECMP next-hop IPv4 addresses for the route examples: - 10.2.1.1 - "[\n \"10.2.1.1\",\n \"10.2.1.2\"\n]" description: IPv4 static route settings for a destination prefix gateway_port_duplex2: title: gateway_port_duplex2 enum: - auto - full - half type: string description: 'Ethernet duplex mode configured on the port. enum: `auto`, `full`, `half`.' examples: - full response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response gateway_port_dsl_type2: title: gateway_port_dsl_type2 enum: - adsl - vdsl type: string description: 'If `wan_type`==`dsl`. DSL technology used by the WAN port. enum: `adsl`, `vdsl`.' service_policy_skyatp_dns_tunnel_detection2: title: service_policy_skyatp_dns_tunnel_detection2 type: object properties: enabled: type: boolean description: Whether Sky ATP DNS tunneling detection is enabled profile: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_tunnel_detection_profile2' - description: 'Sky ATP DNS tunneling detection profile to apply. enum: `default`, `standard`, `strict`.' description: Detection settings for DNS tunneling threats provided by Sky ATP gateway_path_strategy2: title: gateway_path_strategy2 enum: - ecmp - ordered - weighted type: string description: 'Selection strategy used to evaluate the candidate paths. enum: `ecmp`, `ordered`, `weighted`.' switch_port_usage_dynamic_rule: title: switch_port_usage_dynamic_rule required: - src type: object properties: description: type: string description: Optional description of the rule equals: type: string description: Exact value that the selected source attribute must match equals_any: type: array items: type: string description: List of values where any match satisfies this dynamic rule expression: type: string description: '"[0:3]":"abcdef" -> "abc" "split(.)[1]": "a.b.c" -> "b" "split(-)[1][0:3]: "a1234-b5678-c90" -> "b56"' src: allOf: - $ref: '#/components/schemas/switch_port_usage_dynamic_rule_src2' - description: 'Source attribute evaluated by this dynamic rule. enum: `link_peermac`, `lldp_chassis_id`, `lldp_hardware_revision`, `lldp_manufacturer_name`, `lldp_oui`, `lldp_serial_number`, `lldp_system_description`, `lldp_system_name`, `radius_dynamicfilter`, `radius_usermac`, `radius_username`.' usage: type: string description: Port usage name to apply when this dynamic rule matches description: Dynamic port usage rule evaluated against LLDP, RADIUS, or peer MAC attributes ip_type4: title: ip_type4 enum: - dhcp - static type: string description: 'IPv4 address assignment mode for this gateway network interface. enum: `dhcp`, `static`.' examples: - static gateway_port_config: title: gateway_port_config required: - usage type: object properties: ae_disable_lacp: type: boolean description: If `aggregated`==`true`. To disable LCP support for the AE interface default: false ae_idx: type: - string - 'null' description: If `aggregated`==`true`. Users could force to use the designated AE name (must be an integer between 0 and 127) ae_lacp_force_up: type: boolean description: 'For SRX only, if `aggregated`==`true`.Sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only' default: false aggregated: type: boolean description: Whether the port participates in an aggregated Ethernet interface default: false critical: type: boolean description: To generate port up/down alarm, set it to true default: false description: type: string description: Interface Description. Can be a variable (i.e. "{{myvar}}") disable_autoneg: type: boolean description: Whether Ethernet autonegotiation is disabled on the port default: false disabled: type: boolean description: Port admin up (true) / down (false) default: false dsl_type: allOf: - $ref: '#/components/schemas/gateway_port_dsl_type2' - description: 'If `wan_type`==`dsl`. DSL technology used by the WAN port. enum: `adsl`, `vdsl`.' dsl_vci: type: integer description: If `wan_type`==`dsl`, 16 bit int contentEncoding: int32 default: 35 dsl_vpi: type: integer description: If `wan_type`==`dsl`, 8 bit int contentEncoding: int32 default: 0 duplex: allOf: - $ref: '#/components/schemas/gateway_port_duplex2' - description: 'Ethernet duplex mode configured on the port. enum: `auto`, `full`, `half`.' examples: - full ip_config: allOf: - $ref: '#/components/schemas/gateway_port_config_ip_config2' - description: Layer 3 IP configuration for the port lte_apn: type: string description: If `wan_type`==`lte`. APN used by the LTE uplink lte_auth: allOf: - $ref: '#/components/schemas/gateway_port_lte_auth2' - description: 'If `wan_type`==`lte`. Authentication method used by the LTE uplink. enum: `chap`, `none`, `pap`.' lte_backup: type: boolean description: Whether the LTE uplink is used as a backup WAN connection lte_password: type: string description: If `wan_type`==`lte`. Password used for LTE uplink authentication contentEncoding: password lte_username: type: string description: If `wan_type`==`lte`. Username used for LTE uplink authentication mtu: type: integer description: Layer 3 MTU configured on the port contentEncoding: int32 name: type: string description: Interface name used to derive device configuration networks: type: array items: type: string description: If `usage`==`lan`. Networks attached to the interface outer_vlan_id: type: integer description: For Q-in-Q. Outer VLAN ID used for QinQ encapsulation contentEncoding: int32 poe_disabled: type: boolean description: Whether PoE output is disabled on the port default: false poe_keep_state_when_reboot: type: boolean description: Whether Perpetual PoE capabilities are enabled for a port default: false port_network: type: string description: Only for SRX and if `usage`==`lan`, the name of the Network to be used as the Untagged VLAN preserve_dscp: type: boolean description: Whether to preserve dscp when sending traffic over VPN (SSR-only) default: true redundant: type: boolean description: If HA mode. Whether the port participates in the redundant Ethernet configuration redundant_group: maximum: 128 minimum: 1 type: integer description: If HA mode, SRX Only - support redundancy-group. 1-128 for physical SRX, 1-64 for virtual SRX contentEncoding: int32 reth_idx: anyOf: - type: integer contentEncoding: int32 - type: string description: If HA mode and for SRX only. Redundant Ethernet interface index assigned to the port reth_node: type: string description: If HA mode. Node associated with the redundant Ethernet interface reth_nodes: type: array items: type: string description: If HA mode and for SSR only. Per-network node assignment used for VLAN-based redundancy examples: - - node0 - node1 speed: type: string description: Link speed configured on the port default: auto examples: - 1g ssr_no_virtual_mac: type: boolean description: When SSR is running as VM, this is required on certain hosting platforms default: false svr_port_range: type: string description: For SSR only. Port range configured on the interface default: none examples: - 60000-60005 traffic_shaping: allOf: - $ref: '#/components/schemas/gateway_traffic_shaping3' - description: Traffic shaping settings applied to the port usage: allOf: - $ref: '#/components/schemas/gateway_port_usage2' - description: 'Logical usage assigned to the port. enum: `ha_control`, `ha_data`, `lan`, `wan`.' vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID or variable used when the WAN interface is carried on a VLAN vpn_paths: type: object additionalProperties: $ref: '#/components/schemas/gateway_port_vpn_path' description: Per-VPN path settings for traffic that uses this port wan_arp_policer: allOf: - $ref: '#/components/schemas/gateway_port_wan_arp_policer2' - description: 'Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port. enum: `default`, `max`, `recommended`.' wan_ext_ip: type: string description: Only if `usage`==`wan`, optional. If spoke should reach this port by a different IP examples: - 64.2.4.3 wan_ext_ip6: type: string description: Only if `usage`==`wan`, optional. If spoke should reach this port by a different IPv6 examples: - 2601:1700:43c0:dc0::10 wan_extra_routes: type: object additionalProperties: $ref: '#/components/schemas/wan_extra_routes' description: Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "100.100.100.0/24") wan_extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/wan_extra_routes6' description: Only if `usage`==`wan`. Property Key is the destination CIDR (e.g. "2a02:1234:420a:10c9::/64") wan_networks: type: array items: type: string description: Only if `usage`==`wan`. Networks reachable through this WAN port for policy definition wan_probe_override: allOf: - $ref: '#/components/schemas/gateway_wan_probe_override2' - description: Optional WAN health probe override settings for this port wan_source_nat: allOf: - $ref: '#/components/schemas/gateway_port_wan_source_nat2' - description: Source NAT settings applied to traffic leaving this WAN port wan_speedtest_mode: allOf: - $ref: '#/components/schemas/gateway_port_config_wan_speedtest_mode2' - description: 'Controls whether Marvis or the scheduler can run speed tests on this WAN port. enum: `auto`, `enabled`, `disabled`.' examples: - auto wan_type: allOf: - $ref: '#/components/schemas/gateway_port_wan_type2' - description: 'Only if `usage`==`wan`. WAN uplink type configured on the port. enum: `broadband`, `dsl`, `lte`.' description: Gateway port configuration for LAN, WAN, tunnel, and HA interfaces service_policy_ewf_rule: title: service_policy_ewf_rule type: object properties: alert_only: type: boolean description: Whether matching enhanced web filtering traffic is logged without being blocked block_message: type: string description: Message returned when enhanced web filtering blocks a request examples: - Access to this URL Category has been blocked enabled: type: boolean description: Whether this enhanced web filtering rule is enabled default: false profile: allOf: - $ref: '#/components/schemas/service_policy_ewf_rule_profile2' - description: 'Enhanced web filtering profile applied by this rule. enum: `critical`, `standard`, `strict`.' description: Enhanced web filtering rule applied by a service policy auto_preemption1: title: auto_preemption1 type: object properties: day_of_week: allOf: - $ref: '#/components/schemas/day_of_week7' - description: 'Scheduled weekday for auto preemption. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' enabled: type: boolean description: Whether auto preemption is enabled default: false time_of_day: type: string description: Scheduled time of day for auto preemption default: any examples: - 720 description: Preemption behavior for restoring preferred tunnel peers after failover switch_port_usage_storm_control2: title: switch_port_usage_storm_control2 type: object properties: disable_port: type: boolean description: Whether to disable the port when storm control is triggered default: false no_broadcast: type: boolean description: Whether to disable storm control on broadcast traffic default: false no_multicast: type: boolean description: Whether to disable storm control on multicast traffic default: false no_registered_multicast: type: boolean description: Whether to disable storm control on registered multicast traffic default: false no_unknown_unicast: type: boolean description: Whether to disable storm control on unknown unicast traffic default: false percentage: maximum: 100 minimum: 0 type: integer description: Bandwidth-percentage, configures the storm control level as a percentage of the available bandwidth contentEncoding: int32 default: 80 description: Only if `mode`!=`dynamic`. Storm-control settings for this port usage switch_network_multicast2: title: switch_network_multicast2 type: object properties: enabled: type: boolean description: Whether to enable IGMP snooping on this VLAN default: false igmp_version: allOf: - $ref: '#/components/schemas/switch_network_multicast_igmp_version' - description: IGMP version. '2' (default, ASM/IGMPv2) / '3' (SSM/IGMPv3) description: Multicast (IGMP snooping) settings for this VLAN vrf_config6: title: vrf_config6 type: object properties: enabled: type: boolean description: Whether to enable VRF (when supported on the device) description: Routing instance configuration for the site snmp_vacm_security_to_group_content_item: title: snmp_vacm_security_to_group_content_item type: object properties: group: type: string description: VACM group name referenced by this mapping security_name: type: string description: Name of the SNMP security principal mapped to a VACM group description: VACM security-name to group mapping entry iotproxy_visionline2: title: iotproxy_visionline2 type: object properties: access_id: type: string description: Access ID for the Visionline service examples: - 790e6c1790e6c18541d cacerts: type: array items: type: string description: PEM-encoded CA certificates used to verify the Visionline collector's TLS certificate. Required when the collector uses a self-signed certificate enabled: type: boolean description: Whether the Visionline integration is enabled default: false host: type: string description: Collector hostname or IP address for Visionline examples: - visionline_collector1.local password: type: string description: Visionline service password used by the IoT proxy contentEncoding: password port: type: integer description: TCP port of the Visionline collector contentEncoding: int32 default: 443 username: type: string description: Visionline service username used by the IoT proxy examples: - card_administrator description: Site access-control integration settings for Visionline network_vpn_access_static_nat_property: title: network_vpn_access_static_nat_property type: object properties: internal_ip: type: string description: The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.3 name: type: string description: Label for this VPN static NAT rule examples: - pos_station-1 description: VPN access static NAT rule target settings ip_type62: title: ip_type62 enum: - autoconf - dhcp - disabled - static type: string description: 'IPv6 address assignment mode for this gateway network interface. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static sw_routing_policy: title: sw_routing_policy type: object properties: terms: minItems: 1 uniqueItems: true type: array items: $ref: '#/components/schemas/sw_routing_policy_term' description: Ordered terms evaluated by this switch routing policy description: Switch routing policy made of ordered match-action terms service_policy_skyatp_dns_dga_detection_profile2: title: service_policy_skyatp_dns_dga_detection_profile2 enum: - default - standard - strict type: string description: 'Sky ATP DNS DGA detection profile to apply. enum: `default`, `standard`, `strict`.' antenna_select1: title: antenna_select1 enum: - external - internal type: string description: 'Internal or external antenna selection for AP models with selectable antennas. enum: ``, `external`, `internal`.' examples: - external acl_tag_spec: title: acl_tag_spec type: object properties: port_range: type: string description: Matched dst port, "0" means any default: '0' protocol: type: string description: '`tcp` / `udp` / `icmp` / `icmp6` / `gre` / `any` / `:protocol_number`, `protocol_number` is between 1-254, default is `any` `protocol_number` is between 1-254' default: any description: Layer 4 protocol and destination-port match constraint for an ACL tag vrf_config4: title: vrf_config4 type: object properties: enabled: type: boolean description: Whether to enable VRF (when supported on the device) description: VRF defaults applied by this gateway template bgp_config_via2: title: bgp_config_via2 enum: - lan - tunnel - vpn - wan type: string description: Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN evpn_options_vs_instance: title: evpn_options_vs_instance type: object properties: networks: uniqueItems: true type: array items: type: string description: List of network names included in this virtual-switch instance description: EVPN virtual-switch instance network mapping switch_matching_rule_oob_ip_config2: title: switch_matching_rule_oob_ip_config2 type: object properties: type: allOf: - $ref: '#/components/schemas/ip_type12' - description: 'IP assignment mode for out-of-band switch management. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false description: Out-of-band management IP configuration applied when this matching rule matches site_setting_ap_matching_rule: title: site_setting_ap_matching_rule type: object properties: match_model: type: string description: AP model matched by this rule examples: - AP12 name: type: string description: Display name of the AP matching rule examples: - AP12 port_config: type: object additionalProperties: $ref: '#/components/schemas/ap_port_config' description: Property key is the interface(s) (e.g. "eth1,eth2") description: AP matching rule for selecting APs and applying port configuration site_zone_occupancy_alert2: title: site_zone_occupancy_alert2 type: object properties: email_notifiers: type: array items: type: string description: Notification email recipients for zone occupancy alerts examples: - - foo@juniper.net - bar@juniper.net enabled: type: boolean description: Indicate whether zone occupancy alert is enabled for the site default: false threshold: maximum: 30 minimum: 0 type: integer description: Sending zone-occupancy-alert webhook message only if a zone stays non-compliant (i.e. actual occupancy > occupancy_limit) for a minimum duration specified in the threshold, in minutes contentEncoding: int32 default: 5 examples: - 5 description: Occupancy alert settings for site zones vars_annotation: title: vars_annotation type: object properties: note: type: string description: User-provided note to describe what this var was created for type: type: string description: 'Used to identify where to enumerate / auto-complete the field from. Default is `generic` (plain string, no special handling). enum: `generic`, `mxtunnel_id`' default: generic description: Annotation for a single var, helping identify its purpose and enabling auto-complete/enumeration in UI extra_route_next_qualified_properties: title: extra_route_next_qualified_properties type: object properties: metric: type: - integer - 'null' description: Route metric for this qualified IPv4 next hop contentEncoding: int32 preference: type: - integer - 'null' description: Route preference for this qualified IPv4 next hop contentEncoding: int32 description: Qualified next-hop attributes for an IPv4 static route network_vpn_access_config: title: network_vpn_access_config type: object properties: advertised_subnet: type: string description: If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side examples: - 172.16.0.0/24 allow_ping: type: boolean description: Whether to allow ping from vpn into this routed network destination_nat: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_destination_nat_property' description: Destination NAT rules applied for VPN access to this network nat_pool: type: string description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub examples: - 172.16.0.0/26 no_readvertise_to_lan_bgp: type: boolean description: toward LAN-side BGP peers default: false no_readvertise_to_lan_ospf: type: boolean description: toward LAN-side OSPF peers default: false no_readvertise_to_overlay: type: boolean description: toward overlay, how HUB should deal with routes it received from Spokes other_vrfs: type: array items: type: string description: Other VRFs that can receive leaked routes from this spoke network routed: type: boolean description: Whether this network is routable source_nat: allOf: - $ref: '#/components/schemas/network_source_nat2' - description: Source NAT settings used when non-routed spoke hosts must be reachable from the hub static_nat: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_static_nat_property' description: Static NAT rules applied for VPN access to this network summarized_subnet: type: string description: toward overlay, how HUB should deal with routes it received from Spokes examples: - 172.16.0.0/16 summarized_subnet_to_lan_bgp: type: string description: toward LAN-side BGP peers examples: - 172.16.0.0/16 summarized_subnet_to_lan_ospf: type: string description: toward LAN-side OSPF peers examples: - 172.16.0.0/16 description: VPN access settings for a network and VPN pair switch_port_usage_mode2: title: switch_port_usage_mode2 enum: - access - dynamic - inet - trunk type: string description: 'Switching mode for this port usage. enum: `access`, `dynamic`, `inet`, `trunk`.' switch_matching_rule_ip_config2: title: switch_matching_rule_ip_config2 type: object properties: network: type: string description: VLAN Name for the management interface type: allOf: - $ref: '#/components/schemas/ip_type11' - description: 'IP assignment mode for in-band switch management. enum: `dhcp`, `static`.' examples: - static description: In-band management IP configuration applied when this matching rule matches evpn_options3: title: evpn_options3 type: object properties: auto_loopback_subnet: type: string description: Optional, for dhcp_relay, unique loopback IPs are required for ERB or IPClos where we can set option-82 server_id-overrides default: 172.16.192.0/24 auto_loopback_subnet6: type: string description: Optional, for dhcp_relay, unique loopback IPs are required for ERB or IPClos where we can set option-82 server_id-overrides default: fd33:ab00:2::/64 auto_router_id_subnet: type: string description: Optional, this generates router_id automatically, if specified, `router_id_prefix` is ignored default: 172.16.254.0/23 auto_router_id_subnet6: type: string description: Optional, this generates router_id automatically, if specified, `router_id_prefix` is ignored examples: - fd31:5700:1::/64 core_as_border: type: boolean description: Optional, for ERB or CLOS, you can either use esilag to upstream routers or to also be the virtual-gateway. When `routed_at` != `core`, whether to do virtual-gateway at core as well default: false enable_inband_mgmt: type: boolean description: Whether to route management traffic inband; routes will be propagated to downstream switches default: false enable_inband_ztp: type: boolean description: if the mangement traffic goes inbnd, during installation, only the border/core switches are connected to the Internet to allow initial configuration to be pushed down and leave the downstream access switches stay in the Factory Default state enabling inband-ztp allows upstream switches to use LLDP to assign IP and gives Internet to downstream switches in that state default: false overlay: allOf: - $ref: '#/components/schemas/evpn_options_overlay2' - description: EVPN overlay BGP settings for the topology per_vlan_vga_v4_mac: type: boolean description: Only for by Core-Distribution architecture when `evpn_options.routed_at`==`core`. By default, JUNOS uses 00-00-5e-00-01-01 as the virtual-gateway-address's v4_mac. If enabled, 00-00-5e-00-0X-YY will be used (where XX=vlan_id/256, YY=vlan_id%256) default: false per_vlan_vga_v6_mac: type: boolean description: Only for by Core-Distribution architecture when `evpn_options.routed_at`==`core`. By default, JUNOS uses 00-00-5e-00-02-01 as the virtual-gateway-address's v6_mac. If enabled, 00-00-5e-00-1X-YY will be used (where XX=vlan_id/256, YY=vlan_id%256) default: false routed_at: allOf: - $ref: '#/components/schemas/evpn_options_routed_at2' - description: 'Topology tier where EVPN virtual gateway routing is placed. enum: `core`, `distribution`, `edge`.' underlay: allOf: - $ref: '#/components/schemas/evpn_options_underlay2' - description: EVPN underlay BGP and subnet settings for the topology vs_instances: type: object additionalProperties: $ref: '#/components/schemas/evpn_options_vs_instance' description: Virtual-switch instance mappings used to segregate EVPN networks examples: - guest: networks: - guest iot: networks: - iot-wifi - iot-lan description: Fabric EVPN options for the site tunnel_config_provider2: title: tunnel_config_provider2 enum: - custom-ipsec - custom-gre - jse-ipsec - prisma-ipsec - zscaler-gre - zscaler-ipsec type: string description: 'Tunnel provider used when auto provisioning is disabled. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`.' acl_tag: title: acl_tag required: - type type: object properties: ether_types: type: array items: type: string description: Layer 2 EtherTypes matched by this ACL tag; defaults to `any` default: - any gbp_tag: type: integer description: "Required if\n - `type`==`dynamic_gbp` (gbp_tag received from RADIUS)\n - `type`==`gbp_resource`\n - `type`==`static_gbp` (applying gbp tag against matching conditions)" contentEncoding: int32 macs: type: array items: type: string description: Client or resource MAC addresses matched by this ACL tag network: type: string description: "If:\n * `type`==`mac` (optional. default is `any`)\n * `type`==`subnet` (optional. default is `any`)\n * `type`==`network`\n * `type`==`resource` (optional. default is `any`)\n * `type`==`static_gbp` if from matching network (vlan)" port_usage: type: string description: Required if `type`==`port_usage`. Switch port usage name matched by this ACL tag radius_group: type: string description: "Required if:\n * `type`==`radius_group`\n * `type`==`aruba_user_role`\n * `type`==`static_gbp`\nif from matching radius_group" specs: type: array items: $ref: '#/components/schemas/acl_tag_spec' description: Layer 4 protocol and destination-port constraints for this ACL tag subnets: type: array items: type: string description: IP subnets matched by this ACL tag type: allOf: - $ref: '#/components/schemas/acl_tag_type2' - description: 'Classifier type that determines which ACL tag fields are evaluated. enum: `any`, `aruba_user_role`, `dynamic_gbp`, `gbp_resource`, `mac`, `network`, `port_usage`, `radius_group`, `resource`, `static_gbp`, `subnet`.' description: Resource tags (`type`==`resource` or `type`==`gbp_resource`) can only be used in `dst_tags` tunnel_config_auth_algo3: title: tunnel_config_auth_algo3 enum: - md5 - sha1 - sha2 type: string description: 'Integrity algorithm used by this IKE proposal. enum: `md5`, `sha1`, `sha2`.' remote_syslog_severity1: title: remote_syslog_severity1 enum: - alert - any - critical - emergency - error - info - notice - warning type: string description: 'Default syslog severity for messages sent to this server. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' tunnel_config_probe: title: tunnel_config_probe type: object properties: interval: type: integer description: How often to trigger the probe contentEncoding: int32 threshold: type: integer description: Number of consecutive misses before declaring the tunnel down contentEncoding: int32 timeout: type: integer description: Time within which to complete the connectivity check contentEncoding: int32 type: allOf: - $ref: '#/components/schemas/tunnel_config_probe_type2' - description: 'Protocol used by the custom IPsec tunnel health probe. enum: `http`, `icmp`.' description: Tunnel health probe settings mxtunnel_protocol2: title: mxtunnel_protocol2 enum: - ip - udp type: string description: 'Encapsulation protocol used for the site Mist Tunnel. enum: `ip`, `udp`.' dhcp_snooping3: title: dhcp_snooping3 type: object properties: all_networks: type: boolean description: Whether DHCP snooping applies to all configured networks enable_arp_spoof_check: type: boolean description: Enable for dynamic ARP inspection check enable_ip_source_guard: type: boolean description: Enable for check for forging source IP address enabled: type: boolean description: Whether DHCP snooping is enabled networks: type: array items: type: string description: Network names with DHCP snooping enabled when `all_networks`==`false` description: DHCP snooping defaults provided by this network template mxedge_mgmt4: title: mxedge_mgmt4 type: object properties: config_auto_revert: type: boolean description: Whether the Mist Edge automatically reverts configuration changes if connectivity is lost default: false fips_enabled: type: boolean description: Whether FIPS mode is enabled on the Mist Edge default: false mist_password: type: string description: Password for the Mist service account on the Mist Edge examples: - MIST_PASSWORD oob_ip_type: allOf: - $ref: '#/components/schemas/mxedge_mgmt_oob_ip_type2' - description: 'IPv4 address assignment mode for out-of-band management. enum: `dhcp`, `disabled`, `static`.' oob_ip_type6: allOf: - $ref: '#/components/schemas/mxedge_mgmt_oob_ip_type62' - description: 'IPv6 address assignment mode for out-of-band management. enum: `autoconf`, `dhcp`, `disabled`, `static`.' root_password: type: string description: Root account password for the Mist Edge contentEncoding: password examples: - ROOT_PASSWORD description: Mist Edge management access settings for the site mxcluster_radsec_acct_server: title: mxcluster_radsec_acct_server type: object properties: host: type: string description: IP / hostname of RADIUS server port: type: integer description: Acct port of RADIUS server contentEncoding: int32 default: 1813 secret: type: string description: Shared secret used with this RADIUS accounting server contentEncoding: password ssids: type: array items: type: string description: WLAN SSID filters that use this accounting server when matching is enabled description: RadSec accounting server settings for a Mist Edge cluster evpn_options_routed_at2: title: evpn_options_routed_at2 enum: - core - distribution - edge type: string description: 'Topology tier where EVPN virtual gateway routing is placed. enum: `core`, `distribution`, `edge`.' gw_routing_policy_term_matching_vpn_path_sla2: title: gw_routing_policy_term_matching_vpn_path_sla2 type: object properties: max_jitter: type: - integer - 'null' description: Maximum jitter threshold allowed for the VPN path contentEncoding: int32 max_latency: type: - integer - 'null' description: Maximum latency threshold allowed for the VPN path contentEncoding: int32 examples: - 1500 max_loss: type: - integer - 'null' description: Maximum packet-loss threshold allowed for the VPN path contentEncoding: int32 examples: - 30 description: SLA thresholds used when matching a VPN path junos_port_config_duplex2: title: junos_port_config_duplex2 enum: - auto - full - half type: string description: 'Link duplex mode for this Junos port. enum: `auto`, `full`, `half`.' vrrp_group: title: vrrp_group type: object properties: auth_key: type: string description: If `auth_type`==`md5`, authentication key used by the VRRP group examples: - auth-key-1 auth_password: type: string description: If `auth_type`==`simple`, password used by the VRRP group contentEncoding: password auth_type: allOf: - $ref: '#/components/schemas/vrrp_group_auth_type2' - description: 'Authentication method used by the VRRP group. enum: `md5`, `simple`.' examples: - md5 networks: type: object additionalProperties: $ref: '#/components/schemas/vrrp_group_network' description: VRRP network mappings and their virtual IP addresses examples: - data: ip: 10.182.96.1 mgmt: ip: 10.182.104.1 v10: ip: 10.182.104.129 wap: ip: 10.182.102.1 description: Junos VRRP group authentication and network settings poe_priority3: title: poe_priority3 enum: - low - high type: string description: 'Only if `mode`!=`dynamic`. PoE priority for ports using this port usage. enum: `low`, `high`.' switch_network_multicast_igmp_version: title: switch_network_multicast_igmp_version enum: - '2' - '3' type: string description: IGMP version. '2' (default, ASM/IGMPv2) / '3' (SSM/IGMPv3) site_setting_paloalto_networks2: title: site_setting_paloalto_networks2 type: object properties: gateways: type: array items: $ref: '#/components/schemas/site_setting_paloalto_network_gateway' description: Palo Alto Networks gateways integrated with this site send_mist_nac_user_info: type: boolean description: Whether Mist NAC user information is sent to Palo Alto Networks gateways default: false description: Firewall integration settings for Palo Alto Networks at the site remote_syslog_server_protocol2: title: remote_syslog_server_protocol2 enum: - tcp - udp type: string description: 'Transport protocol used for this remote syslog server. enum: `tcp`, `udp`.' switch_vrf_instance: title: switch_vrf_instance type: object properties: aggregate_routes: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: IPv4 aggregate routes configured for this VRF instance examples: - 172.16.3.0/24: discard: false metric: null preference: 30 aggregate_routes6: type: object additionalProperties: $ref: '#/components/schemas/aggregate_route' description: IPv6 aggregate routes configured for this VRF instance examples: - 2a02:1234:420a:10c9::/64: discard: false metric: null preference: 30 evpn_auto_loopback_subnet: type: string description: IPv4 subnet used for automatic EVPN loopback addresses in this VRF instance examples: - 100.101.0.0/24 evpn_auto_loopback_subnet6: type: string description: IPv6 subnet used for automatic EVPN loopback addresses in this VRF instance extra_routes: type: object additionalProperties: $ref: '#/components/schemas/vrf_extra_route' description: Additional IPv4 static routes configured for this VRF instance examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/vrf_extra_route6' description: Additional IPv6 static routes configured for this VRF instance examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 multicast_config: allOf: - $ref: '#/components/schemas/switch_multicast_config3' - description: Multicast configuration for this VRF instance. PIM is automatically enabled when any network in this VRF has `multicast.enabled`==`true` networks: uniqueItems: true type: array items: type: string description: Names of switch networks included in this VRF instance description: Switch VRF instance routing and network membership settings examples: - extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest site_setting_paloalto_network_gateway: title: site_setting_paloalto_network_gateway type: object properties: api_key: type: string description: Authentication key used to access the Palo Alto Networks gateway API examples: - 5abf7c8a-1a1c-4398-ba2d-b0c297094d1a api_url: type: string description: Base URL for the Palo Alto Networks gateway API examples: - https://23.43.12.78:8443 description: Palo Alto Networks gateway API connection settings gateway_port_usage2: title: gateway_port_usage2 enum: - ha_control - ha_data - lan - wan type: string description: 'Logical usage assigned to the port. enum: `ha_control`, `ha_data`, `lan`, `wan`.' radio_band_antenna_beam_pattern3: title: radio_band_antenna_beam_pattern3 enum: - narrow - medium - wide type: string description: 'Beam pattern used by the 5 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' ospf_area_type2: title: ospf_area_type2 enum: - default - nssa - stub type: string description: 'Area type for this OSPF area. enum: `default`, `nssa`, `stub`.' examples: - default gateway_path_type2: title: gateway_path_type2 enum: - local - tunnel - vpn - wan type: string description: Gateway path source type, such as local network, WAN interface, VPN path, or tunnel site_setting_srx_app: title: site_setting_srx_app type: object properties: enabled: type: boolean description: Whether Juniper SRX application visibility is enabled default: false description: Juniper SRX application visibility settings for the site radio_band_antenna_beam_pattern1: title: radio_band_antenna_beam_pattern1 enum: - narrow - medium - wide type: string description: 'Beam pattern used by the 6 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' radio_band_24_usage4: title: radio_band_24_usage4 enum: - '24' - '5' - '6' - auto type: string description: 'Radio usage mode for the 2.4 GHz-capable radio. enum: `24`, `5`, `6`, `auto`.' switch_radius_config4: title: switch_radius_config4 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: Switch RADIUS configuration for the site site_auto_upgrade_version2: title: site_auto_upgrade_version2 enum: - beta - custom - stable type: string description: 'Firmware release channel or custom version used for AP auto-upgrade. enum: `beta`, `custom`, `stable`.' examples: - beta ap_port_config_forwarding2: title: ap_port_config_forwarding2 enum: - all - limited - mxtunnel - site_mxedge - wxtunnel type: string description: 'Traffic forwarding mode for this AP Ethernet port. enum: `all`, `limited`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all gateway_oob_ip_config_node12: title: gateway_oob_ip_config_node12 type: object properties: gateway: type: string description: Default gateway for the node1 out-of-band management interface when `type`==`static` ip: type: string description: Static IPv4 address for the node1 out-of-band management interface when `type`==`static` netmask: type: string description: IPv4 netmask or prefix length for the node1 out-of-band management interface when `type`==`static`; used only if `subnet` is not specified in `networks` type: allOf: - $ref: '#/components/schemas/ip_type5' - description: 'IP assignment mode for the node1 out-of-band management interface. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: Whether to use `mgmt_junos` for host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID used for node1 out-of-band management traffic description: Out-of-band management IP configuration override for node1 in an HA cluster mist_nacedge1: title: mist_nacedge1 type: object properties: auth_ttl: maximum: 2592000 minimum: 60 type: integer description: Cache of last auth result; in seconds contentEncoding: int32 default: 604800 caching_site_ids: type: array items: type: string contentEncoding: uuid description: List of site UUIDs whose auth requests should be cached by NAC Edges assigned to this site examples: - - 4ac1dcf4-9d8b-7910-ac87-6ad873648a5c - 7dc1acf4-9d8b-7910-ac87-6ad873648a5c default_dot1x_vlan: type: string description: Default vlan for all dot1x devices, if different from default_vlan examples: - '20' default_vlan: type: string description: Default vlan to assign for devices not in the cache examples: - test_vlan enabled: type: boolean description: Whether Mist Site Survivability is enabled for the site mxedge_hosts: type: array items: type: string description: NAC Edge hostnames used for the Site Survivability feature examples: - - mxedge1.local description: NAC Edge service settings for the site Mist Edge cluster mxcluster_radsec_auth_server: title: mxcluster_radsec_auth_server type: object properties: host: type: string description: IP / hostname of RADIUS server inband_status_check: type: boolean description: Whether to enable inband status check default: false inband_status_interval: minimum: 0 type: integer description: Inband status interval, in seconds contentEncoding: int32 default: 300 keywrap_enabled: type: boolean description: If used for Mist APs, enable keywrap algorithm. Default is false keywrap_format: allOf: - oneOf: - {} - $ref: '#/components/schemas/mxcluster_rad_auth_server_keywrap_format2' - description: 'Encoding format for Mist AP RADIUS keywrap keys. enum: `ascii`, `hex`.' keywrap_kek: type: string description: If used for Mist APs, encryption key keywrap_mack: type: string description: If used for Mist APs, Message Authentication Code Key port: type: integer description: Auth port of RADIUS server contentEncoding: int32 default: 1812 retry: type: integer description: Number of authentication request retries before failing over contentEncoding: int32 default: 2 secret: type: string description: Shared secret used with this RADIUS authentication server contentEncoding: password ssids: type: array items: type: string description: WLAN SSID filters that use this authentication server when matching is enabled timeout: type: integer description: Authentication request timeout, in seconds contentEncoding: int32 default: 5 description: RadSec authentication server settings for a Mist Edge cluster network_internet_access2: title: network_internet_access2 type: object properties: create_simple_service_policy: type: boolean description: Whether Mist should create simple service policies for restricted internet access default: false destination_nat: type: object additionalProperties: $ref: '#/components/schemas/network_internet_access_destination_nat_property' description: Destination NAT rules for direct internet access enabled: type: boolean description: Whether direct internet access is enabled for this network restricted: type: boolean description: By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies default: false static_nat: type: object additionalProperties: $ref: '#/components/schemas/network_internet_access_static_nat_property' description: Static NAT rules for direct internet access description: Direct internet access and NAT settings for this network dhcpd_config_option_type2: title: dhcpd_config_option_type2 enum: - boolean - hex - int16 - int32 - ip - string - uint16 - uint32 type: string description: 'Data type used to encode this DHCP option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' remote_syslog_archive1: title: remote_syslog_archive1 type: object properties: files: anyOf: - type: string - type: integer contentEncoding: int32 description: Number of archived syslog files to retain examples: - '20' size: type: string description: Maximum size of each archived syslog file, such as 5m examples: - 5m description: Retention settings for this generated syslog file idp_profile_matching2: title: idp_profile_matching2 type: object properties: attack_name: type: array items: type: string description: Signature names matched by the IDP profile overwrite dst_subnet: type: array items: type: string description: Destination subnets matched by the IDP profile overwrite severity: type: array items: $ref: '#/components/schemas/idp_profile_matching_severity_value' description: Threat levels matched by the IDP profile overwrite description: Criteria that select signatures for this overwrite rule dot11_bandwidth242: title: dot11_bandwidth242 enum: - 0 - 20 - 40 type: integer description: 'Channel width configured for the 2.4 GHz radio. enum: `0`, `20`, `40`.' examples: - 20 ap_port_config_dynamic_vlan2: title: ap_port_config_dynamic_vlan2 type: object properties: default_vlan_id: maximum: 4094 minimum: 1 type: integer description: Fallback VLAN ID used when RADIUS does not return a dynamic VLAN match contentEncoding: int32 examples: - 999 enabled: type: boolean description: Whether dynamic VLAN assignment is enabled for this AP port type: allOf: - $ref: '#/components/schemas/ap_port_config_dynamic_vlan_type2' - description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS. enum: `airespace-interface-name`, `standard`.' vlans: type: object additionalProperties: type: string nullable: true description: Mapping entries for RADIUS-assigned VLAN values on this AP port. For `type`==`airespace-interface-name`, the property key is the Airespace interface name returned by RADIUS (e.g. "guest"), and the value is the corresponding VLAN ID (e.g. 100). For `type`==`standard`, the property key is the VLAN ID number returned by RADIUS, and the value is ignored. examples: - 1-10: null user: 10 description: RADIUS-assigned VLAN settings for AP port authentication gateway_port_lte_auth2: title: gateway_port_lte_auth2 enum: - chap - none - pap type: string description: 'If `wan_type`==`lte`. Authentication method used by the LTE uplink. enum: `chap`, `none`, `pap`.' remote_syslog_time_format2: title: remote_syslog_time_format2 enum: - millisecond - year - year millisecond type: string description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond gateway_template1: title: gateway_template1 required: - name type: object properties: additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands provided by this gateway template bgp_config: type: object additionalProperties: $ref: '#/components/schemas/bgp_config' description: BGP routing defaults for this gateway template. Property key is the BGP session name created_time: type: number description: Timestamp when the gateway template was created readOnly: true dhcpd_config: allOf: - $ref: '#/components/schemas/dhcpd_config3' - description: DHCP server defaults provided by this gateway template dnsOverride: type: boolean description: Whether DNS server and suffix settings in this template override inherited values default: false dns_servers: type: array items: type: string description: DNS servers provided by this gateway template dns_suffix: type: array items: type: string description: DNS search suffixes provided by this gateway template extra_routes: type: object additionalProperties: $ref: '#/components/schemas/gateway_extra_route' description: Additional IPv4 route defaults in this gateway template extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/gateway_extra_route6' description: Additional IPv6 route defaults in this gateway template examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 gateway_matching: allOf: - $ref: '#/components/schemas/gateway_matching2' - description: Matching rules that select gateways for this template gateway_mgmt: allOf: - $ref: '#/components/schemas/gateway_mgmt2' - description: Management-plane defaults provided by this gateway template id: type: string description: Unique identifier of the gateway template contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f idp_profiles: type: object additionalProperties: $ref: '#/components/schemas/idp_profile' description: Intrusion detection and prevention profile defaults in this gateway template ip_configs: type: object additionalProperties: $ref: '#/components/schemas/gateway_ip_config_property' description: Gateway interface IP configuration defaults by network name modified_time: type: number description: Timestamp when the gateway template was last modified readOnly: true name: type: string description: Display name of the gateway template examples: - gw_template networks: type: array items: $ref: '#/components/schemas/network' description: Layer 3 networks configured by this gateway template ntpOverride: type: boolean description: Whether NTP servers in this template override inherited values default: false ntp_servers: type: array items: type: string description: NTP servers provided by this gateway template oob_ip_config: allOf: - $ref: '#/components/schemas/gateway_oob_ip_config3' - description: Out-of-band management IP defaults in this gateway template org_id: type: string description: Organization that owns this gateway template contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 path_preferences: type: object additionalProperties: $ref: '#/components/schemas/gateway_path_preferences' description: Property key is the path name port_config: type: object additionalProperties: $ref: '#/components/schemas/gateway_port_config' description: Property key is the Port Name (i.e. "ge-0/0/0"), the Ports Range (i.e. "ge-0/0/0-10"), the List of Ports (i.e. "ge-0/0/0,ge-1/0/0", only allowed for Aggregated or Redundant interfaces) or a Variable (i.e. "{{myvar}}"). router_id: type: string description: Auto assigned if not set examples: - 10.2.1.10 routing_policies: type: object additionalProperties: $ref: '#/components/schemas/gw_routing_policy' description: Routing policy defaults applied by this gateway template service_policies: type: array items: $ref: '#/components/schemas/service_policy' description: Traffic service policy defaults enforced by this gateway template tunnel_configs: type: object additionalProperties: $ref: '#/components/schemas/tunnel_config' description: Property key is the tunnel name tunnel_provider_options: allOf: - $ref: '#/components/schemas/tunnel_provider_options2' - description: Provider-specific tunnel options defined by this gateway template type: allOf: - $ref: '#/components/schemas/gateway_template_type2' - description: 'Gateway template deployment type. enum: `spoke`, `standalone`.' examples: - standalone url_filtering_deny_msg: type: string description: When a service policy denies a app_category, what message to show in user's browser default: Access to this URL Category has been blocked examples: - Access to this URL Category has been blocked vrf_config: allOf: - $ref: '#/components/schemas/vrf_config4' - description: VRF defaults applied by this gateway template vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/gateway_vrf_instance' description: VRF instances configured by this gateway template examples: - CORP_VRF: networks: - CORP_NET - MGMT_NET description: Template settings applied to site gateways tunnel_config_probe_type2: title: tunnel_config_probe_type2 enum: - http - icmp type: string description: 'Protocol used by the custom IPsec tunnel health probe. enum: `http`, `icmp`.' radius_config2: title: radius_config2 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this Junos configuration auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this Junos configuration auth_servers_retries: type: integer description: Number of RADIUS authentication request retries before failover contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS authentication server timeout, in seconds contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: maximum: 65535 minimum: 1 type: integer description: UDP port used for RADIUS Change of Authorization (CoA) contentEncoding: int32 default: 3799 network: type: string description: Use `network` or `source_ip`. Network where the RADIUS server resides; if the network has a static IP, Mist uses it as the source IP source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS authentication and accounting settings for this AP port tunnel_provider_options_zscaler_sub_location: title: tunnel_provider_options_zscaler_sub_location type: object properties: aup_block_internet_until_accepted: type: boolean description: Whether this sub-location blocks internet access until the Acceptable Use Policy is accepted default: false aup_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display Acceptable Use Policy (AUP) default: false aup_force_ssl_inspection: type: boolean description: Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser default: false aup_timeout_in_days: maximum: 180 minimum: 1 type: integer description: Required if `aup_enabled`==`true`. Days before AUP is requested again contentEncoding: int32 auth_required: type: boolean description: Enable this option to authenticate users default: false caution_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display caution notification for non-authenticated users default: false dn_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 idle_time_in_minutes: maximum: 43200 minimum: 0 type: integer description: Required if `surrogate_IP`==`true`, idle Time to Disassociation contentEncoding: int32 name: type: string description: '[network]($h/Orgs%20Networks/_overview) name' ofw_enabled: type: boolean description: If `true`, enable the firewall control option default: false surrogate_IP: type: boolean description: Can only be `true` when `auth_required`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies default: false surrogate_IP_enforced_for_known_browsers: type: boolean description: Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers surrogate_refresh_time_in_minutes: maximum: 43200 minimum: 1 type: integer description: Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idle_time_in_minutes`, refresh Time for re-validation of Surrogacy contentEncoding: int32 up_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 description: Zscaler sub-location settings for a specific network dhcpd_config_option: title: dhcpd_config_option type: object properties: type: allOf: - $ref: '#/components/schemas/dhcpd_config_option_type2' - description: 'Data type used to encode this DHCP option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' value: type: string description: Option value to send for this DHCP option description: Custom DHCP option value snmp_config_trap_group: title: snmp_config_trap_group type: object properties: categories: type: array items: type: string description: Trap categories included in this SNMP trap group group_name: type: string description: Trap group name for this SNMP trap group examples: - profiler targets: type: array items: type: string description: Trap target addresses for this SNMP trap group version: allOf: - $ref: '#/components/schemas/snmp_config_trap_version2' - description: 'SNMP trap protocol version used by this group. enum: `all`, `v1`, `v2`.' description: SNMP trap group definition switch_bgp_config_neighbor: title: switch_bgp_config_neighbor required: - neighbor_as type: object properties: export_policy: type: string description: Export policy must match one of the policy names defined in the `routing_policies` property. hold_time: oneOf: - $ref: '#/components/schemas/switch_bgp_config_hold_time_zero' - maximum: 65535 minimum: 3 type: integer contentEncoding: int32 description: 'BGP hold time for this neighbor. enum: `0`.' import_policy: type: string description: Import policy must match one of the policy names defined in the `routing_policies` property. multihop_ttl: maximum: 255 minimum: 1 type: integer description: Time-to-live value for multihop BGP sessions to this neighbor contentEncoding: int32 neighbor_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Autonomous System (AS) number of the BGP neighbor. For internal BGP, this must match `local_as`. For external BGP, this must differ from `local_as`. examples: - '65000' description: Per-neighbor switch BGP session settings acl_policy_action: title: acl_policy_action required: - dst_tag type: object properties: action: allOf: - $ref: '#/components/schemas/allow_deny4' - description: Allow or deny decision applied to traffic matching the destination tag dst_tag: type: string description: Destination ACL tag matched by this policy action examples: - corp description: Action applied to traffic that matches a destination ACL tag radio_band_preamble4: title: radio_band_preamble4 enum: - auto - long - short type: string description: '802.11 preamble mode used by the 2.4 GHz radio. enum: `auto`, `long`, `short`.' tunnel_config_tunnel_mode2: title: tunnel_config_tunnel_mode2 enum: - active-active - active-standby type: string description: 'Tunnel failover mode used for primary and secondary endpoints. enum: `active-active`, `active-standby`.' marvis_auto_operations2: title: marvis_auto_operations2 type: object properties: ap_insufficient_capacity: type: boolean description: Whether Marvis may remediate AP insufficient-capacity issues automatically default: false ap_loop: type: boolean description: Whether Marvis may remediate AP loop issues automatically default: false ap_non_compliant: type: boolean description: Whether Marvis may remediate AP non-compliance automatically default: false bounce_port_for_abnormal_poe_client: type: boolean description: Whether Marvis may bounce switch ports for abnormal PoE clients default: false disable_port_when_ddos_protocol_violation: type: boolean description: Whether Marvis may disable a port when DDOS protocol violations are detected default: false disable_port_when_rogue_dhcp_server_detected: type: boolean description: Whether Marvis may disable a port when a rogue DHCP server is detected default: false gateway_non_compliant: type: boolean description: Whether Marvis may remediate non-compliant gateways automatically default: false switch_misconfigured_port: type: boolean description: Whether Marvis may remediate misconfigured switch ports automatically default: false switch_port_stuck: type: boolean description: Whether Marvis may remediate stuck switch ports automatically default: false description: Automatic remediation operations controlled by Marvis sw_routing_policy_term_action2: title: sw_routing_policy_term_action2 type: object properties: accept: type: boolean description: Whether to accept routes that match this term community: type: array items: type: string description: BGP communities to set when this term is used as an export policy local_preference: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Preference value to set when this term is used as an import policy prepend_as_path: type: array items: type: string description: AS path values to prepend when this term is used as an export policy description: Policy actions applied when this routing policy term matches extra_route6_next_qualified_properties: title: extra_route6_next_qualified_properties type: object properties: metric: type: - integer - 'null' description: Route metric for this qualified IPv6 next hop contentEncoding: int32 preference: type: - integer - 'null' description: Route preference for this qualified IPv6 next hop contentEncoding: int32 description: Qualified next-hop attributes for an IPv6 static route response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response tunnel_config_ipsec_proposal: title: tunnel_config_ipsec_proposal type: object properties: auth_algo: allOf: - $ref: '#/components/schemas/tunnel_config_auth_algo1' - description: 'Integrity algorithm used by this IPsec proposal. enum: `md5`, `sha1`, `sha2`.' dh_group: allOf: - $ref: '#/components/schemas/tunnel_config_dh_group2' - description: 'Diffie-Hellman group used by this IPsec proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' enc_algo: allOf: - oneOf: - {} - $ref: '#/components/schemas/tunnel_config_enc_algo1' - description: 'Cipher algorithm used by this IPsec proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' description: IPsec proposal settings for custom IPsec tunnels synthetictest_config1: title: synthetictest_config1 type: object properties: aggressiveness: allOf: - $ref: '#/components/schemas/synthetictest_config_aggressiveness3' - description: 'Overall aggressiveness level for synthetic test probes. enum: `auto`, `high`, `med`, `low`.' custom_probes: type: object additionalProperties: $ref: '#/components/schemas/synthetictest_config_custom_probe' description: Custom synthetic probe definitions keyed by probe name disabled: type: boolean description: Whether synthetic tests are disabled default: false lan_networks: type: array items: $ref: '#/components/schemas/synthetictest_config_lan_network' description: LAN network probe groups used by synthetic tests vlans: type: array items: $ref: '#/components/schemas/synthetictest_config_vlan' description: Deprecated VLAN-based synthetic test settings deprecated: true wan_speedtest: allOf: - $ref: '#/components/schemas/synthetictest_config_wan_speedtest2' - description: WAN speedtest settings for synthetic tests description: Active monitoring test configuration for the site gateway_traffic_shaping3: title: gateway_traffic_shaping3 type: object properties: class_percentages: type: array items: type: integer contentEncoding: int32 description: Traffic class bandwidth percentages for high, medium, low, and best-effort queues enabled: type: boolean description: Whether traffic shaping is enabled default: false max_tx_kbps: type: integer description: Maximum transmit bandwidth for the interface, in Kbps contentEncoding: int32 description: Traffic shaping settings applied to the port vrf_config5: title: vrf_config5 type: object properties: enabled: type: boolean description: Whether to enable VRF (when supported on the device) description: VRF defaults applied by this network template mxcluster_nac2: title: mxcluster_nac2 type: object properties: acct_server_port: type: integer description: RADIUS accounting port used by Mist NAC on the cluster contentEncoding: int32 default: 1813 auth_server_port: type: integer description: RADIUS authentication port used by Mist NAC on the cluster contentEncoding: int32 default: 1812 client_ips: type: object additionalProperties: $ref: '#/components/schemas/mxcluster_nac_client_ip' description: Property key is the RADIUS Client IP/Subnet. enabled: type: boolean description: Whether Mist NAC is enabled on the cluster default: false secret: type: string description: Shared RADIUS secret used by Mist NAC clients examples: - testing123 description: RADIUS settings for Mist NAC on the site Mist Edge cluster site_wids_repeated_auth_failures: title: site_wids_repeated_auth_failures type: object properties: duration: type: integer description: Window where a trigger will be detected and action to be taken (in seconds) contentEncoding: int32 examples: - 60 threshold: type: integer description: Count of events to trigger contentEncoding: int32 description: Detection settings for repeated authentication failures mxedge_mgmt_oob_ip_type62: title: mxedge_mgmt_oob_ip_type62 enum: - autoconf - dhcp - disabled - static type: string description: 'IPv6 address assignment mode for out-of-band management. enum: `autoconf`, `dhcp`, `disabled`, `static`.' site_engagement1: title: site_engagement1 type: object properties: dwell_tag_names: allOf: - $ref: '#/components/schemas/site_engagement_dwell_tag_names2' - description: Display labels for dwell-time visit categories dwell_tags: allOf: - $ref: '#/components/schemas/site_engagement_dwell_tags2' - description: Visit duration ranges used to assign engagement categories hours: allOf: - $ref: '#/components/schemas/hours3' - description: Schedule during which engagement analytics rules apply max_dwell: maximum: 68400 minimum: 1 type: integer description: Maximum dwell time in seconds considered by engagement analytics contentEncoding: int32 default: 43200 examples: - 43200 min_dwell: minimum: 0 type: integer description: Minimum dwell time in seconds for engagement analytics contentEncoding: int32 description: Dwell-time analytics rules for the site simple_alert_dns_failure: title: simple_alert_dns_failure type: object properties: client_count: type: integer description: Number of distinct clients that must encounter DNS failures before alerting contentEncoding: int32 default: 20 duration: maximum: 60 minimum: 5 type: integer description: Time window in minutes for evaluating DNS failures contentEncoding: int32 default: 10 incident_count: type: integer description: Number of DNS failure incidents required within the duration window contentEncoding: int32 default: 30 description: Thresholds for DNS failure heuristic alerts protect_re1: title: protect_re1 type: object properties: allowed_services: type: array items: $ref: '#/components/schemas/protect_re_allowed_service' description: Built-in services explicitly allowed by the Protect RE policy examples: - - icmp - ssh custom: type: array items: $ref: '#/components/schemas/protect_re_custom' description: Additional ACL entries allowed by the Protect RE policy enabled: type: boolean description: "When enabled, all traffic that is not essential to our operation will be dropped\ne.g. ntp / dns / traffic to mist will be allowed by default\n if dhcpd is enabled, we'll make sure it works" default: false hit_count: type: boolean description: Whether to enable hit count for Protect_RE policy default: false trusted_hosts: type: array items: type: string description: Trusted host or subnet entries allowed by the Protect RE policy description: Control-plane protection settings for the gateway tacacs2: title: tacacs2 type: object properties: acct_servers: type: array items: $ref: '#/components/schemas/tacacs_acct_server' description: TACACS+ accounting servers used for switch management sessions default_role: allOf: - $ref: '#/components/schemas/tacacs_default_role2' - description: 'Default switch-management role to use for TACACS+ logins. enum: `admin`, `helpdesk`, `none`, `read`.' enabled: type: boolean description: Whether TACACS+ is enabled for switch management authentication network: type: string description: Source network used for connectivity to the TACACS+ servers tacplus_servers: type: array items: $ref: '#/components/schemas/tacacs_auth_server' description: TACACS+ authentication servers used for switch management logins description: Management authentication settings using TACACS+ snmp_config_engine_id_type2: title: snmp_config_engine_id_type2 enum: - local - use_mac_address type: string description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' site_setting_switch2: title: site_setting_switch2 type: object properties: acl_policies: type: array items: $ref: '#/components/schemas/acl_policy' description: ACL policy defaults provided by this network template acl_tags: type: object additionalProperties: $ref: '#/components/schemas/acl_tag' description: ACL tags available to access policies in this network template additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands provided by this network template bgp_config: type: object additionalProperties: $ref: '#/components/schemas/switch_bgp_config' description: BGP routing defaults for this network template. Property key is the BGP session name created_time: type: number description: Timestamp when the network template was created readOnly: true dhcp_snooping: allOf: - $ref: '#/components/schemas/dhcp_snooping3' - description: DHCP snooping defaults provided by this network template dns_servers: type: array items: type: string description: DNS servers provided by this network template dns_suffix: type: array items: type: string description: DNS search suffixes provided by this network template extra_routes: type: object additionalProperties: $ref: '#/components/schemas/extra_route' description: Additional IPv4 route defaults in this network template examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/extra_route6' description: Additional IPv6 route defaults in this network template examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 id: type: string description: Unique identifier of the network template contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f import_org_networks: type: array items: type: string description: Organization network names imported into this network template mist_nac: allOf: - $ref: '#/components/schemas/switch_mist_nac2' - description: Mist NAC defaults applied by this network template modified_time: type: number description: Timestamp when the network template was last modified readOnly: true multicast_config: allOf: - $ref: '#/components/schemas/switch_multicast_config1' - description: Multicast settings for networks in the master VRF (not assigned to any vrf_instances); PIM is automatically enabled when any master-VRF network has `multicast.enabled`==`true` name: type: string description: Display name of the network template networks: type: object additionalProperties: $ref: '#/components/schemas/switch_network' description: Layer 3 networks configured by this network template ntp_servers: type: array items: type: string description: NTP servers provided by this network template org_id: type: string description: Organization that owns this network template contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 ospf_areas: type: object additionalProperties: $ref: '#/components/schemas/ospf_area' description: OSPF area defaults provided by this network template port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Port mirroring defaults provided by this network template port_usages: type: object additionalProperties: $ref: '#/components/schemas/switch_port_usage' description: Reusable switch port usage profiles provided by this network template radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config3' - description: RADIUS authentication and accounting defaults in this network template remote_syslog: allOf: - $ref: '#/components/schemas/remote_syslog2' - description: Remote syslog defaults provided by this network template remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false routing_policies: type: object additionalProperties: $ref: '#/components/schemas/sw_routing_policy' description: Routing policy defaults applied by this network template snmp_config: allOf: - $ref: '#/components/schemas/snmp_config2' - description: SNMP defaults provided by this network template switch_matching: allOf: - $ref: '#/components/schemas/switch_matching3' - description: Matching rules that select switches for this network template switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt3' - description: Management-plane defaults provided by this network template vrf_config: allOf: - $ref: '#/components/schemas/vrf_config5' - description: VRF defaults applied by this network template vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/switch_vrf_instance' description: VRF instances configured by this network template examples: - guest: extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest auto_upgrade: allOf: - $ref: '#/components/schemas/switch_auto_upgrade1' - description: Switch firmware auto-upgrade configuration description: Site-level switch feature configuration tunnel_config_auto_provision_provider2: title: tunnel_config_auto_provision_provider2 enum: - jse-ipsec - zscaler-ipsec type: string description: 'Tunnel provider used for automatic endpoint provisioning. enum: `jse-ipsec`, `zscaler-ipsec`.' tunnel_config_auto_provision_node3: title: tunnel_config_auto_provision_node3 type: object properties: probe_ips: uniqueItems: true type: array items: type: string description: Probe IP addresses used to monitor auto-provisioned tunnel reachability wan_names: type: array items: type: string description: WAN interface names used by the auto-provisioned tunnel endpoint description: Main auto-provisioned tunnel endpoint settings switch_radius_config_auth_server_selection2: title: switch_radius_config_auth_server_selection2 enum: - ordered - unordered type: string description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' tunnel_config_enc_algo1: title: tunnel_config_enc_algo1 enum: - 3des - aes128 - aes256 - aes_gcm128 - aes_gcm256 type: string description: 'Cipher algorithm used by this IPsec proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' sw_routing_policy_term_matching_protocol_enum: title: sw_routing_policy_term_matching_protocol_enum enum: - bgp - direct - evpn - ospf - static type: string description: 'enum: `bgp`, `direct`, `evpn`, `ospf`, `static`' site_rogue1: title: site_rogue1 type: object properties: allowed_vlan_ids: type: array items: maximum: 4096 minimum: 0 type: integer contentEncoding: int32 description: VLAN IDs allowed by the rogue detection policy enabled: type: boolean description: Whether rogue detection is enabled default: false honeypot_enabled: type: boolean description: Whether honeypot detection is enabled default: false min_duration: maximum: 59 type: integer description: Minimum duration for a bssid to be considered neighbor contentEncoding: int32 default: 10 examples: - 10 min_rogue_duration: maximum: 59 type: integer description: Minimum duration for a bssid to be considered rogue contentEncoding: int32 default: 10 examples: - 10 min_rogue_rssi: minimum: -85 type: integer description: Minimum RSSI for an AP to be considered rogue contentEncoding: int32 default: -80 examples: - -80 min_rssi: minimum: -85 type: integer description: Minimum RSSI for an AP to be considered neighbor (ignoring APs that’s far away) contentEncoding: int32 default: -80 examples: - -80 whitelisted_bssids: type: array items: type: string description: BSSID values or wildcard patterns excluded from rogue detection examples: - - NeighborSSID whitelisted_ssids: type: array items: type: string description: SSID names excluded from rogue detection examples: - - cc:8e:6f:d4:bf:16 - cc-8e-6f-d4-bf-16 - cc-73-* - cc:82:* description: AP threat detection settings for the site config_switch_local_accounts_user: title: config_switch_local_accounts_user type: object properties: password: type: string description: Local password for the switch user account contentEncoding: password examples: - Juniper123 role: allOf: - $ref: '#/components/schemas/config_switch_local_accounts_user_role2' - description: 'Access role granted to the local switch user account. enum: `admin`, `helpdesk`, `none`, `read`.' description: Local switch user account credentials and access role vrrp_group_auth_type2: title: vrrp_group_auth_type2 enum: - md5 - simple type: string description: 'Authentication method used by the VRRP group. enum: `md5`, `simple`.' examples: - md5 switch_mgmt4: title: switch_mgmt4 type: object properties: ap_affinity_threshold: type: integer description: AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used. contentEncoding: int32 default: 10 cli_banner: type: string description: Set Banners for switches. Allows markup formatting examples: - \t\tWELCOME! cli_idle_timeout: maximum: 60 minimum: 1 type: integer description: Sets timeout for switches contentEncoding: int32 config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 dhcp_option_fqdn: type: boolean description: Enable to provide the FQDN with DHCP option 81 default: false disable_oob_down_alarm: type: boolean description: Whether to suppress alarms when the switch out-of-band management interface is down fips_enabled: type: boolean description: Whether FIPS mode is enabled on the switch default: false local_accounts: type: object additionalProperties: $ref: '#/components/schemas/config_switch_local_accounts_user' description: Local switch user accounts keyed by username mxedge_proxy_host: type: string description: IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud mxedge_proxy_port: anyOf: - maximum: 65535 minimum: 1 type: integer contentEncoding: int32 default: 2222 - type: string description: Mist Edge proxy port used for switch management traffic protect_re: allOf: - $ref: '#/components/schemas/protect_re3' - description: Control-plane protection settings for the switch radius: allOf: - $ref: '#/components/schemas/switch_radius2' - description: Management authentication settings using RADIUS remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false root_password: type: string description: Root password for local switch access contentEncoding: password tacacs: allOf: - $ref: '#/components/schemas/tacacs2' - description: Management authentication settings using TACACS+ use_mxedge_proxy: type: boolean description: Whether to use Mist Edge as a proxy for switch management traffic description: Management access settings for switches at the site switch_matching3: title: switch_matching3 type: object properties: enable: type: boolean description: Whether custom switch matching rules are enabled rules: uniqueItems: true type: array items: $ref: '#/components/schemas/switch_matching_rule' description: Switch matching rules evaluated to apply custom configuration description: Matching rules that select switches for this network template gw_routing_policy_term_matching2: title: gw_routing_policy_term_matching2 type: object properties: as_path: type: array items: $ref: '#/components/schemas/bgp_as' description: AS path values that routes must match community: type: array items: type: string description: BGP communities that routes must match network: uniqueItems: true type: array items: type: string description: Configured network names that routes must match prefix: type: array items: type: string description: Route prefixes that routes must match protocol: type: array items: $ref: '#/components/schemas/gw_routing_policy_term_matching_protocol_enum' description: Routing protocols that routes must match route_exists: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_matching_route_exists2' - description: Existing route condition that must be satisfied before this term matches vpn_neighbor_mac: type: array items: type: string description: Overlay neighbor MAC addresses used as match criteria for BGP sessions with `via`==`vpn` vpn_path: type: array items: type: string description: Overlay path names used as match criteria for BGP sessions with `via`==`vpn` vpn_path_sla: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_matching_vpn_path_sla2' - description: SLA thresholds used when matching a VPN path description: Route match criteria that must be satisfied before actions are applied network_internet_access_destination_nat_property: title: network_internet_access_destination_nat_property type: object properties: internal_ip: type: string description: The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.30 name: type: string description: Label for this direct internet destination NAT rule examples: - web server port: type: string description: The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}") examples: - '443' wan_name: type: string description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity examples: - wan0 description: Direct-internet destination NAT rule target settings site_wids2: title: site_wids2 type: object properties: repeated_auth_failures: allOf: - $ref: '#/components/schemas/site_wids_repeated_auth_failures' - description: Detection settings for repeated authentication failures description: Wireless intrusion detection settings for the site hours3: title: hours3 type: object properties: fri: type: string description: Operating hour range for Friday examples: - 09:00-17:00 mon: type: string description: Operating hour range for Monday examples: - 09:00-17:00 sat: type: string description: Operating hour range for Saturday examples: - 09:00-17:00 sun: type: string description: Operating hour range for Sunday examples: - 09:00-17:00 thu: type: string description: Operating hour range for Thursday examples: - 09:00-17:00 tue: type: string description: Operating hour range for Tuesday examples: - 09:00-17:00 wed: type: string description: Operating hour range for Wednesday examples: - 09:00-17:00 description: Schedule during which engagement analytics rules apply gateway_port_vpn_path_role2: title: gateway_port_vpn_path_role2 enum: - hub - mesh - spoke type: string description: 'Gateway role for this VPN path; valid values depend on the VPN `type`. enum: `hub`, `mesh`, `spoke`.' radio_band_preamble2: title: radio_band_preamble2 enum: - auto - long - short type: string description: '802.11 preamble mode used by the 6 GHz radio. enum: `auto`, `long`, `short`.' gateway_ip_config_property: title: gateway_ip_config_property type: object properties: ip: type: string description: Static IPv4 address for the gateway network interface when `type`==`static` contentEncoding: ipv4 ip6: type: string description: Static IPv6 address for the gateway network interface when `type6`==`static` contentEncoding: ipv6 netmask: type: string description: IPv4 netmask or prefix length for the gateway network interface when `type`==`static` examples: - /24 netmask6: type: string description: IPv6 netmask or prefix length for the gateway network interface when `type6`==`static` examples: - 2001:db8:abcd:12::1 secondary_ips: type: array items: type: string description: Additional IPv4 addresses in CIDR notation for this gateway network interface examples: - - 192.168.50.1/24 - 192.168.60.1/26 type: allOf: - $ref: '#/components/schemas/ip_type4' - description: 'IPv4 address assignment mode for this gateway network interface. enum: `dhcp`, `static`.' examples: - static type6: allOf: - $ref: '#/components/schemas/ip_type62' - description: 'IPv6 address assignment mode for this gateway network interface. enum: `autoconf`, `dhcp`, `disabled`, `static`.' examples: - static description: Gateway network interface IP configuration protect_re_allowed_service: title: protect_re_allowed_service enum: - icmp - ssh type: string description: 'Services allowed through protect-RE filters. enum: `icmp`, `ssh`' site_setting_wired_vna2: title: site_setting_wired_vna2 type: object properties: enabled: type: boolean description: Whether Wired VNA is enabled for the site default: false description: Virtual Network Assistant settings for wired experiences at the site wan_extra_routes6: title: wan_extra_routes6 type: object properties: via: type: string description: IPv6 next-hop address for this WAN extra route contentEncoding: ipv6 description: Additional IPv6 route for a WAN interface site_wifi2: title: site_wifi2 type: object properties: cisco_enabled: type: boolean description: Whether Cisco compatibility features are enabled for site Wi-Fi default: true disable_11k: type: boolean description: Whether to disable 11k default: false disable_radios_when_power_constrained: type: boolean description: Whether AP radios are disabled when AP power is constrained default: false enable_arp_spoof_check: type: boolean description: When proxy_arp is enabled, check for arp spoofing. default: false enable_shared_radio_scanning: type: boolean description: Whether shared radio scanning is enabled for site Wi-Fi default: true enabled: type: boolean description: Enable Wi-Fi feature (using SUB-MAN license) default: true locate_connected: type: boolean description: Whether to locate connected clients default: true locate_unconnected: type: boolean description: Whether to locate unconnected clients default: false mesh_allow_dfs: type: boolean description: Whether to allow Mesh to use DFS channels. For DFS channels, Remote Mesh AP would have to do CAC when scanning for new Base AP, which is slow and will disrupt the connection. If roaming is desired, keep it disabled. default: false mesh_enable_crm: type: boolean description: Used to enable/disable CRM default: false mesh_enabled: type: boolean description: Whether to enable Mesh feature for the site default: false mesh_psk: type: - string - 'null' description: Optional passphrase of mesh networking, default is generated randomly mesh_ssid: type: - string - 'null' description: Optional ssid of mesh networking, default is based on site_id proxy_arp: allOf: - oneOf: - {} - $ref: '#/components/schemas/site_wifi_proxy_arp2' - description: 'ARP proxy mode for site Wi-Fi. enum: `default`, `disabled`, `enabled`.' description: Wireless LAN configuration settings for the site response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response aggregate_route: title: aggregate_route type: object properties: discard: type: boolean description: Whether to install the aggregate route as a discard route default: false metric: maximum: 4294967295 minimum: 0 type: - integer - 'null' description: Routing metric assigned to the aggregate route contentEncoding: int32 preference: maximum: 4294967295 minimum: 0 type: - integer - 'null' description: Route preference assigned to the aggregate route contentEncoding: int32 description: Aggregate route configuration for a network or routing instance vrf_extra_route: title: vrf_extra_route type: object properties: via: type: string description: IPv4 next-hop address for this VRF extra route contentEncoding: ipv4 description: Additional IPv4 static route for a VRF instance mxcluster_rad_auth_server_keywrap_format2: title: mxcluster_rad_auth_server_keywrap_format2 enum: - ascii - hex type: string description: 'Encoding format for Mist AP RADIUS keywrap keys. enum: `ascii`, `hex`.' gateway_vrf_instance: title: gateway_vrf_instance type: object properties: networks: uniqueItems: true type: array items: type: string description: Network names included in this gateway VRF instance description: Gateway VRF instance and its member networks examples: - networks: - CORP_NET - MGMT_NET network_vpn_access_destination_nat_property: title: network_vpn_access_destination_nat_property type: object properties: internal_ip: type: string description: The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.30 name: type: string description: Label for this VPN destination NAT rule examples: - web server port: type: string description: Destination port or variable for this VPN destination NAT rule examples: - '443' description: VPN access destination NAT rule target settings site_occupancy_analytics: title: site_occupancy_analytics type: object properties: assets_enabled: type: boolean description: Indicate whether named BLE assets should be included in the zone occupancy calculation default: false clients_enabled: type: boolean description: Indicate whether connected Wi-Fi clients should be included in the zone occupancy calculation default: true min_duration: type: integer description: Minimum dwell duration before a client or asset is counted in occupancy analytics contentEncoding: int32 default: 3000 examples: - 3000 sdkclients_enabled: type: boolean description: Indicate whether SDK clients should be included in the zone occupancy calculation default: false unconnected_clients_enabled: type: boolean description: Indicate whether unconnected Wi-Fi clients should be included in the zone occupancy calculation default: false description: Analytics settings for site occupancy radius_acct_server: title: radius_acct_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS accounting server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this accounting server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS accounting server secret: type: string description: Shared secret used with this RADIUS accounting server contentEncoding: password examples: - testing123 description: RADIUS accounting server settings site_setting_critical_url_monitoring_monitor: title: site_setting_critical_url_monitoring_monitor type: object properties: url: type: string description: Monitored HTTP or HTTPS URL used for site health latency examples: - http://50.1.3.5:8080 vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: Source VLAN ID used to run the critical URL monitor description: Critical URL monitor definition for site health radius_auth_server: title: radius_auth_server required: - host - secret type: object properties: host: type: string description: Address or hostname of the RADIUS authentication server examples: - 1.2.3.4 keywrap_enabled: type: boolean description: Whether RADIUS keywrap is enabled for messages sent to this authentication server keywrap_format: allOf: - $ref: '#/components/schemas/radius_keywrap_format1' - description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' keywrap_kek: type: string description: RADIUS keywrap key encryption key (KEK) examples: - '1122334455' keywrap_mack: type: string description: RADIUS keywrap message authentication code key (MACK) examples: - '1122334455' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used by the RADIUS authentication server require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Shared secret used with this RADIUS authentication server contentEncoding: password examples: - testing123 description: RADIUS authentication server settings gateway_wan_probe_override_probe_profile2: title: gateway_wan_probe_override_probe_profile2 enum: - broadband - lte type: string description: 'WAN probe profile used for health checks on this port. enum: `broadband`, `lte`.' ip_type11: title: ip_type11 enum: - dhcp - static type: string description: 'IP assignment mode for in-band switch management. enum: `dhcp`, `static`.' examples: - static gateway_mgmt2: title: gateway_mgmt2 type: object properties: admin_sshkeys: type: array items: type: string description: SSR-only SSH public keys for administrative access examples: - - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host app_probing: allOf: - $ref: '#/components/schemas/app_probing1' - description: Application probing configuration for gateway monitoring app_usage: type: boolean description: Consumes uplink bandwidth, requires WA license auto_signature_update: allOf: - $ref: '#/components/schemas/gateway_mgmt_auto_signature_update2' - description: Schedule for automatic security signature updates config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 disable_console: type: boolean description: For SSR and SRX, disable console port default: false disable_idp_pcap: type: boolean description: For SRX only, disable IDP packet capture default: false disable_oob: type: boolean description: For SSR and SRX, disable management interface default: false disable_usb: type: boolean description: For SSR and SRX, disable usb interface default: false fips_enabled: type: boolean description: Whether FIPS mode is enabled on the gateway default: false probe_hosts: type: array items: type: string description: IPv4 probe targets used for gateway connectivity checks examples: - - 8.8.8.8 probe_hostsv6: type: array items: type: string description: IPv6 probe targets used for gateway connectivity checks examples: - - 2001:4860:4860::8888 protect_re: allOf: - $ref: '#/components/schemas/protect_re1' - description: Control-plane protection settings for the gateway root_password: type: string description: SRX only. Root password for local gateway access contentEncoding: password security_log_source_address: type: string description: IPv4 source address used for gateway security log traffic contentEncoding: ipv4 examples: - 192.168.1.1 security_log_source_interface: type: string description: Source interface used for gateway security log traffic examples: - ge-0/0/1.0 description: Management-plane defaults provided by this gateway template snmp_config_client_list: title: snmp_config_client_list type: object properties: client_list_name: type: string description: Name of the SNMP client list examples: - clist-1 clients: type: array items: type: string description: SNMP client IP addresses or CIDR ranges allowed by this list description: SNMP client allowlist definition tunnel_config_ike_proposal: title: tunnel_config_ike_proposal type: object properties: auth_algo: allOf: - $ref: '#/components/schemas/tunnel_config_auth_algo3' - description: 'Integrity algorithm used by this IKE proposal. enum: `md5`, `sha1`, `sha2`.' dh_group: allOf: - $ref: '#/components/schemas/tunnel_config_ike_dh_group2' - description: 'Diffie-Hellman group used by this IKE proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' enc_algo: allOf: - oneOf: - {} - $ref: '#/components/schemas/tunnel_config_enc_algo3' - description: 'Cipher algorithm used by this IKE proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' description: IKE proposal settings for custom IPsec tunnels snmpv3_config_notify_items: title: snmpv3_config_notify_items type: object properties: name: type: string description: Identifier for this SNMPv3 notification definition tag: type: string description: Notification tag used to select target addresses type: allOf: - $ref: '#/components/schemas/snmpv3_config_notify_type2' - description: Delivery mode for this SNMPv3 notification, such as trap or inform description: SNMPv3 notification definition for traps or informs app_probing_custom_app_protocol2: title: app_probing_custom_app_protocol2 enum: - http - icmp type: string description: 'Probe protocol used by this custom application definition. enum: `http`, `icmp`.' gateway_path_preferences_path: title: gateway_path_preferences_path required: - type type: object properties: cost: type: integer description: Relative cost assigned to this path for gateway path selection contentEncoding: int32 disabled: type: boolean description: For SSR Only. `true`, if this specific path is undesired gateway_ip: type: string description: Only if `type`==`local`, if a different gateway is desired internet_access: type: boolean description: Only if `type`==`vpn`, if this vpn path can be used for internet name: type: string description: "Required when \n * `type`==`vpn`: the name of the VPN Path to use \n * `type`==`wan`: the name of the WAN interface to use" networks: type: array items: type: string description: List of network names used when `type`==`local` target_ips: type: array items: type: string description: List of destination IP addresses to replace when `type`==`local` type: allOf: - $ref: '#/components/schemas/gateway_path_type2' - description: Gateway path source type, such as local network, WAN interface, VPN path, or tunnel wan_name: type: string description: Optional if `type`==`vpn`; WAN interface name associated with the VPN path examples: - wan0 description: Candidate path within a gateway path preference ap_radio_band62: title: ap_radio_band62 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 6 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 6 GHz radio contentEncoding: int32 default: 0 antenna_beam_pattern: allOf: - $ref: '#/components/schemas/radio_band_antenna_beam_pattern1' - description: 'Beam pattern used by the 6 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode2' - description: 'Radio chain mode for the 6 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth62' - description: 'Channel width configured for the 6 GHz radio. enum: `0`, `20`, `40`, `80`, `160`.' examples: - 80 channel: type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 0 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 6 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 7 power_max: maximum: 18 minimum: 5 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 18 minimum: 5 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble2' - description: '802.11 preamble mode used by the 6 GHz radio. enum: `auto`, `long`, `short`.' standard_power: type: boolean description: For 6GHz Only, standard-power operation, AFC (Automatic Frequency Coordination) will be performed, and we'll fall back to Low Power Indoor if AFC failed default: false description: 6 GHz radio settings for this access point idp_profile_action2: title: idp_profile_action2 enum: - alert - close - drop type: string description: 'Enforcement action applied when this overwrite rule matches. enum: `alert`, `close`, `drop`.' examples: - alert site_engagement_dwell_tag_names2: title: site_engagement_dwell_tag_names2 type: object properties: bounce: type: string description: Display label for bounce visits default: Visitor examples: - Bounce engaged: type: string description: Display label for engaged visits default: Associates examples: - Engaged passerby: type: string description: Display label for passerby visits default: Passerby examples: - Passer By stationed: type: string description: Display label for stationed visits default: Assets examples: - Stationed description: Display labels for dwell-time visit categories network_multicast_group: title: network_multicast_group type: object properties: rp_ip: type: string description: RP (rendezvous point) IP address description: Multicast group rendezvous point mapping switch_mist_nac2: title: switch_mist_nac2 type: object properties: enabled: type: boolean description: Whether Mist NAC RadSec is enabled for the switch network: type: string description: Switch network used for Mist NAC RadSec connectivity description: Mist NAC defaults applied by this network template app_probing_custom_app: title: app_probing_custom_app type: object properties: address: type: string description: Required if `protocol`==`icmp`. IP address probed by the ICMP custom app examples: - 192.168.1.1 app_type: type: string description: Category label used for this custom application probe hostnames: type: array items: type: string description: If `protocol`==`http`. Hostnames or URLs probed by this custom app examples: - - https://www.abc.com key: type: string description: Stable key used to identify this custom application probe name: type: string description: Display name for this custom application probe examples: - pos_app network: type: string description: Gateway network used as the source context for this probe examples: - lan packetSize: maximum: 65400 minimum: 0 type: integer description: If `protocol`==`icmp`. ICMP packet size used by this custom app probe contentEncoding: int32 protocol: allOf: - $ref: '#/components/schemas/app_probing_custom_app_protocol2' - description: 'Probe protocol used by this custom application definition. enum: `http`, `icmp`.' url: type: string description: If `protocol`==`http`. HTTP URL or hostname probed by this custom app examples: - www.abc.com vrf: type: string description: Gateway VRF used as the source context for this probe examples: - lan description: User-defined application probe definition site_setting_juniper_srx_gateway: title: site_setting_juniper_srx_gateway type: object properties: api_key: type: string description: Authentication key used to access the Juniper SRX gateway API examples: - 5abf7c8a-1a1c-4398-ba2d-b0c297094d1a api_password: type: string description: Authentication password used to access the Juniper SRX gateway API examples: - abc@123 api_url: type: string description: Base URL for the Juniper SRX gateway API examples: - https://23.43.12.78:8443 description: Juniper SRX gateway API connection settings switch_port_usage_dynamic_reset_default_when2: title: switch_port_usage_dynamic_reset_default_when2 enum: - link_down - none type: string description: 'Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage. enum: `link_down`, `none`.' examples: - link_down snmp_config_trap_version2: title: snmp_config_trap_version2 enum: - all - v1 - v2 type: string description: 'SNMP trap protocol version used by this group. enum: `all`, `v1`, `v2`.' tunterm_monitoring_item: title: tunterm_monitoring_item type: object properties: host: minLength: 1 type: string description: Can be ip, ipv6, hostname examples: - 10.2.8.15 port: type: integer description: When `protocol`==`tcp`, TCP port checked by the monitoring probe contentEncoding: int32 examples: - 80 protocol: allOf: - $ref: '#/components/schemas/tunterm_monitoring_protocol2' - minLength: 1 description: 'Monitoring method used for this tunnel termination check. enum: `arp`, `ping`, `tcp`.' examples: - tcp src_vlan_id: type: integer description: Optional source for the monitoring check, vlan_id configured in tunterm_other_ip_configs contentEncoding: int32 examples: - 5 timeout: type: integer description: Maximum time for this monitoring check, in seconds contentEncoding: int32 default: 300 examples: - 300 description: Monitoring check for tunnel termination reachability mxcluster_radsec_nas_ip_source2: title: mxcluster_radsec_nas_ip_source2 enum: - any - oob - oob6 - tunnel - tunnel6 type: string description: 'Source used to populate NAS-IP-Address and NAS-IPv6-Address attributes. enum: `any`, `oob`, `oob6`, `tunnel`, `tunnel6`.' site_setting_auto_placement2: title: site_setting_auto_placement2 type: object properties: orientation: type: integer description: AP orientation angle in degrees on the map contentEncoding: int32 examples: - 45 x: type: number description: Map x-coordinate determined by auto placement examples: - 30 y: type: number description: Map y-coordinate determined by auto placement examples: - 60 description: Automatic AP placement settings for the site mxcluster_radsec2: title: mxcluster_radsec2 type: object properties: acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/mxcluster_radsec_acct_server' description: RADIUS accounting servers used by the RadSec proxy auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/mxcluster_radsec_auth_server' description: RADIUS authentication servers used by the RadSec proxy enabled: type: boolean description: Whether to enable service on Mist Edge i.e. RADIUS proxy over TLS match_ssid: type: boolean description: Whether to match ssid in request message to select from a subset of RADIUS servers nas_ip_source: allOf: - $ref: '#/components/schemas/mxcluster_radsec_nas_ip_source2' - description: 'Source used to populate NAS-IP-Address and NAS-IPv6-Address attributes. enum: `any`, `oob`, `oob6`, `tunnel`, `tunnel6`.' proxy_hosts: type: array items: type: string description: AP-reachable hostnames or IP addresses advertised as RadSec TLS servers server_selection: allOf: - $ref: '#/components/schemas/mxcluster_radsec_server_selection2' - description: 'RADIUS server selection strategy for RadSec failover. enum: `ordered`, `unordered`.' src_ip_source: allOf: - $ref: '#/components/schemas/mxcluster_radsec_src_ip_source2' - description: 'Connection source interface or address used when reaching RADIUS servers. enum: `any`, `oob`, `oob6`, `tunnel`, `tunnel6`.' description: TLS-secured RADIUS proxy settings for the site Mist Edge cluster synthetictest_config_vlan: title: synthetictest_config_vlan type: object properties: custom_test_urls: type: array items: type: string description: Deprecated custom URLs tested by VLAN-based synthetic probes examples: - - https://www.abc.com/ - https://10.3.5.1:8080/about deprecated: true disabled: type: boolean description: For some vlans where we don't want this to run default: false probes: type: array items: type: string description: Synthetic probe names to run for the listed VLANs vlan_ids: type: array items: $ref: '#/components/schemas/vlan_id_with_variable' description: VLAN identifiers where synthetic probes are run examples: - - 10 - 20 - '{{vlan}}' description: Deprecated VLAN-based synthetic test settings idp_config2: title: idp_config2 type: object properties: alert_only: type: boolean description: Whether to alert without enforcing IDP prevention actions enabled: type: boolean description: Whether IDP inspection is enabled for the policy default: false idpprofile_id: type: string description: org_level IDP Profile can be used, this takes precedence over `profile` contentEncoding: uuid examples: - 89b9d208-84a4-fa8f-af57-78f92c639cf2 profile: type: string description: 'enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles' default: strict description: Intrusion detection and prevention settings applied by this service policy switch_radius_config1: title: switch_radius_config1 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS configuration used when alternate RADIUS settings are required tunnel_config_node1: title: tunnel_config_node1 required: - hosts - wan_names type: object properties: hosts: type: array items: type: string description: Remote gateway host addresses for this tunnel node internal_ip6s: uniqueItems: true type: array items: type: string description: IPv6 addresses configured on this tunnel node internal_ips: type: array items: type: string description: Internal IP addresses configured on this tunnel node probe_hostnames: uniqueItems: true type: array items: type: string description: Hostnames used as ICMP probe destinations for this tunnel node; applicable for both IPv4 and IPv6 probe_http: allOf: - $ref: '#/components/schemas/tunnel_config_node_probe_http2' - description: HTTP probe settings for this tunnel node; success from any ICMP or HTTP probe indicates the tunnel is up probe_ip6s: uniqueItems: true type: array items: type: string description: IPv6 ICMP probe addresses used to monitor this tunnel node probe_ips: uniqueItems: true type: array items: type: string description: Health-check IP addresses used to monitor this tunnel node remote_ids: type: array items: type: string description: IKE identities expected from this tunnel node wan_names: type: array items: type: string description: Interface names that source tunnel traffic for this node description: Backup remote tunnel endpoint settings site_setting_tunterm_multicast_config2: title: site_setting_tunterm_multicast_config2 type: object properties: mdns: allOf: - $ref: '#/components/schemas/site_setting_tunterm_multicast_config_mdns2' - description: Multicast DNS forwarding settings for tunneled VLANs multicast_all: type: boolean description: Whether all multicast traffic is forwarded through tunnel termination default: false ssdp: allOf: - $ref: '#/components/schemas/site_setting_tunterm_multicast_config_ssdp2' - description: Simple Service Discovery Protocol forwarding settings for tunneled VLANs description: Multicast settings for tunnel termination at the site idp_profile: title: idp_profile type: object properties: base_profile: allOf: - $ref: '#/components/schemas/idp_profile_base_profile2' - description: 'Built-in IDP baseline profile inherited before applying overwrites. enum: `critical`, `standard`, `strict`.' examples: - strict created_time: type: number description: Timestamp when the IDP profile was created readOnly: true id: type: string description: Unique identifier of the IDP profile contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f modified_time: type: number description: Timestamp when the IDP profile was last modified readOnly: true name: type: string description: Display name of the IDP profile examples: - relaxed org_id: type: string description: Owning organization for the IDP profile contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 overwrites: type: array items: $ref: '#/components/schemas/idp_profile_overwrite' description: IDP signature override rules applied on top of the base profile description: Organization IDP profile with a base profile and targeted overwrite rules service_policy_ewf_rule_profile2: title: service_policy_ewf_rule_profile2 enum: - critical - standard - strict type: string description: 'Enhanced web filtering profile applied by this rule. enum: `critical`, `standard`, `strict`.' service_policy_skyatp_http_inspection_profile2: title: service_policy_skyatp_http_inspection_profile2 enum: - standard - strict type: string description: 'Sky ATP HTTP inspection profile to apply. enum: `standard`, `strict`.' evpn_options_overlay2: title: evpn_options_overlay2 type: object properties: as: maximum: 65535 minimum: 1 type: integer description: Overlay BGP Local AS Number contentEncoding: int32 default: 65000 examples: - 65000 description: EVPN overlay BGP settings for the topology ap_port_config: title: ap_port_config type: object properties: disabled: type: boolean description: Whether this AP Ethernet port is disabled default: false dynamic_vlan: allOf: - $ref: '#/components/schemas/ap_port_config_dynamic_vlan2' - description: RADIUS-assigned VLAN settings for AP port authentication enable_mac_auth: type: boolean description: Whether MAC authentication is enabled on this AP port default: false forwarding: allOf: - $ref: '#/components/schemas/ap_port_config_forwarding2' - description: 'Traffic forwarding mode for this AP Ethernet port. enum: `all`, `limited`, `mxtunnel`, `site_mxedge`, `wxtunnel`.' examples: - all mac_auth_preferred: type: boolean description: When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth default: false mac_auth_protocol: allOf: - $ref: '#/components/schemas/ap_port_config_mac_auth_protocol2' - description: 'Protocol used for MAC authentication when `enable_mac_auth` is `true`. enum: `eap-md5`, `eap-peap`, `pap`.' mist_nac: allOf: - $ref: '#/components/schemas/wlan_mist_nac3' - description: Juniper Mist NAC settings used by AP port authentication mx_tunnel_id: type: string description: If `forwarding`==`mxtunnel`, vlan_ids comes from mxtunnel contentEncoding: uuid examples: - 08cd7499-5841-51c8-e663-fb16b6f3b45e mxtunnel_name: type: string description: If `forwarding`==`site_mxedge`, vlan_ids comes from site_mxedge (`mxtunnel` under site setting) port_auth: allOf: - $ref: '#/components/schemas/ap_port_config_port_auth2' - description: 'Authentication mode for this AP Ethernet port. enum: `dot1x`, `none`.' examples: - none port_vlan_id: maximum: 4094 minimum: 1 type: integer description: If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port contentEncoding: int32 examples: - 1 radius_config: allOf: - $ref: '#/components/schemas/radius_config2' - description: RADIUS authentication and accounting settings for this AP port radsec: allOf: - $ref: '#/components/schemas/radsec3' - description: TLS-secured RADIUS settings for this AP port vlan_id: maximum: 4094 minimum: 1 type: integer description: "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnel` under site setting)" contentEncoding: int32 examples: - 9 vlan_ids: type: string description: If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port examples: - 10,20,30 wxtunnel_id: type: string description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session contentEncoding: uuid examples: - 7dae216d-7c98-a51b-e068-dd7d477b7216 wxtunnel_remote_id: type: string description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session examples: - wifiguest description: Ethernet port behavior settings for an access point service_policy_ssl_proxy3: title: service_policy_ssl_proxy3 type: object properties: ciphers_category: allOf: - $ref: '#/components/schemas/ssl_proxy_ciphers_category2' - description: 'Allowed cipher strength category for SSL proxy inspection. enum: `medium`, `strong`, `weak`.' enabled: type: boolean description: Whether SSL proxy inspection is enabled for the service policy default: false description: TLS inspection settings applied by this service policy site_setting: title: site_setting type: object properties: acl_policies: type: array items: $ref: '#/components/schemas/acl_policy' description: Access control policies configured for the site acl_tags: type: object additionalProperties: $ref: '#/components/schemas/acl_tag' description: Access control tag definitions available to site policies additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands applied through the site setting allow_mist: type: boolean description: whether to allow Mist to look at this org default: false analytic: allOf: - $ref: '#/components/schemas/site_setting_analytic2' - description: Advanced analytics configuration for the site ap_matching: allOf: - $ref: '#/components/schemas/site_setting_ap_matching2' - description: Rules that apply model-specific AP port configuration ap_port_config: allOf: - $ref: '#/components/schemas/site_setting_ap_port_config2' - description: Ethernet port configuration overrides for APs at the site ap_synthetic_test: allOf: - $ref: '#/components/schemas/site_setting_ap_synthetic_test2' - description: Synthetic test configuration for APs at the site ap_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: Enable threshold-based device down delivery for AP devices only. When configured it takes effect for AP devices and `device_updown_threshold` is ignored. contentEncoding: int32 default: 0 auto_placement: allOf: - $ref: '#/components/schemas/site_setting_auto_placement2' - description: Automatic AP placement settings for the site auto_upgrade: allOf: - $ref: '#/components/schemas/site_setting_auto_upgrade2' - description: Automatic AP firmware upgrade settings for the site. Overrides org setting when provided. auto_upgrade_esl: allOf: - $ref: '#/components/schemas/site_setting_auto_upgrade_esl2' - description: Automatic ESL firmware upgrade settings for the site auto_upgrade_linecard: type: boolean description: Whether line cards are included in automatic switch upgrades default: true bgp_neighbor_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based bgp neighbor down delivery. contentEncoding: int32 blacklist_url: type: string description: Read-only URL for the site blacklist file readOnly: true examples: - https://papi.s3.amazonaws.com/blacklist/xxx... ble_config: allOf: - $ref: '#/components/schemas/ble_config3' - description: Bluetooth Low Energy configuration applied to APs at the site config_auto_revert: type: boolean description: Whether to enable ap auto config revert default: false config_push_policy: allOf: - $ref: '#/components/schemas/site_setting_config_push_policy2' - description: Policy controlling how site configuration pushes are applied created_time: type: number description: Timestamp when the site settings were created readOnly: true critical_url_monitoring: allOf: - $ref: '#/components/schemas/site_setting_critical_url_monitoring2' - description: Monitoring configuration for critical URLs at the site device_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: By default, device_updown_threshold, if set, will apply to all devices types if different values for specific device type is desired, use the following contentEncoding: int32 default: 0 dhcp_snooping: allOf: - $ref: '#/components/schemas/dhcp_snooping4' - description: Layer 2 DHCP snooping settings for the site disabled_system_defined_port_usages: type: array items: $ref: '#/components/schemas/system_defined_port_usages' description: System-defined switch port usages disabled for the site dns_servers: type: array items: type: string description: Name server addresses configured for the site dns_suffix: type: array items: type: string description: Search suffixes used for DNS lookups at the site enable_unii_4: type: boolean description: Whether UNII-4 channels are enabled for the site default: false engagement: allOf: - $ref: '#/components/schemas/site_engagement1' - description: Dwell-time analytics rules for the site evpn_options: allOf: - $ref: '#/components/schemas/evpn_options3' - description: Fabric EVPN options for the site extra_routes: type: object additionalProperties: $ref: '#/components/schemas/extra_route' description: Additional IPv4 routes configured for the site examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/extra_route6' description: Additional IPv6 routes configured for the site examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 flags: type: object additionalProperties: type: string description: Feature flags enabled for the site for_site: type: boolean description: Whether this settings object is scoped to a site readOnly: true gateway: allOf: - $ref: '#/components/schemas/gateway_template1' - description: Template settings applied to site gateways gateway_additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands applied to gateways at the site gateway_mgmt: allOf: - $ref: '#/components/schemas/gateway_mgmt3' - description: Management access settings for gateways at the site gateway_tunnel_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based gateway tunnel (secure edge tunnels) up-down delivery. contentEncoding: int32 gateway_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: Enable threshold-based device down delivery for Gateway devices only. When configured it takes effect for GW devices and `device_updown_threshold` is ignored. contentEncoding: int32 default: 0 id: type: string description: Unique value identifying the site settings object contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f iotproxy: allOf: - $ref: '#/components/schemas/iotproxy1' - description: Proxy settings for IoT traffic at the site juniper_srx: allOf: - $ref: '#/components/schemas/site_setting_juniper_srx2' - description: SRX integration settings for the site led: allOf: - $ref: '#/components/schemas/ap_led3' - description: AP LED behavior configured for the site marvis: allOf: - $ref: '#/components/schemas/marvis1' - description: AI assistant settings for Marvis at the site mist_nac: allOf: - $ref: '#/components/schemas/switch_mist_nac3' - description: Network access control settings for switches at the site modified_time: type: number description: Timestamp when the site settings were last modified readOnly: true mxedge: allOf: - $ref: '#/components/schemas/site_setting_mxedge2' - description: Site Mist Edge service settings mxedge_mgmt: allOf: - $ref: '#/components/schemas/mxedge_mgmt4' - description: Mist Edge management access settings for the site mxtunnel: allOf: - $ref: '#/components/schemas/site_mxtunnel1' - description: Site Mist Tunnel configuration networks: type: object additionalProperties: $ref: '#/components/schemas/switch_network' description: Switch network definitions configured for the site ntp_servers: type: array items: type: string description: Time synchronization server addresses configured for the site occupancy: allOf: - $ref: '#/components/schemas/site_occupancy_analytics' - description: Analytics settings for site occupancy org_id: type: string description: Identifier of the org that owns the site settings contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 ospf_areas: type: object additionalProperties: $ref: '#/components/schemas/ospf_area' description: Routing area settings for OSPF on site switches paloalto_networks: allOf: - $ref: '#/components/schemas/site_setting_paloalto_networks2' - description: Firewall integration settings for Palo Alto Networks at the site persist_config_on_device: type: boolean description: Whether to store the config on AP default: false port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Switch port mirroring settings for the site port_usages: type: object additionalProperties: $ref: '#/components/schemas/switch_port_usage' description: Switch port usage profiles available at the site proxy: allOf: - $ref: '#/components/schemas/proxy3' - description: Network proxy settings for devices at the site radio_config: allOf: - $ref: '#/components/schemas/ap_radio3' - description: AP radio configuration for the site radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config4' - description: Switch RADIUS configuration for the site remote_syslog: allOf: - $ref: '#/components/schemas/remote_syslog4' - description: Syslog forwarding settings for devices at the site remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false report_gatt: type: boolean description: Whether AP should periodically connect to BLE devices and report GATT device info (device name, manufacturer name, serial number, battery %, temperature, humidity) default: false rogue: allOf: - $ref: '#/components/schemas/site_rogue1' - description: AP threat detection settings for the site routing_policies: type: object additionalProperties: $ref: '#/components/schemas/sw_routing_policy' description: Switch routing policy definitions for the site rtsa: allOf: - $ref: '#/components/schemas/site_setting_rtsa2' - description: Managed mobility and asset tracking settings for the site simple_alert: allOf: - $ref: '#/components/schemas/simple_alert2' - description: Threshold alert settings for the site site_id: type: string description: Identifier of the site these settings apply to contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 skyatp: allOf: - $ref: '#/components/schemas/site_setting_skyatp2' - description: Threat intelligence settings from Sky ATP for the site sle_thresholds: allOf: - $ref: '#/components/schemas/sle_thresholds2' - description: Service level expectation threshold settings for the site snmp_config: allOf: - $ref: '#/components/schemas/snmp_config3' - description: Management polling settings for SNMP on site devices srx_app: allOf: - $ref: '#/components/schemas/site_setting_srx_app' - description: Juniper SRX application visibility settings for the site ssh_keys: type: array items: type: string description: Public SSH keys configured for the site ssr: allOf: - $ref: '#/components/schemas/setting_ssr2' - description: Session Smart Router settings for the site status_portal: allOf: - $ref: '#/components/schemas/site_setting_status_portal' - description: End-user status portal settings for the site switch: allOf: - $ref: '#/components/schemas/site_setting_switch2' - description: Site-level switch feature configuration switch_matching: allOf: - $ref: '#/components/schemas/switch_matching1' - description: Rules for matching switches to model-specific settings switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt4' - description: Management access settings for switches at the site switch_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: Enable threshold-based device down delivery for Switch devices only. When configured it takes effect for SW devices and `device_updown_threshold` is ignored. contentEncoding: int32 default: 0 synthetic_test: allOf: - $ref: '#/components/schemas/synthetictest_config1' - description: Active monitoring test configuration for the site track_anonymous_devices: type: boolean description: Whether to track anonymous BLE assets (requires ‘track_asset’ enabled) default: false tunterm_monitoring: type: array items: $ref: '#/components/schemas/tunterm_monitoring_item' description: Tunnel termination monitoring settings for the Mist Edges assigned to the site tunterm_monitoring_disabled: type: boolean description: Whether tunnel termination monitoring is disabled for the site default: false tunterm_multicast_config: allOf: - $ref: '#/components/schemas/site_setting_tunterm_multicast_config2' - description: Multicast settings for tunnel termination at the site uplink_port_config: allOf: - $ref: '#/components/schemas/ap_uplink_port_config3' - description: AP uplink port configuration for the site uses_description_from_port_usage: type: boolean description: by default, we only honor description provided in port_config. This allows fallback to those defined in port_usages default: false uwb_config: allOf: - $ref: '#/components/schemas/ap_uwb_config3' - description: UWB RTLS (OMLOX asset visibility) settings for the site, only effective on AP models with a UWB radio and in countries where the UWB radio is permitted. Overridden by the device profile and device-level settings vars: type: object additionalProperties: type: string description: Template variables defined for the site examples: - RADIUS_IP1: 172.31.2.5 RADIUS_SECRET: 11s64632d vars_annotations: type: object additionalProperties: $ref: '#/components/schemas/vars_annotation' description: Metadata annotations for site template variables examples: - MXTUNNEL_GUEST: type: mxtunnel_id RADIUS_IP1: note: RADIUS server IP address for US East Campus vna: allOf: - $ref: '#/components/schemas/site_setting_vna2' - description: Virtual Network Assistant settings for the site vpn_path_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based vpn path down delivery. contentEncoding: int32 vpn_peer_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based vpn peer down delivery. contentEncoding: int32 vrf_config: allOf: - $ref: '#/components/schemas/vrf_config6' - description: Routing instance configuration for the site vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/switch_vrf_instance' description: Switch VRF instances configured for the site examples: - guest: extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest vrrp_groups: type: object additionalProperties: $ref: '#/components/schemas/vrrp_group' description: High-availability VRRP group settings for the site vs_instance: type: object additionalProperties: $ref: '#/components/schemas/vs_instance_property' description: EX9200 virtual switch instance definitions for the site wan_vna: allOf: - $ref: '#/components/schemas/site_setting_wan_vna2' - description: Virtual Network Assistant settings for WAN experiences at the site watched_station_url: type: string description: Read-only URL for the watched station list file readOnly: true examples: - https://papi.s3.amazonaws.com/watched_station/xxx... whitelist_url: type: string description: Read-only URL for the site whitelist file readOnly: true examples: - https://papi.s3.amazonaws.com/whitelist/xxx... wids: allOf: - $ref: '#/components/schemas/site_wids2' - description: Wireless intrusion detection settings for the site wifi: allOf: - $ref: '#/components/schemas/site_wifi2' - description: Wireless LAN configuration settings for the site wired_vna: allOf: - $ref: '#/components/schemas/site_setting_wired_vna2' - description: Virtual Network Assistant settings for wired experiences at the site zone_occupancy_alert: allOf: - $ref: '#/components/schemas/site_zone_occupancy_alert2' - description: Occupancy alert settings for site zones description: Configuration settings applied at the site level gateway_traffic_shaping1: title: gateway_traffic_shaping1 type: object properties: class_percentages: type: array items: type: integer contentEncoding: int32 description: Traffic class bandwidth percentages for high, medium, low, and best-effort queues enabled: type: boolean description: Whether traffic shaping is enabled default: false max_tx_kbps: type: integer description: Maximum transmit bandwidth for the interface, in Kbps contentEncoding: int32 description: Traffic shaping settings applied to this VPN path tunnel_via2: title: tunnel_via2 enum: - primary - secondary type: string description: If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor site_setting_skyatp2: title: site_setting_skyatp2 type: object properties: enabled: type: boolean description: Whether Sky ATP is enabled for the site send_ip_mac_mapping: type: boolean description: Whether IP-to-MAC mappings are sent to Sky ATP default: false description: Threat intelligence settings from Sky ATP for the site radsec3: title: radsec3 type: object properties: coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled for RadSec traffic default: false enabled: type: boolean description: Whether RadSec is enabled idle_timeout: anyOf: - type: integer contentEncoding: int32 default: 60 - type: string description: Idle timeout, in seconds, for RadSec connections mxcluster_ids: type: array items: type: string contentEncoding: uuid description: Mist Edge cluster IDs used as RadSec proxies when the WLAN does not use mxtunnel proxy_hosts: type: array items: type: string description: RadSec proxy hostnames advertised to APs server_name: type: string description: TLS server name to verify against the CA certificates in Org Setting. Only if not Mist Edge. examples: - radsec.abc.com servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radsec_server' description: External RadSec servers. Only if not Mist Edge. use_mxedge: type: boolean description: Whether to use organization Mist Edge instances as RadSec proxies use_site_mxedge: type: boolean description: Whether to use site Mist Edge instances when this WLAN does not use mxtunnel default: false description: TLS-secured RADIUS settings for this AP port switch_auto_upgrade1: title: switch_auto_upgrade1 type: object properties: custom_versions: type: object additionalProperties: type: string description: Per-model switch firmware versions to use for auto-upgrade examples: - QFX5120-32C: 23.4R2-S2.1 QFX5130-32CD: 23.4R2-S2.3 enabled: type: boolean description: Whether switch auto-upgrade is enabled snapshot: type: boolean description: Whether to create a recovery snapshot during the upgrade process default: false description: Switch firmware auto-upgrade configuration network: title: network required: - name type: object properties: created_time: type: number description: Epoch timestamp when the network was created readOnly: true disallow_mist_services: type: boolean description: Whether to disallow Mist Devices in the network default: false gateway: type: string description: IPv4 gateway address for this network contentEncoding: ipv4 examples: - 192.168.70.1 gateway6: type: string description: IPv6 gateway address for this network contentEncoding: ipv6 examples: - fdad:b0bc:f29e::1 id: type: string description: Unique identifier of the network contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f internal_access: allOf: - $ref: '#/components/schemas/network_internal_access2' - description: Internal access settings for this network internet_access: allOf: - $ref: '#/components/schemas/network_internet_access2' - description: Direct internet access and NAT settings for this network isolation: type: boolean description: Whether to allow clients in the network to talk to each other modified_time: type: number description: Epoch timestamp when the network was last modified readOnly: true multicast: allOf: - $ref: '#/components/schemas/network_multicast2' - description: Settings for multicast routing on this network name: type: string description: Display name of the organization network org_id: type: string description: Organization that owns this network contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 routed_for_networks: type: array items: type: string description: Other network names this network can route to, for example through BGP, OSPF or static routes subnet: type: string description: IPv4 subnet CIDR for this network examples: - 192.168.70.0/24 subnet6: type: string description: IPv6 subnet CIDR for this network examples: - fdad:b0bc:f29e::/32 tenants: type: object additionalProperties: $ref: '#/components/schemas/network_tenant' description: Tenant address mappings associated with this network vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID or variable associated with this network vpn_access: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_config' description: VPN access settings keyed by VPN name for this network description: Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates gw_routing_policy_term_action2: title: gw_routing_policy_term_action2 type: object properties: accept: type: boolean description: Whether to accept routes that match this term. Precedence is `accept` > `next_term` > `next_policy`; routes are rejected if all three are false add_community: type: array items: type: string description: BGP communities to add to routes that match this term add_target_vrfs: type: array items: type: string description: SSR target VRFs to add when leaking routes from hub to spoke community: type: array items: type: string description: BGP communities to set when this term is used as an export policy exclude_as_path: type: array items: type: string description: AS path values to exclude when this term is used as an export policy exclude_community: type: array items: type: string description: BGP communities to exclude from routes that match this term export_communities: type: array items: type: string description: BGP communities allowed for export when this term is used as an export policy local_preference: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Preference value to set when this term is used as an import policy next_policy: type: boolean description: When true, continue evaluating the next routing policy in the chain after this term matches; default is false default: false next_term: type: boolean description: When true, continue evaluating the next term in the same routing policy after this term matches; default is false default: false prepend_as_path: type: array items: type: string description: AS path values to prepend when this term is used as an export policy description: Policy actions applied when this routing policy term matches site_mxtunnel_additional_mxtunnel: title: site_mxtunnel_additional_mxtunnel type: object properties: clusters: type: array items: $ref: '#/components/schemas/site_mxtunnel_cluster' description: Tunnel peer clusters used by APs for this additional Mist Tunnel hello_interval: maximum: 300 minimum: 1 type: integer description: In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by hello_retries contentEncoding: int32 default: 60 examples: - 60 hello_retries: maximum: 30 minimum: 2 type: integer description: Number of missed hello heartbeats before an AP tries another tunnel peer contentEncoding: int32 default: 7 examples: - 3 protocol: allOf: - $ref: '#/components/schemas/site_mxtunnel_protocol2' - description: 'Encapsulation protocol used for this additional Mist Tunnel. enum: `ip`, `udp`.' examples: - udp vlan_ids: type: array items: type: integer contentEncoding: int32 description: List of VLAN IDs carried by this additional Mist Tunnel examples: - - 300 - 310 - 320 description: Additional named Mist Tunnel configuration for a site site_wifi_proxy_arp2: title: site_wifi_proxy_arp2 enum: - default - disabled - enabled type: string description: 'ARP proxy mode for site Wi-Fi. enum: `default`, `disabled`, `enabled`.' vrrp_group_network: title: vrrp_group_network type: object properties: ip: type: string description: Virtual IP address used by the VRRP group on this network description: Virtual IP assignment for a VRRP network tunnel_provider_options_prisma2: title: tunnel_provider_options_prisma2 type: object properties: service_account_name: type: string description: For prisma-ipsec, service account name to used for tunnel auto provisioning examples: - sa1@1823425211 description: Palo Alto Prisma Access provisioning options for tunnel endpoints ospf_area_network_auth_type2: title: ospf_area_network_auth_type2 enum: - md5 - none - password type: string description: 'Authentication method used by this OSPF network. enum: `md5`, `none`, `password`.' examples: - md5 network_multicast2: title: network_multicast2 type: object properties: disable_igmp: type: boolean description: If the network will only be the source of the multicast traffic, IGMP can be disabled default: false enabled: type: boolean description: Whether multicast support is enabled for this network default: false groups: type: object additionalProperties: $ref: '#/components/schemas/network_multicast_group' description: Multicast group-to-RP mappings for this network description: Settings for multicast routing on this network bgp_config_neighbors: title: bgp_config_neighbors required: - neighbor_as type: object properties: disabled: type: boolean description: If true, the BGP session to this neighbor will be administratively disabled/shutdown default: false export_policy: type: string description: Export policy applied only to this BGP neighbor hold_time: maximum: 65535 minimum: 0 type: integer description: BGP hold time for this neighbor, in seconds contentEncoding: int32 default: 90 import_policy: type: string description: Import policy applied only to this BGP neighbor multihop_ttl: maximum: 255 minimum: 0 type: integer description: Assuming BGP neighbor is directly connected contentEncoding: int32 neighbor_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Autonomous System (AS) number of this BGP neighbor examples: - '65000' tunnel_via: allOf: - $ref: '#/components/schemas/tunnel_via2' - description: If `via`==`tunnel`, primary or secondary tunnel associated with this BGP neighbor description: Per-neighbor BGP session settings gateway_port_config_ip_config2: title: gateway_port_config_ip_config2 type: object properties: dns: type: array items: type: string description: Resolver server IP addresses used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0 dns_suffix: type: array items: type: string description: DNS search suffixes used by this interface, except on out-of-band interfaces such as vme, em0, or fxp0 gateway: type: string description: Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IP address (i.e. "192.168.1.1") or a Variable (i.e. "{{myvar}}") examples: - 192.168.1.1 gateway6: type: string description: Except for out-of_band interface (vme/em0/fxp0). Interface Default Gateway IPv6 Address (i.e. "2001:db8::1") or a Variable (i.e. "{{myvar}}") examples: - 2001:db8::1 ip: type: string description: Interface IP address (i.e. "192.168.1.8") or a Variable (i.e. "{{myvar}}") contentEncoding: ipv4 examples: - 192.168.1.8 ip6: type: string description: Interface IPv6 Address (i.e. "2001:db8::123") or a Variable (i.e. "{{myvar}}") contentEncoding: ipv6 examples: - 2001:db8::123 netmask: type: string description: Used only if `subnet` is not specified in `networks`. Interface Netmask (i.e. "/24") or a Variable (i.e. "{{myvar}}") examples: - /24 netmask6: type: string description: Used only if `subnet` is not specified in `networks`. Interface IPv6 Netmask (i.e. "/64") or a Variable (i.e. "{{myvar}}") examples: - /64 network: type: string description: Optional, the network to be used for mgmt poser_password: type: string description: Password used for PPPoE when `type`==`pppoe` contentEncoding: password pppoe_auth: allOf: - $ref: '#/components/schemas/gateway_wan_ppoe_auth2' - description: 'Authentication protocol used for PPPoE when `type`==`pppoe`. enum: `chap`, `none`, `pap`.' pppoe_username: type: string description: Username used for PPPoE when `type`==`pppoe` type: allOf: - $ref: '#/components/schemas/gateway_wan_type2' - description: 'IPv4 assignment mode for this gateway port interface. enum: `dhcp`, `pppoe`, `static`.' type6: allOf: - $ref: '#/components/schemas/gateway_wan_type62' - description: 'IPv6 assignment mode for this gateway port interface. enum: `autoconf`, `dhcp`, `static`.' description: Layer 3 IP configuration for the port tunnel_config_node3: title: tunnel_config_node3 required: - hosts - wan_names type: object properties: hosts: type: array items: type: string description: Remote gateway host addresses for this tunnel node internal_ip6s: uniqueItems: true type: array items: type: string description: IPv6 addresses configured on this tunnel node internal_ips: type: array items: type: string description: Internal IP addresses configured on this tunnel node probe_hostnames: uniqueItems: true type: array items: type: string description: Hostnames used as ICMP probe destinations for this tunnel node; applicable for both IPv4 and IPv6 probe_http: allOf: - $ref: '#/components/schemas/tunnel_config_node_probe_http2' - description: HTTP probe settings for this tunnel node; success from any ICMP or HTTP probe indicates the tunnel is up probe_ip6s: uniqueItems: true type: array items: type: string description: IPv6 ICMP probe addresses used to monitor this tunnel node probe_ips: uniqueItems: true type: array items: type: string description: Health-check IP addresses used to monitor this tunnel node remote_ids: type: array items: type: string description: IKE identities expected from this tunnel node wan_names: type: array items: type: string description: Interface names that source tunnel traffic for this node description: Main remote tunnel endpoint settings gateway_mgmt_auto_signature_update2: title: gateway_mgmt_auto_signature_update2 type: object properties: day_of_week: allOf: - $ref: '#/components/schemas/day_of_week1' - description: 'Scheduled weekday for automatic signature updates. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' enable: type: boolean description: Whether automatic security signature updates are enabled default: true time_of_day: type: string description: Optional, Mist will decide the timing description: Schedule for automatic security signature updates gw_routing_policy_term: title: gw_routing_policy_term type: object properties: actions: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_action2' - description: Policy actions applied when this routing policy term matches matching: allOf: - $ref: '#/components/schemas/gw_routing_policy_term_matching2' - description: Route match criteria that must be satisfied before actions are applied description: Gateway routing policy term with match criteria and actions switch_port_usage_mac_auth_protocol2: title: switch_port_usage_mac_auth_protocol2 enum: - eap-md5 - eap-peap - pap type: string description: 'Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled. enum: `eap-md5`, `eap-peap`, `pap`.' gateway_matching2: title: gateway_matching2 type: object properties: enable: type: boolean description: Whether gateway matching is enabled rules: uniqueItems: true type: array items: $ref: '#/components/schemas/gateway_matching_rule' description: Gateway matching rules evaluated for this configuration description: Matching rules that select gateways for this template snmpv3_config_notify_filter_item_content: title: snmpv3_config_notify_filter_item_content type: object properties: include: type: boolean description: Whether the matching OID subtree is included oid: type: string description: Matched OID subtree for this notification filter rule examples: - 1.3.6.1.4.1 description: OID filter rule for an SNMPv3 notification profile remote_syslog_user: title: remote_syslog_user type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities logged for this user rule match: type: string description: Expression used to filter user log messages examples: - '"!alarm|ntp|errors.crc_error[chan]"' user: type: string description: Account name or wildcard matched by this syslog rule examples: - '*' description: User-specific syslog logging rule ssr_proxy2: title: ssr_proxy2 type: object properties: disabled: type: boolean description: Whether the SSR proxy configuration is disabled default: false examples: - true url: type: string description: Proxy URL that SSR devices use to reach Mist examples: - https://proxy.corp.com:8080/ description: Network proxy settings used by SSR devices to reach Mist switch_stp_config2: title: switch_stp_config2 type: object properties: bridge_priority: type: string description: Switch STP priority. Range [0, 4k, 8k.. 60k] in steps of 4k. Bridge priority applies to both VSTP and RSTP. default: 32k examples: - 40k description: Spanning Tree Protocol configuration applied when this matching rule matches service_policy: title: service_policy type: object properties: action: allOf: - $ref: '#/components/schemas/allow_deny2' - description: Allow or deny action for traffic matched by this service policy antivirus: allOf: - $ref: '#/components/schemas/service_policy_antivirus1' - description: Malware and virus inspection settings applied by this service policy appqoe: allOf: - $ref: '#/components/schemas/service_policy_appqoe1' - description: Application QoE settings applied by this service policy ewf: type: array items: $ref: '#/components/schemas/service_policy_ewf_rule' description: Enhanced web filtering rules applied by this service policy idp: allOf: - $ref: '#/components/schemas/idp_config2' - description: Intrusion detection and prevention settings applied by this service policy local_routing: type: boolean description: Whether the policy permits access within the same VRF name: type: string description: Display name of the service policy path_preference: type: string description: By default, we derive all paths available and use them. Optionally, you can customize by using `path_preference` secintel: allOf: - $ref: '#/components/schemas/service_policy_secintel3' - description: Threat intelligence settings applied by this service policy servicepolicy_id: type: string description: Organization-level service policy identifier used to link and override selected attributes contentEncoding: uuid services: uniqueItems: true type: array items: type: string description: Application services or service groups matched by this policy skyatp: allOf: - $ref: '#/components/schemas/service_policy_skyatp2' - description: Threat inspection settings provided by Sky ATP for this service policy ssl_proxy: allOf: - $ref: '#/components/schemas/service_policy_ssl_proxy3' - description: TLS inspection settings applied by this service policy syslog: allOf: - $ref: '#/components/schemas/service_policy_syslog2' - description: Remote logging settings applied by this service policy tenants: uniqueItems: true type: array items: type: string description: User or network tenants matched by this service policy description: Site-level service policy that allows or denies traffic for tenants and services site_setting_analytic2: title: site_setting_analytic2 type: object properties: enabled: type: boolean description: Enable Advanced Analytic feature (using SUB-ANA license) default: false description: Advanced analytics configuration for the site snmp_vacm_security_model2: title: snmp_vacm_security_model2 enum: - usm - v1 - v2c type: string description: 'Required security model for these VACM group mappings. enum: `usm`, `v1`, `v2c`.' ap_radio_band51: title: ap_radio_band51 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 5 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 5 GHz radio contentEncoding: int32 default: 0 antenna_beam_pattern: allOf: - $ref: '#/components/schemas/radio_band_antenna_beam_pattern3' - description: 'Beam pattern used by the 5 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode1' - description: 'Radio chain mode for the 5 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth52' - description: 'Channel width configured for the 5 GHz radio. enum: `0`, `20`, `40`, `80`.' examples: - 40 channel: type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 100 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 6 power_max: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble1' - description: '802.11 preamble mode used by the 5 GHz radio. enum: `auto`, `long`, `short`.' description: 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode tunnel_provider_options_zscaler2: title: tunnel_provider_options_zscaler2 type: object properties: aup_block_internet_until_accepted: type: boolean description: Whether Zscaler blocks internet access until the Acceptable Use Policy is accepted default: false aup_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display Acceptable Use Policy (AUP) default: false aup_force_ssl_inspection: type: boolean description: Proxy HTTPs traffic, requiring Zscaler cert to be installed in browser default: false aup_timeout_in_days: maximum: 180 minimum: 1 type: integer description: Required if `aup_enabled`==`true`. Days before AUP is requested again contentEncoding: int32 auth_required: type: boolean description: Enable this option to enforce user authentication default: false caution_enabled: type: boolean description: Can only be `true` when `auth_required`==`false`, display caution notification for non-authenticated users default: false dn_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 idle_time_in_minutes: maximum: 43200 minimum: 0 type: integer description: Required if `surrogate_IP`==`true`, idle Time to Disassociation contentEncoding: int32 ofw_enabled: type: boolean description: If `true`, enable the firewall control option default: false sub_locations: type: array items: $ref: '#/components/schemas/tunnel_provider_options_zscaler_sub_location' description: Per-network Zscaler sub-location settings surrogate_IP: type: boolean description: Can only be `true` when `auth_required`==`true`. Map a user to a private IP address so it applies the user's policies, instead of the location's policies default: false surrogate_IP_enforced_for_known_browsers: type: boolean description: Can only be `true` when `surrogate_IP`==`true`, enforce surrogate IP for known browsers surrogate_refresh_time_in_minutes: maximum: 43200 minimum: 1 type: integer description: Required if `surrogate_IP_enforced_for_known_browsers`==`true`, must be lower or equal than `idle_time_in_minutes`, refresh Time for re-validation of Surrogacy contentEncoding: int32 up_bandwidth: maximum: 99999 minimum: 0.1 type: - number - 'null' description: Download bandwidth cap of the link, in Mbps. Disabled if not set examples: - 200 xff_forward_enabled: type: boolean description: Location uses proxy chaining to forward traffic default: false description: Provider settings for Zscaler tunnel endpoints ospf_area_network_interface_type2: title: ospf_area_network_interface_type2 enum: - broadcast - nbma - p2mp - p2p type: string description: 'OSPF interface type used for this network. enum: `broadcast`, `nbma`, `p2mp`, `p2p`.' switch_mgmt2: title: switch_mgmt2 type: object properties: ap_affinity_threshold: type: integer description: AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used. contentEncoding: int32 default: 10 cli_banner: type: string description: Set Banners for switches. Allows markup formatting examples: - \t\tWELCOME! cli_idle_timeout: maximum: 60 minimum: 1 type: integer description: Sets timeout for switches contentEncoding: int32 config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 dhcp_option_fqdn: type: boolean description: Enable to provide the FQDN with DHCP option 81 default: false disable_oob_down_alarm: type: boolean description: Whether to suppress alarms when the switch out-of-band management interface is down fips_enabled: type: boolean description: Whether FIPS mode is enabled on the switch default: false local_accounts: type: object additionalProperties: $ref: '#/components/schemas/config_switch_local_accounts_user' description: Local switch user accounts keyed by username mxedge_proxy_host: type: string description: IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud mxedge_proxy_port: anyOf: - maximum: 65535 minimum: 1 type: integer contentEncoding: int32 default: 2222 - type: string description: Mist Edge proxy port used for switch management traffic protect_re: allOf: - $ref: '#/components/schemas/protect_re3' - description: Control-plane protection settings for the switch radius: allOf: - $ref: '#/components/schemas/switch_radius2' - description: Management authentication settings using RADIUS remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false root_password: type: string description: Root password for local switch access contentEncoding: password tacacs: allOf: - $ref: '#/components/schemas/tacacs2' - description: Management authentication settings using TACACS+ use_mxedge_proxy: type: boolean description: Whether to use Mist Edge as a proxy for switch management traffic description: Management-plane settings applied when this matching rule matches simple_alert_arp_failure: title: simple_alert_arp_failure type: object properties: client_count: type: integer description: Number of distinct clients that must encounter ARP failures before alerting contentEncoding: int32 default: 10 duration: maximum: 60 minimum: 5 type: integer description: Time window in minutes for evaluating ARP failures contentEncoding: int32 default: 20 incident_count: type: integer description: Number of ARP failure incidents required within the duration window contentEncoding: int32 default: 10 description: Thresholds for ARP failure heuristic alerts protect_re3: title: protect_re3 type: object properties: allowed_services: type: array items: $ref: '#/components/schemas/protect_re_allowed_service' description: Built-in services explicitly allowed by the Protect RE policy examples: - - icmp - ssh custom: type: array items: $ref: '#/components/schemas/protect_re_custom' description: Additional ACL entries allowed by the Protect RE policy enabled: type: boolean description: "When enabled, all traffic that is not essential to our operation will be dropped\ne.g. ntp / dns / traffic to mist will be allowed by default\n if dhcpd is enabled, we'll make sure it works" default: false hit_count: type: boolean description: Whether to enable hit count for Protect_RE policy default: false trusted_hosts: type: array items: type: string description: Trusted host or subnet entries allowed by the Protect RE policy description: Control-plane protection settings for the switch config_switch_local_accounts_user_role2: title: config_switch_local_accounts_user_role2 enum: - admin - helpdesk - none - read type: string description: 'Access role granted to the local switch user account. enum: `admin`, `helpdesk`, `none`, `read`.' site_setting_tunterm_multicast_config_mdns2: title: site_setting_tunterm_multicast_config_mdns2 type: object properties: enabled: type: boolean description: Whether mDNS multicast forwarding is enabled default: false vlan_ids: type: array items: type: integer contentEncoding: int32 description: VLAN IDs where mDNS multicast forwarding is enabled examples: - - 2 - 3 - 5 description: Multicast DNS forwarding settings for tunneled VLANs synthetictest_config_aggressiveness1: title: synthetictest_config_aggressiveness1 enum: - auto - high - med - low type: string description: 'Probe aggressiveness level for this custom synthetic probe. enum: `auto`, `high`, `med`, `low`.' switch_mgmt3: title: switch_mgmt3 type: object properties: ap_affinity_threshold: type: integer description: AP affinity threshold for switch management. If set in both site settings and organization settings, the site setting value is used. contentEncoding: int32 default: 10 cli_banner: type: string description: Set Banners for switches. Allows markup formatting examples: - \t\tWELCOME! cli_idle_timeout: maximum: 60 minimum: 1 type: integer description: Sets timeout for switches contentEncoding: int32 config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 dhcp_option_fqdn: type: boolean description: Enable to provide the FQDN with DHCP option 81 default: false disable_oob_down_alarm: type: boolean description: Whether to suppress alarms when the switch out-of-band management interface is down fips_enabled: type: boolean description: Whether FIPS mode is enabled on the switch default: false local_accounts: type: object additionalProperties: $ref: '#/components/schemas/config_switch_local_accounts_user' description: Local switch user accounts keyed by username mxedge_proxy_host: type: string description: IP address or FQDN of the Mist Edge used to proxy the switch management traffic to the Mist Cloud mxedge_proxy_port: anyOf: - maximum: 65535 minimum: 1 type: integer contentEncoding: int32 default: 2222 - type: string description: Mist Edge proxy port used for switch management traffic protect_re: allOf: - $ref: '#/components/schemas/protect_re3' - description: Control-plane protection settings for the switch radius: allOf: - $ref: '#/components/schemas/switch_radius2' - description: Management authentication settings using RADIUS remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false root_password: type: string description: Root password for local switch access contentEncoding: password tacacs: allOf: - $ref: '#/components/schemas/tacacs2' - description: Management authentication settings using TACACS+ use_mxedge_proxy: type: boolean description: Whether to use Mist Edge as a proxy for switch management traffic description: Management-plane defaults provided by this network template remote_syslog2: title: remote_syslog2 type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive3' - description: Retention settings for generated syslog archive files cacerts: type: array items: type: string description: CA certificates used to verify TLS syslog servers examples: - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' - '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----' console: allOf: - $ref: '#/components/schemas/remote_syslog_console2' - description: Log forwarding filters for console messages sent to remote syslog enabled: type: boolean description: Whether remote syslog forwarding is enabled default: false files: type: array items: $ref: '#/components/schemas/remote_syslog_file_config' description: Local syslog file definitions to generate and forward network: type: string description: Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip` examples: - default send_to_all_servers: type: boolean description: Whether each log entry is sent to all configured remote syslog servers default: false servers: type: array items: $ref: '#/components/schemas/remote_syslog_server' description: Remote syslog server destinations examples: - - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: allOf: - $ref: '#/components/schemas/remote_syslog_time_format2' - description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond users: type: array items: $ref: '#/components/schemas/remote_syslog_user' description: User-specific syslog logging rules description: Remote syslog defaults provided by this network template tunnel_provider_options2: title: tunnel_provider_options2 type: object properties: jse: allOf: - $ref: '#/components/schemas/tunnel_provider_options_jse2' - description: Juniper Secure Edge provisioning options for tunnel endpoints prisma: allOf: - $ref: '#/components/schemas/tunnel_provider_options_prisma2' - description: Palo Alto Prisma Access provisioning options for tunnel endpoints zscaler: allOf: - $ref: '#/components/schemas/tunnel_provider_options_zscaler2' - description: Provider settings for Zscaler tunnel endpoints description: Provider-specific tunnel options defined by this gateway template switch_port_usage_duplex2: title: switch_port_usage_duplex2 enum: - auto - full - half type: string description: 'Only if `mode`!=`dynamic`. Link duplex mode for this port usage. enum: `auto`, `full`, `half`.' junos_port_config: title: junos_port_config required: - usage type: object properties: ae_disable_lacp: type: boolean description: To disable LACP support for the AE interface ae_idx: type: integer description: Users could force to use the designated AE name contentEncoding: int32 ae_lacp_force_up: type: boolean description: 'If `aggregated`==`true`, sets the state of the interface as UP when the peer has limited LACP capability. Use case: When a device connected to this AE port is ZTPing for the first time, it will not have LACP configured on the other end. **Note:** Turning this on will enable force-up on one of the interfaces in the bundle only' default: false ae_lacp_passive: type: boolean description: If `aggregated`==`true`, sets LACP to passive mode on this AE interface; by default, active (fast) mode is used default: false ae_lacp_slow: type: boolean description: To use slow timeout aggregated: type: boolean description: Whether this port is configured as an aggregated Ethernet member default: false critical: type: boolean description: To generate port up/down alarm default: false description: type: string description: Human-readable description for this Junos port disable_autoneg: type: boolean description: If `speed` and `duplex` are specified, whether to disable autonegotiation default: false duplex: allOf: - $ref: '#/components/schemas/junos_port_config_duplex2' - description: 'Link duplex mode for this Junos port. enum: `auto`, `full`, `half`.' dynamic_usage: type: - string - 'null' description: Enable dynamic usage for this port. Set to `dynamic` to enable. esilag: type: boolean description: Whether this Junos port participates in an ESI-LAG mtu: type: integer description: Media maximum transmission unit (MTU) is the largest data unit that can be forwarded without fragmentation contentEncoding: int32 default: 1514 networks: type: array items: type: string description: List of network names. Required if `usage`==`inet` no_local_overwrite: type: boolean description: Prevent helpdesk to override the port config default: true poe_disabled: type: boolean description: Whether PoE capabilities are disabled for this Junos port default: false port_network: type: string description: Required if `usage`==`vlan_tunnel`. Q-in-Q tunneling using All-in-one bundling. This also enables standard L2PT for interfaces that are not encapsulation tunnel interfaces and uses MAC rewrite operation. [View more information](https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/q-in-q.html#id-understanding-qinq-tunneling-and-vlan-translation) speed: allOf: - $ref: '#/components/schemas/junos_port_config_speed1' - description: 'Link speed for this Junos port. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' usage: type: string description: Port usage name. For Q-in-Q, use `vlan_tunnel`. If EVPN is used, use `evpn_uplink`or `evpn_downlink` description: Junos switch port configuration snmpv3_config_target_address_item: title: snmpv3_config_target_address_item type: object properties: address: type: string description: IP address or hostname of the SNMP target examples: - 10.11.0.2 address_mask: type: string description: Mask applied to the SNMP target address examples: - 255.255.255.0 port: type: - string - 'null' description: UDP port used by the SNMP target default: '161' tag_list: type: string description: Set of notification tags for this target address; use spaces between multiple tags target_address_name: type: string description: Name of the SNMP target address entry examples: - target_address_name target_parameters: type: string description: Target parameter profile referenced by this target address description: SNMPv3 notification target address entry switch_bgp_config_hold_time_zero: title: switch_bgp_config_hold_time_zero const: 0 type: integer description: BGP hold time value of 0 response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response tunnel_config_enc_algo3: title: tunnel_config_enc_algo3 enum: - 3des - aes128 - aes256 - aes_gcm128 - aes_gcm256 type: string description: 'Cipher algorithm used by this IKE proposal. enum: `3des`, `aes128`, `aes256`, `aes_gcm128`, `aes_gcm256`.' switch_bgp_config_type2: title: switch_bgp_config_type2 enum: - external - internal type: string description: 'BGP session type for this switch BGP configuration. enum: `external`, `internal`.' service_policy_secintel_profile2: title: service_policy_secintel_profile2 enum: - default - standard - strict type: string description: 'Protection level applied by SecIntel inspection. enum: `default`, `standard`, `strict`.' site_setting_juniper_srx2: title: site_setting_juniper_srx2 type: object properties: auto_upgrade: allOf: - $ref: '#/components/schemas/juniper_srx_auto_upgrade2' - description: SRX auto-upgrade settings applied when SRX devices are onboarded gateways: type: array items: $ref: '#/components/schemas/site_setting_juniper_srx_gateway' description: SRX gateways integrated with this site send_mist_nac_user_info: type: boolean description: Whether Mist NAC user information is sent to Juniper SRX gateways description: SRX integration settings for the site service_policy_skyatp2: title: service_policy_skyatp2 type: object properties: dns_dga_detection: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_dga_detection2' - description: Detection settings for DNS DGA threats provided by Sky ATP dns_tunnel_detection: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_tunnel_detection2' - description: Detection settings for DNS tunneling threats provided by Sky ATP http_inspection: allOf: - $ref: '#/components/schemas/service_policy_skyatp_http_inspection2' - description: Web traffic inspection settings provided by Sky ATP iot_device_policy: allOf: - $ref: '#/components/schemas/service_policy_skyatp_iot_device_policy2' - description: Device threat policy settings provided by Sky ATP for IoT clients description: Threat inspection settings provided by Sky ATP for this service policy mac_addresses: title: mac_addresses required: - macs type: object properties: macs: minItems: 1 uniqueItems: true type: array items: type: string description: List of MAC addresses included in the request examples: - - 683b679ac024 description: Request containing one or more MAC addresses gateway_wan_type62: title: gateway_wan_type62 enum: - autoconf - dhcp - static type: string description: 'IPv6 assignment mode for this gateway port interface. enum: `autoconf`, `dhcp`, `static`.' service_policy_skyatp_dns_dga_detection2: title: service_policy_skyatp_dns_dga_detection2 type: object properties: enabled: type: boolean description: Whether Sky ATP DNS DGA detection is enabled profile: allOf: - $ref: '#/components/schemas/service_policy_skyatp_dns_dga_detection_profile2' - description: 'Sky ATP DNS DGA detection profile to apply. enum: `default`, `standard`, `strict`.' description: Detection settings for DNS DGA threats provided by Sky ATP sw_routing_policy_term: title: sw_routing_policy_term required: - name type: object properties: actions: allOf: - $ref: '#/components/schemas/sw_routing_policy_term_action2' - description: Policy actions applied when this routing policy term matches matching: allOf: - $ref: '#/components/schemas/sw_routing_policy_term_matching2' - description: Route match criteria that must be satisfied before actions are applied name: type: string description: Display name of the switch routing policy term description: Switch routing policy term with match criteria and actions dhcpd_config_type2: title: dhcpd_config_type2 enum: - local - none - relay type: string description: 'IPv4 DHCP mode for this network. enum: `local`, `none`, `relay`.' synthetictest_config_wan_speedtest2: title: synthetictest_config_wan_speedtest2 type: object properties: enabled: type: boolean description: Whether scheduled WAN speedtests are enabled time_of_day: type: string description: Scheduled time of day for WAN speedtests default: any examples: - 720 description: WAN speedtest settings for synthetic tests synthetictest_config_aggressiveness3: title: synthetictest_config_aggressiveness3 enum: - auto - high - med - low type: string description: 'Overall aggressiveness level for synthetic test probes. enum: `auto`, `high`, `med`, `low`.' site_setting_vna2: title: site_setting_vna2 type: object properties: enabled: type: boolean description: Enable Virtual Network Assistant (using SUB-VNA license). This applied to AP / Switch / Gateway default: false description: Virtual Network Assistant settings for the site ap_uwb_config_type: title: ap_uwb_config_type const: zigpos type: string description: 'UWB integration type. enum: `zigpos`' snmpv3_config_target_param_security_model2: title: snmpv3_config_target_param_security_model2 enum: - usm - v1 - v2c type: string description: 'Required security model for this target parameter profile. enum: `usm`, `v1`, `v2c`.' iotproxy1: title: iotproxy1 type: object properties: enabled: type: boolean description: Whether the site IoT proxy is enabled default: false visionline: allOf: - $ref: '#/components/schemas/iotproxy_visionline2' - description: Site access-control integration settings for Visionline description: Proxy settings for IoT traffic at the site snmpv3_config_notify_filter_item: title: snmpv3_config_notify_filter_item type: object properties: categories: type: array items: type: string description: CX only. List of SNMP trap group categories included in this filter profile. See https://www.juniper.net/documentation/software/topics/task/configuration/snmp-trap-groups-configuring-junos-nm.html for valid category names. examples: - - link - authentication contents: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_filter_item_content' description: OID filter rules in this notification filter profile profile_name: type: string description: Notification filter profile name description: SNMPv3 notification filter profile ap_port_config_dynamic_vlan_type2: title: ap_port_config_dynamic_vlan_type2 enum: - airespace-interface-name - standard type: string description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS. enum: `airespace-interface-name`, `standard`.' protect_re_custom_protocol2: title: protect_re_custom_protocol2 enum: - any - icmp - tcp - udp type: string description: 'Transport protocol matched by this custom Protect RE ACL. enum: `any`, `icmp`, `tcp`, `udp`.' snmp_vacm_access_item_type2: title: snmp_vacm_access_item_type2 enum: - context_prefix - default_context_prefix type: string description: 'VACM context matching type for this access rule. enum: `context_prefix`, `default_context_prefix`.' proxy3: title: proxy3 type: object properties: disabled: type: boolean description: Whether this proxy configuration is disabled default: false examples: - true url: type: string description: Proxy URL used to reach Mist examples: - https://proxy.corp.com:8080/ description: Network proxy settings for devices at the site sw_routing_policy_term_matching2: title: sw_routing_policy_term_matching2 type: object properties: as_path: type: array items: $ref: '#/components/schemas/bgp_as' description: AS path values that routes must match community: type: array items: type: string description: BGP communities that routes must match prefix: type: array items: type: string description: Route prefixes that routes must match protocol: type: array items: $ref: '#/components/schemas/sw_routing_policy_term_matching_protocol_enum' description: Routing protocols that routes must match description: Route match criteria that must be satisfied before actions are applied ip_type12: title: ip_type12 enum: - dhcp - static type: string description: 'IP assignment mode for out-of-band switch management. enum: `dhcp`, `static`.' examples: - static remote_syslog_facility3: title: remote_syslog_facility3 enum: - any - authorization - change-log - config - conflict-log - daemon - dfc - external - firewall - ftp - interactive-commands - kernel - ntp - pfe - security - user type: string description: 'Syslog facility to match for this selector. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config snmp_vacm_access_item_prefix_list_item: title: snmp_vacm_access_item_prefix_list_item type: object properties: context_prefix: type: string description: Context prefix for this VACM access rule. Required only if `type`==`context_prefix` examples: - iil notify_view: type: string description: Notify view name referenced by this VACM access rule examples: - all read_view: type: string description: Read view name referenced by this VACM access rule examples: - all security_level: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item_level2' - description: 'Required security level for this VACM access rule. enum: `authentication`, `none`, `privacy`.' security_model: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item_model2' - description: 'Required security model for this VACM access rule. enum: `any`, `usm`, `v1`, `v2c`.' type: allOf: - $ref: '#/components/schemas/snmp_vacm_access_item_type2' - description: 'VACM context matching type for this access rule. enum: `context_prefix`, `default_context_prefix`.' write_view: type: string description: Write view name referenced by this VACM access rule examples: - all description: Context prefix rule for a VACM access entry radio_band_antenna_mode2: title: radio_band_antenna_mode2 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Radio chain mode for the 6 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default mxcluster_nac_client_ip: title: mxcluster_nac_client_ip type: object properties: require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Client-specific shared secret, if different from the cluster default site_id: type: string description: Present only for third-party clients, identifies the associated site contentEncoding: uuid examples: - 00000000-0000-0000-1234-000000000000 vendor: allOf: - $ref: '#/components/schemas/mxcluster_nac_client_vendor2' - description: 'RADIUS client vendor profile for this IP or subnet. enum: `aruba`, `cisco-aironet`, `cisco-dnac`, `cisco-ios`, `cisco-meraki`, `brocade`, `generic`, `juniper`, `paloalto`.' examples: - cisco-ios description: Mist NAC client settings for a RADIUS client IP or subnet gateway_port_config_wan_speedtest_mode2: title: gateway_port_config_wan_speedtest_mode2 enum: - auto - enabled - disabled type: string description: 'Controls whether Marvis or the scheduler can run speed tests on this WAN port. enum: `auto`, `enabled`, `disabled`.' examples: - auto bgp_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: BGP AS, value in range 1-4294967294. Can be a Variable (e.g. `{{bgp_as}}` ) examples: - '65000' radio_band_antenna_mode4: title: radio_band_antenna_mode4 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Radio chain mode for the 2.4 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default dot11_bandwidth62: title: dot11_bandwidth62 enum: - 0 - 20 - 40 - 80 - 160 type: integer description: 'Channel width configured for the 6 GHz radio. enum: `0`, `20`, `40`, `80`, `160`.' examples: - 80 junos_port_config_speed1: title: junos_port_config_speed1 enum: - 10m - 100m - 1g - 2.5g - 5g - 10g - 25g - 40g - 100g - auto type: string description: 'Link speed for this Junos port. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' switch_multicast_config3: title: switch_multicast_config3 type: object properties: anycast_rp: type: boolean description: When `true`, auto-generates a shared RP on `is_l3_border` devices (ERB/IPClos topologies only) default: false rp_ip: type: string description: RP address used when `anycast_rp`==`false`. If the address matches a device SVI, it is configured as a local RP; otherwise a static RP is configured examples: - 10.2.1.10 sbd_subnet: type: string description: SBD IRB subnet; Mist auto-assigns per-device IPs from this range (EVPN eOISM only) examples: - 10.99.0.0/24 sbd_vlan_id: type: integer description: Supplemental Bridge Domain VLAN ID (EVPN topology / eOISM only) contentEncoding: int32 examples: - 3900 description: Multicast configuration for this VRF instance. PIM is automatically enabled when any network in this VRF has `multicast.enabled`==`true` gateway_wan_type2: title: gateway_wan_type2 enum: - dhcp - pppoe - static type: string description: 'IPv4 assignment mode for this gateway port interface. enum: `dhcp`, `pppoe`, `static`.' synthetictest_config_custom_probe: title: synthetictest_config_custom_probe type: object properties: aggressiveness: allOf: - $ref: '#/components/schemas/synthetictest_config_aggressiveness1' - description: 'Probe aggressiveness level for this custom synthetic probe. enum: `auto`, `high`, `med`, `low`.' target: type: string description: Can be URL (e.g. http://x.com, https://x.com:8080/path/to/resource), IP address, or IP:port combination examples: - 10.3.5.3:8080 threshold: type: integer description: Response-time threshold for this custom probe, in milliseconds contentEncoding: int32 examples: - 100 type: allOf: - $ref: '#/components/schemas/synthetictest_config_custom_probe_type3' - description: 'Probe type used by this custom synthetic probe. enum: `application`, `curl`, `icmp`, `reachability`, `tcp`.' description: Custom probe definition for synthetic tests service_policy_secintel3: title: service_policy_secintel3 type: object properties: enabled: type: boolean description: Whether SecIntel inspection is enabled for the service policy default: false profile: allOf: - $ref: '#/components/schemas/service_policy_secintel_profile2' - description: 'Protection level applied by SecIntel inspection. enum: `default`, `standard`, `strict`.' secintelprofile_id: type: string description: Organization-level SecIntel profile ID; takes precedence over inline `profile` settings description: Threat intelligence settings applied by this service policy snmp_vacm_access_item_prefix_list_item_level2: title: snmp_vacm_access_item_prefix_list_item_level2 enum: - authentication - none - privacy type: string description: 'Required security level for this VACM access rule. enum: `authentication`, `none`, `privacy`.' setting_ssr_auto_upgrade2: title: setting_ssr_auto_upgrade2 type: object properties: channel: allOf: - $ref: '#/components/schemas/ssr_upgrade_channel4' - description: 'Firmware release channel used for SSR auto-upgrade. enum: `alpha`, `beta`, `stable`.' custom_versions: type: object additionalProperties: type: string description: Per-model SSR firmware versions used for auto-upgrade enabled: type: boolean description: Whether SSR auto-upgrade is enabled for newly onboarded devices default: false version: type: string description: Firmware version to deploy (e.g. 6.3.0-107.r1). Optional, used when custom_versions not specified examples: - 6.3.0-107.r1 description: Automatic SSR firmware upgrade settings for newly onboarded devices idp_profile_matching_severity_value: title: idp_profile_matching_severity_value enum: - critical - info - major - minor type: string description: 'enum: `critical`, `info`, `major`, `minor`' examples: - major network_tenant: title: network_tenant type: object properties: addresses: type: array items: type: string description: IP addresses or subnets assigned to this tenant in the network description: Tenant address entry for a network site_setting_config_push_policy2: title: site_setting_config_push_policy2 type: object properties: no_push: type: boolean description: Stop any new config from being pushed to the device default: false push_window: allOf: - $ref: '#/components/schemas/push_policy_push_window1' - description: Allowed time window during which configuration pushes may run description: Policy controlling how site configuration pushes are applied tacacs_auth_server: title: tacacs_auth_server type: object properties: host: type: string description: Address or hostname of the TACACS+ authentication server port: type: string description: TCP port used by the TACACS+ authentication server secret: type: string description: Shared secret used with this TACACS+ authentication server contentEncoding: password timeout: type: integer description: TACACS+ authentication server timeout, in seconds contentEncoding: int32 default: 10 description: TACACS+ authentication server settings switch_bgp_config: title: switch_bgp_config required: - local_as - type type: object properties: auth_key: type: string description: Authentication key used for BGP neighbor sessions, when configured bfd_minimum_interval: maximum: 255000 minimum: 1 type: integer description: Minimum interval in milliseconds for BFD hello packets. A neighbor is considered failed when the device stops receiving replies after the specified interval. Value must be between 1 and 255000. contentEncoding: int32 export_policy: type: string description: Export policy must match one of the policy names defined in the `routing_policies` property. hold_time: oneOf: - $ref: '#/components/schemas/switch_bgp_config_hold_time_zero' - maximum: 65535 minimum: 3 type: integer contentEncoding: int32 description: 'Default BGP hold time for switch BGP sessions. enum: `0`.' import_policy: type: string description: Import policy must match one of the policy names defined in the `routing_policies` property. local_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Local BGP Autonomous System (AS) number for the switch examples: - '65000' neighbors: type: object additionalProperties: $ref: '#/components/schemas/switch_bgp_config_neighbor' description: BGP neighbor settings keyed by neighbor IP address networks: type: array items: type: string description: Network names used to add BGP groups to the corresponding VRFs type: allOf: - $ref: '#/components/schemas/switch_bgp_config_type2' - description: 'BGP session type for this switch BGP configuration. enum: `external`, `internal`.' description: Switch BGP configuration for a routing instance gateway_mgmt3: title: gateway_mgmt3 type: object properties: admin_sshkeys: type: array items: type: string description: SSR-only SSH public keys for administrative access examples: - - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...Wxa6p6UW0ZbcP john@host app_probing: allOf: - $ref: '#/components/schemas/app_probing1' - description: Application probing configuration for gateway monitoring app_usage: type: boolean description: Consumes uplink bandwidth, requires WA license auto_signature_update: allOf: - $ref: '#/components/schemas/gateway_mgmt_auto_signature_update2' - description: Schedule for automatic security signature updates config_revert_timer: maximum: 30 minimum: 1 type: integer description: Rollback timer for commit confirmed contentEncoding: int32 default: 10 disable_console: type: boolean description: For SSR and SRX, disable console port default: false disable_idp_pcap: type: boolean description: For SRX only, disable IDP packet capture default: false disable_oob: type: boolean description: For SSR and SRX, disable management interface default: false disable_usb: type: boolean description: For SSR and SRX, disable usb interface default: false fips_enabled: type: boolean description: Whether FIPS mode is enabled on the gateway default: false probe_hosts: type: array items: type: string description: IPv4 probe targets used for gateway connectivity checks examples: - - 8.8.8.8 probe_hostsv6: type: array items: type: string description: IPv6 probe targets used for gateway connectivity checks examples: - - 2001:4860:4860::8888 protect_re: allOf: - $ref: '#/components/schemas/protect_re1' - description: Control-plane protection settings for the gateway root_password: type: string description: SRX only. Root password for local gateway access contentEncoding: password security_log_source_address: type: string description: IPv4 source address used for gateway security log traffic contentEncoding: ipv4 examples: - 192.168.1.1 security_log_source_interface: type: string description: Source interface used for gateway security log traffic examples: - ge-0/0/1.0 description: Management access settings for gateways at the site protect_re_custom: title: protect_re_custom type: object properties: port_range: type: string description: Matched dst port, "0" means any default: '0' examples: - 80,1035-1040 protocol: allOf: - $ref: '#/components/schemas/protect_re_custom_protocol2' - description: 'Transport protocol matched by this custom Protect RE ACL. enum: `any`, `icmp`, `tcp`, `udp`.' subnets: type: array items: type: string description: Source subnets matched by this custom Protect RE ACL description: Custom Protect RE ACL entry switch_network: title: switch_network required: - vlan_id type: object properties: gateway: type: string description: Only required for EVPN-VXLAN networks, IPv4 Virtual Gateway gateway6: type: string description: Only required for EVPN-VXLAN networks, IPv6 Virtual Gateway isolation: type: boolean description: 'whether to stop clients to talk to each other, default is false (when enabled, a unique isolation_vlan_id is required). NOTE: this features requires uplink device to also a be Juniper device and `inter_switch_link` to be set. See also `inter_isolation_network_link` and `community_vlan_id` in port_usage' default: false isolation_vlan_id: type: string description: Required when `isolation`==`true`. Unique VLAN ID used for client isolation examples: - '3070' multicast: allOf: - $ref: '#/components/schemas/switch_network_multicast2' - description: Multicast (IGMP snooping) settings for this VLAN subnet: type: string description: Optional for pure switching, required when L3 / routing features are used subnet6: type: string description: Optional for pure switching, required when L3 / routing features are used vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN identifier for this switch network description: A network represents a network segment. It can either represent a VLAN (then usually ties to a L3 subnet), optionally associate it with a subnet which can later be used to create addition routes. Used for ports doing `family ethernet-switching`. It can also be a pure L3-subnet that can then be used against a port that with `family inet`. day_of_week5: title: day_of_week5 enum: - any - fri - mon - sat - sun - thu - tue - wed type: string description: 'Weekly ESL auto-upgrade day for the maintenance window. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' site_mxtunnel_cluster: title: site_mxtunnel_cluster type: object properties: name: type: string description: Peer cluster name used in the site Mist Tunnel configuration examples: - primary tunterm_hosts: type: array items: type: string description: Tunnel termination hostnames or IP addresses in this peer cluster examples: - - mxedge1 - mxedge2.local description: Mist Tunnel peer cluster definition for a site tunnel_config: title: tunnel_config type: object properties: auto_provision: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision2' - description: Provider auto-provisioning settings for tunnel endpoints ike_lifetime: type: integer description: Only if `provider`==`custom-ipsec`. IKE lifetime configured for the custom IPsec tunnel contentEncoding: int32 ike_mode: allOf: - $ref: '#/components/schemas/tunnel_config_ike_mode2' - description: 'Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel. enum: `aggressive`, `main`.' ike_proposals: type: array items: $ref: '#/components/schemas/tunnel_config_ike_proposal' description: If `provider`==`custom-ipsec`, IKE proposals used for custom IPsec negotiation ipsec_lifetime: type: integer description: If `provider`==`custom-ipsec`, IPsec lifetime configured for the custom tunnel contentEncoding: int32 ipsec_proposals: type: array items: $ref: '#/components/schemas/tunnel_config_ipsec_proposal' description: Only if `provider`==`custom-ipsec`. IPsec proposals used for custom IPsec negotiation local_id: type: string description: Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec` local_subnets: type: array items: type: string description: Local protected subnets advertised by this tunnel mode: allOf: - $ref: '#/components/schemas/tunnel_config_tunnel_mode2' - description: 'Tunnel failover mode used for primary and secondary endpoints. enum: `active-active`, `active-standby`.' networks: type: array items: type: string description: Destination networks reachable through this tunnel primary: allOf: - $ref: '#/components/schemas/tunnel_config_node3' - description: Main remote tunnel endpoint settings probe: allOf: - $ref: '#/components/schemas/tunnel_config_probe' - description: Tunnel health probe settings protocol: allOf: - $ref: '#/components/schemas/tunnel_config_protocol2' - description: 'Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation. enum: `gre`, `ipsec`.' provider: allOf: - $ref: '#/components/schemas/tunnel_config_provider2' - description: 'Tunnel provider used when auto provisioning is disabled. enum: `custom-ipsec`, `custom-gre`, `jse-ipsec`, `prisma-ipsec`, `zscaler-gre`, `zscaler-ipsec`.' psk: type: string description: Required if `provider`==`zscaler-ipsec`, `provider`==`jse-ipsec` or `provider`==`custom-ipsec` remote_subnets: type: array items: type: string description: Remote protected subnets reached through policy-based IPsec secondary: allOf: - $ref: '#/components/schemas/tunnel_config_node1' - description: Backup remote tunnel endpoint settings version: allOf: - $ref: '#/components/schemas/tunnel_config_version2' - description: 'Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration. enum: `1`, `2`.' description: Gateway tunnel configuration for provider-managed or custom tunnels ap_radio3: title: ap_radio3 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM can be disabled for individual radio-band settings default: false ant_gain_24: minimum: 0 type: integer description: Antenna gain for 2.4G - for models with external antenna only contentEncoding: int32 examples: - 4 ant_gain_5: minimum: 0 type: integer description: Antenna gain for 5G - for models with external antenna only contentEncoding: int32 examples: - 5 ant_gain_6: minimum: 0 type: integer description: Antenna gain for 6G - for models with external antenna only contentEncoding: int32 examples: - 5 antenna_mode: allOf: - $ref: '#/components/schemas/ap_radio_antenna_mode2' - description: 'Selected radio chain mode for AP models that support antenna mode control. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' antenna_select: allOf: - $ref: '#/components/schemas/antenna_select1' - description: 'Internal or external antenna selection for AP models with selectable antennas. enum: ``, `external`, `internal`.' examples: - external band_24: allOf: - $ref: '#/components/schemas/ap_radio_band242' - description: 2.4 GHz radio settings for this access point band_24_usage: allOf: - $ref: '#/components/schemas/radio_band_24_usage4' - description: 'Radio usage mode for the 2.4 GHz-capable radio. enum: `24`, `5`, `6`, `auto`.' band_5: allOf: - $ref: '#/components/schemas/ap_radio_band53' - description: 5 GHz radio settings for this access point band_5_on_24_radio: allOf: - $ref: '#/components/schemas/ap_radio_band51' - description: 5 GHz settings used when the 2.4 GHz radio operates in 5 GHz mode band_6: allOf: - $ref: '#/components/schemas/ap_radio_band62' - description: 6 GHz radio settings for this access point full_automatic_rrm: type: boolean description: Let RRM control everything, only the `channels` and `ant_gain` will be honored (i.e. disabled/bandwidth/power/band_24_usage are all controlled by RRM) default: false indoor_use: type: boolean description: To make an outdoor operate indoor. For an outdoor-ap, some channels are disallowed by default, this allows the user to use it as an indoor-ap default: false rrm_managed: type: boolean description: Enable RRM to manage all radio settings (ignores all band_xxx configs) scanning_enabled: type: boolean description: Whether scanning radio is enabled examples: - true description: AP radio configuration for the site site_setting_auto_upgrade_esl2: title: site_setting_auto_upgrade_esl2 type: object properties: allow_downgrade: type: boolean description: If true, it will allow downgrade to a lower version default: false custom_versions: type: object additionalProperties: type: string description: Custom versions for different models. Property key is the model name (e.g. "AP41") examples: - AP41: 2.4.6 AP61: 2.5.0 day_of_week: allOf: - $ref: '#/components/schemas/day_of_week5' - description: 'Weekly ESL auto-upgrade day for the maintenance window. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' enabled: type: boolean description: Whether auto upgrade should happen (Note that Mist may auto-upgrade if the version is not supported) default: false time_of_day: type: string description: '`any` / HH:MM (24-hour format), upgrade will happen within up to 1-hour from this time' examples: - 720 version: type: string description: ESL firmware version used for auto-upgrade examples: - 2.5.0 description: Automatic ESL firmware upgrade settings for the site snmpv3_config2: title: snmpv3_config2 type: object properties: notify: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_items' description: SNMPv3 notification definitions used for traps and informs notify_filter: type: array items: $ref: '#/components/schemas/snmpv3_config_notify_filter_item' description: SNMPv3 notification filter profiles target_address: type: array items: $ref: '#/components/schemas/snmpv3_config_target_address_item' description: SNMPv3 notification target addresses target_parameters: type: array items: $ref: '#/components/schemas/snmpv3_config_target_param' description: SNMPv3 target parameter profiles usm: type: array items: $ref: '#/components/schemas/snmp_usm' description: SNMPv3 USM engine configurations vacm: allOf: - $ref: '#/components/schemas/snmp_vacm2' - description: SNMPv3 VACM access control configuration description: SNMPv3 user, VACM, notify, and target configuration mxcluster_radsec_server_selection2: title: mxcluster_radsec_server_selection2 enum: - ordered - unordered type: string description: 'RADIUS server selection strategy for RadSec failover. enum: `ordered`, `unordered`.' gateway_oob_ip_config3: title: gateway_oob_ip_config3 type: object properties: gateway: type: string description: Default gateway for the out-of-band management interface when `type`==`static` ip: type: string description: Static IPv4 address for the out-of-band management interface when `type`==`static` netmask: type: string description: IPv4 netmask or prefix length for the out-of-band management interface when `type`==`static` node1: allOf: - $ref: '#/components/schemas/gateway_oob_ip_config_node12' - description: Out-of-band management IP configuration override for node1 in an HA cluster type: allOf: - $ref: '#/components/schemas/ip_type2' - description: 'IP assignment mode for the out-of-band management interface. enum: `dhcp`, `static`.' examples: - static use_mgmt_vrf: type: boolean description: If supported on the platform. If enabled, DNS will be using this routing-instance, too default: false use_mgmt_vrf_for_host_out: type: boolean description: For host-out traffic (NTP/TACPLUS/RADIUS/SYSLOG/SNMP), if alternative source network/ip is desired default: false vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID used for out-of-band management traffic description: Out-of-band management IP defaults in this gateway template tunnel_config_dh_group2: title: tunnel_config_dh_group2 enum: - '1' - '14' - '15' - '16' - '19' - '2' - '20' - '21' - '24' - '5' type: string description: 'Diffie-Hellman group used by this IPsec proposal. enum: `1`, `14`, `15`, `16`, `19`, `2`, `20`, `21`, `24`, `5`.' dhcpd_config_type62: title: dhcpd_config_type62 enum: - local - none - relay type: string description: 'IPv6 DHCP mode for this network. enum: `local`, `none`, `relay`.' simple_alert_dhcp_failure: title: simple_alert_dhcp_failure type: object properties: client_count: type: integer description: Number of distinct clients that must encounter DHCP failures before alerting contentEncoding: int32 default: 10 duration: maximum: 60 minimum: 5 type: integer description: Time window in minutes for evaluating DHCP failures contentEncoding: int32 default: 10 incident_count: type: integer description: Number of DHCP failure incidents required within the duration window contentEncoding: int32 default: 20 description: Thresholds for DHCP failure heuristic alerts snmpv3_config_target_param_mess_process_model2: title: snmpv3_config_target_param_mess_process_model2 enum: - v1 - v2c - v3 type: string description: 'SNMP message processing model used by this target parameter profile. enum: `v1`, `v2c`, `v3`.' radius_keywrap_format1: title: radius_keywrap_format1 enum: - ascii - hex type: string description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`.' ble_config_power_mode3: title: ble_config_power_mode3 enum: - custom - default type: string description: 'Transmit power mode for BLE beacons; use custom to set `power`. enum: `custom`, `default`.' examples: - custom snmp_config_v2c_config: title: snmp_config_v2c_config type: object properties: authorization: type: string description: Access level for the SNMPv2c community examples: - read-only client_list_name: type: string description: SNMP client list name referenced by this community examples: - clist-1 community_name: type: string description: SNMPv2c community string name examples: - abc123 view: type: string description: SNMP view name that must be defined in the views list examples: - all description: SNMPv2c community configuration entry snmp_usm_user_encryption_type2: title: snmp_usm_user_encryption_type2 enum: - privacy-3des - privacy-aes128 - privacy-des - privacy-none type: string description: 'Privacy protocol used by this SNMPv3 USM user. enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`.' snmpv3_config_target_param_security_level2: title: snmpv3_config_target_param_security_level2 enum: - authentication - none - privacy type: string description: 'Required security level for this target parameter profile. enum: `authentication`, `none`, `privacy`.' bgp_config_type2: title: bgp_config_type2 enum: - external - internal type: string description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external remote_syslog_content: title: remote_syslog_content type: object properties: facility: allOf: - $ref: '#/components/schemas/remote_syslog_facility3' - description: 'Syslog facility to match for this selector. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config severity: allOf: - $ref: '#/components/schemas/remote_syslog_severity3' - description: 'Syslog severity to match for this selector. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' description: Syslog message content selector for remote logging gw_routing_policy_term_matching_protocol_enum: title: gw_routing_policy_term_matching_protocol_enum enum: - aggregate - bgp - direct - ospf - static type: string description: 'enum: `aggregate`, `bgp`, `direct`, `ospf`, `static` (SRX Only)' network_internal_access2: title: network_internal_access2 type: object properties: enabled: type: boolean description: Whether internal access is enabled for this network description: Internal access settings for this network snmp_config3: title: snmp_config3 type: object properties: client_list: type: array items: $ref: '#/components/schemas/snmp_config_client_list' description: SNMP client allowlists that can be referenced by communities contact: type: string description: Administrative contact string advertised through SNMP examples: - cns@juniper.net description: type: string description: Device description string advertised through SNMP examples: - Juniper QFX Series Switch - 1K_5LA enabled: type: boolean description: Whether SNMP is enabled default: true engine_id: maxLength: 27 type: string description: SNMP engine ID used for SNMPv3 engine_id_type: allOf: - $ref: '#/components/schemas/snmp_config_engine_id_type2' - description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' location: type: string description: Physical location string advertised through SNMP examples: - Las Vegas, NV name: type: string description: System name advertised through SNMP examples: - TGH-1K-QFX10K network: type: string description: Management network used for SNMP traffic default: default trap_groups: type: array items: $ref: '#/components/schemas/snmp_config_trap_group' description: SNMP trap group definitions v2c_config: type: array items: $ref: '#/components/schemas/snmp_config_v2c_config' description: SNMPv2c community configuration entries for this SNMP profile v3_config: allOf: - $ref: '#/components/schemas/snmpv3_config2' - description: SNMPv3 user, VACM, notify, and target configuration views: type: array items: $ref: '#/components/schemas/snmp_config_view' description: SNMP MIB view definitions description: Management polling settings for SNMP on site devices bgp_config: title: bgp_config required: - via type: object properties: auth_key: type: string description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan` bfd_minimum_interval: maximum: 255000 minimum: 1 type: - integer - 'null' description: "Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfd_multiplier is configured alone. Default:\n * 1000 if `type`==`external`\n * 350 `type`==`internal`" contentEncoding: int32 default: 350 bfd_multiplier: maximum: 255 minimum: 1 type: - integer - 'null' description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`, when bfd_minimum_interval_is_configured alone contentEncoding: int32 default: 3 disable_bfd: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. BFD provides faster path failure detection and is enabled by default default: false export: type: string description: Routing policy applied to routes exported by this BGP session export_policy: type: string description: Default export policies if no per-neighbor policies defined extended_v4_nexthop: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, either inet/net6 unicast depending on neighbor IP family (v4 or v6). For v6 neighbors, to exchange v4 nexthop, which allows dual-stack support, enable this graceful_restart_time: maximum: 4095 minimum: 0 type: integer description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. `0` means disable contentEncoding: int32 default: 0 hold_time: maximum: 65535 minimum: 0 type: integer description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default is 90. contentEncoding: int32 default: 90 import: type: string description: Routing policy applied to routes imported by this BGP session import_policy: type: string description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. Default import policies if no per-neighbor policies defined local_as: anyOf: - type: string - maximum: 4294967295 minimum: 1 type: integer contentEncoding: int32 description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; local BGP Autonomous System (AS) number examples: - '65000' neighbor_as: anyOf: - type: string - maximum: 4294967294 minimum: 1 type: integer contentEncoding: int32 description: Default BGP neighbor Autonomous System (AS) number for this session examples: - '65000' neighbors: type: object additionalProperties: $ref: '#/components/schemas/bgp_config_neighbors' description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If per-neighbor as is desired. Property key is the neighbor address networks: type: array items: type: string description: Optional if `via`==`lan`; networks where BGP neighbors can connect to or from no_private_as: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. If true, we will not advertise private ASNs (AS 64512-65534) to this neighbor default: false no_readvertise_to_overlay: type: boolean description: Optional if `via`==`lan`, `via`==`tunnel` or `via`==`wan`. By default, we'll re-advertise all learned BGP routers toward overlay default: false tunnel_name: type: string description: Optional if `via`==`tunnel`; tunnel name used for this BGP session type: allOf: - $ref: '#/components/schemas/bgp_config_type2' - minLength: 1 description: Required if `via`==`lan`, `via`==`tunnel` or `via`==`wan`; BGP session type, internal or external via: allOf: - $ref: '#/components/schemas/bgp_config_via2' - description: Transport used for this BGP session, such as LAN, tunnel, VPN, or WAN vpn_name: type: string description: Optional if `via`==`vpn`; VPN name used for this BGP session wan_name: type: string description: Optional if `via`==`wan`; WAN interface name used for this BGP session description: BGP session configuration. BFD is enabled when either bfd_minimum_interval or bfd_multiplier is configured service_policy_antivirus1: title: service_policy_antivirus1 type: object properties: avprofile_id: type: string description: Organization-level antivirus profile ID; takes precedence over inline `profile` settings contentEncoding: uuid enabled: type: boolean description: Whether antivirus inspection is enabled for the service policy default: false profile: type: string description: Antivirus profile name to apply, such as `default`, `noftp`, `httponly`, or an AV profile key description: Malware and virus inspection settings applied by this service policy juniper_srx_auto_upgrade2: title: juniper_srx_auto_upgrade2 type: object properties: custom_versions: type: object additionalProperties: type: string description: Per-SRX-model firmware versions to deploy instead of the default version enabled: type: boolean description: Whether SRX auto-upgrade is enabled for newly onboarded devices default: false snapshot: type: boolean description: Whether to take a snapshot during the SRX upgrade process default: false version: type: string description: Firmware version to deploy (e.g. 23.4R2-S5.5). Optional, used when custom_versions not specified examples: - 23.4R2-S5.5 description: SRX auto-upgrade settings applied when SRX devices are onboarded dhcp_snooping4: title: dhcp_snooping4 type: object properties: all_networks: type: boolean description: Whether DHCP snooping applies to all configured networks enable_arp_spoof_check: type: boolean description: Enable for dynamic ARP inspection check enable_ip_source_guard: type: boolean description: Enable for check for forging source IP address enabled: type: boolean description: Whether DHCP snooping is enabled networks: type: array items: type: string description: Network names with DHCP snooping enabled when `all_networks`==`false` description: Layer 2 DHCP snooping settings for the site gw_routing_policy_term_matching_route_exists2: title: gw_routing_policy_term_matching_route_exists2 type: object properties: route: type: string description: Prefix that must exist for this condition to match examples: - 192.168.0.0/24 vrf_name: type: string description: Name of the VRF instance where the route is checked; can also be a VPN or WAN name when applicable default: default description: Existing route condition that must be satisfied before this term matches gateway_port_wan_arp_policer2: title: gateway_port_wan_arp_policer2 enum: - default - max - recommended type: string description: 'Only when `wan_type`==`broadband`. ARP policer profile applied to the WAN port. enum: `default`, `max`, `recommended`.' simple_alert2: title: simple_alert2 type: object properties: arp_failure: allOf: - $ref: '#/components/schemas/simple_alert_arp_failure' - description: Thresholds for ARP failure heuristic alerts dhcp_failure: allOf: - $ref: '#/components/schemas/simple_alert_dhcp_failure' - description: Thresholds for DHCP failure heuristic alerts dns_failure: allOf: - $ref: '#/components/schemas/simple_alert_dns_failure' - description: Thresholds for DNS failure heuristic alerts description: Threshold alert settings for the site ble_config_beacon_rate_mode2: title: ble_config_beacon_rate_mode2 enum: - custom - default type: string description: 'Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate. enum: `custom`, `default`.' examples: - custom vlan_id_with_variable: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID, either numeric or expressed as a template variable string gateway_port_vpn_path: title: gateway_port_vpn_path type: object properties: bfd_profile: allOf: - $ref: '#/components/schemas/gateway_port_vpn_path_bfd_profile2' - description: 'BFD profile used for this VPN path when the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`.' bfd_use_tunnel_mode: type: boolean description: Only if the VPN `type`==`hub_spoke`. Whether to use tunnel mode. SSR only default: false preference: type: integer description: Only if the VPN `type`==`hub_spoke`. For a given VPN, when `path_selection.strategy`==`simple`, the preference for a path (lower is preferred) contentEncoding: int32 role: allOf: - $ref: '#/components/schemas/gateway_port_vpn_path_role2' - description: 'Gateway role for this VPN path; valid values depend on the VPN `type`. enum: `hub`, `mesh`, `spoke`.' traffic_shaping: allOf: - $ref: '#/components/schemas/gateway_traffic_shaping1' - description: Traffic shaping settings applied to this VPN path description: VPN path settings for traffic that uses a gateway port remote_syslog_facility1: title: remote_syslog_facility1 enum: - any - authorization - change-log - config - conflict-log - daemon - dfc - external - firewall - ftp - interactive-commands - kernel - ntp - pfe - security - user type: string description: 'Default syslog facility for messages sent to this server. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config snmp_vacm_access_item: title: snmp_vacm_access_item type: object properties: group_name: type: string description: SNMP VACM group name prefix_list: type: array items: $ref: '#/components/schemas/snmp_vacm_access_item_prefix_list_item' description: Context prefix rules for this VACM group description: VACM access rule for an SNMP group synthetictest_config_lan_network: title: synthetictest_config_lan_network type: object properties: networks: type: array items: type: string description: LAN network names where synthetic probes are run examples: - - pos-stations - pos-machines probes: type: array items: type: string description: Synthetic probe names to run on the listed LAN networks description: configure minis probes to be tested on lan networks of gateways allow_deny4: title: allow_deny4 enum: - allow - deny type: string description: Allow or deny decision applied to traffic matching the destination tag site_setting_status_portal: title: site_setting_status_portal type: object properties: enabled: type: boolean description: Whether the site status portal is enabled default: false hostnames: type: array items: type: string description: Portal hostnames served by the site status portal description: End-user status portal settings for the site hours1: title: hours1 type: object properties: fri: type: string description: Operating hour range for Friday examples: - 09:00-17:00 mon: type: string description: Operating hour range for Monday examples: - 09:00-17:00 sat: type: string description: Operating hour range for Saturday examples: - 09:00-17:00 sun: type: string description: Operating hour range for Sunday examples: - 09:00-17:00 thu: type: string description: Operating hour range for Thursday examples: - 09:00-17:00 tue: type: string description: Operating hour range for Tuesday examples: - 09:00-17:00 wed: type: string description: Operating hour range for Wednesday examples: - 09:00-17:00 description: Day-of-week hour ranges when configuration pushes are allowed remote_syslog_file_config: title: remote_syslog_file_config type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive1' - description: Retention settings for this generated syslog file contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities written to this file enable_tls: type: boolean description: Only if `protocol`==`tcp`, enable TLS for this syslog file destination explicit_priority: type: boolean description: Whether to include explicit syslog priority values in file output file: type: string description: Generated syslog file name examples: - file-name match: type: string description: Expression used to filter log messages written to this file examples: - '!alarm|ntp|errors.crc_error[chan]' structured_data: type: boolean description: Whether to include structured syslog data in file output description: Generated syslog file output settings remote_syslog_server: title: remote_syslog_server type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities sent to this server explicit_priority: type: boolean description: Whether to include explicit syslog priority values in messages sent to this server facility: allOf: - $ref: '#/components/schemas/remote_syslog_facility1' - description: 'Default syslog facility for messages sent to this server. enum: `any`, `authorization`, `change-log`, `config`, `conflict-log`, `daemon`, `dfc`, `external`, `firewall`, `ftp`, `interactive-commands`, `kernel`, `ntp`, `pfe`, `security`, `user`.' examples: - config host: type: string description: Address or hostname of the remote syslog server examples: - syslogd.internal match: type: string description: Expression used to filter log messages sent to this server examples: - '!alarm|ntp|errors.crc_error[chan]' port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 default: 514 - type: string description: Network port used by the remote syslog server protocol: allOf: - $ref: '#/components/schemas/remote_syslog_server_protocol2' - description: 'Transport protocol used for this remote syslog server. enum: `tcp`, `udp`.' routing_instance: type: string description: Routing instance used to reach this remote syslog server examples: - routing-instance-name server_name: type: string description: TLS server name used when verifying the remote syslog server certificate examples: - syslogd.internal severity: allOf: - $ref: '#/components/schemas/remote_syslog_severity1' - description: 'Default syslog severity for messages sent to this server. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' source_address: type: string description: Source address for syslog traffic. If configured, Mist uses the VLAN first; otherwise it uses `source_ip` structured_data: type: boolean description: Whether to include structured syslog data in messages sent to this server tag: type: string description: Syslog tag value added to messages sent to this server description: Remote syslog server destination settings acl_policy: title: acl_policy type: object properties: actions: type: array items: $ref: '#/components/schemas/acl_policy_action' description: Destination tag actions evaluated for sources matching this ACL policy disabled: type: boolean description: Whether this ACL policy is disabled default: false name: type: string description: Display name of the ACL policy examples: - guest access src_tags: type: array items: type: string description: Source ACL tags that select traffic for this ACL policy description: "ACL Policy:\n - for GBP-based policy, all src_tags and dst_tags have to be gbp-based\n - for ACL-based policy, `network` is required in either the source or destination so that we know where to attach the policy to" gateway_port_vpn_path_bfd_profile2: title: gateway_port_vpn_path_bfd_profile2 enum: - broadband - lte type: string description: 'BFD profile used for this VPN path when the VPN `type`==`hub_spoke`. enum: `broadband`, `lte`.' ap_led3: title: ap_led3 type: object properties: brightness: maximum: 255 minimum: 0 type: integer description: Indicator LED brightness level from 0 to 255 contentEncoding: int32 default: 255 examples: - 255 enabled: type: boolean description: Whether the AP indicator LED is enabled default: true description: AP LED behavior configured for the site tunnel_config_auto_provision_lat_lng2: title: tunnel_config_auto_provision_lat_lng2 required: - lat - lng type: object properties: lat: type: number description: Geographic latitude used for POP selection override examples: - 37.295833 lng: type: number description: Geographic longitude used for POP selection override examples: - -122.032946 description: Geographic coordinate override used for tunnel POP selection remote_syslog_archive3: title: remote_syslog_archive3 type: object properties: files: anyOf: - type: string - type: integer contentEncoding: int32 description: Number of archived syslog files to retain examples: - '20' size: type: string description: Maximum size of each archived syslog file, such as 5m examples: - 5m description: Retention settings for generated syslog archive files network_source_nat2: title: network_source_nat2 type: object properties: external_ip: type: string description: External source NAT IP or subnet used when spoke hosts must be reachable from the hub examples: - 172.16.0.8/30 description: Source NAT settings used when non-routed spoke hosts must be reachable from the hub tacacs_acct_server: title: tacacs_acct_server type: object properties: host: type: string description: Address or hostname of the TACACS+ accounting server port: type: string description: TCP port used by the TACACS+ accounting server secret: type: string description: Shared secret used with this TACACS+ accounting server contentEncoding: password timeout: type: integer description: TACACS+ accounting server timeout, in seconds contentEncoding: int32 default: 10 description: TACACS+ accounting server settings day_of_week4: title: day_of_week4 enum: - any - fri - mon - sat - sun - thu - tue - wed type: string description: 'Weekly AP auto-upgrade day for the maintenance window. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' site_setting_ap_synthetic_test2: title: site_setting_ap_synthetic_test2 type: object properties: additional_vlan_ids: anyOf: - type: string - type: array items: $ref: '#/components/schemas/vlan_id_with_variable' description: VLAN IDs included in addition to the default VLAN set for AP synthetic tests description: Synthetic test configuration for APs at the site ap_port_config_mac_auth_protocol2: title: ap_port_config_mac_auth_protocol2 enum: - eap-md5 - eap-peap - pap type: string description: 'Protocol used for MAC authentication when `enable_mac_auth` is `true`. enum: `eap-md5`, `eap-peap`, `pap`.' ospf_areas_network: title: ospf_areas_network type: object properties: auth_keys: type: object additionalProperties: type: string description: Required if `auth_type`==`md5`. Property key is the key number examples: - '1': auth-key-1 auth_password: type: string description: Required if `auth_type`==`password`, the password, max length is 8 examples: - simple auth_type: allOf: - $ref: '#/components/schemas/ospf_area_network_auth_type2' - description: 'Authentication method used by this OSPF network. enum: `md5`, `none`, `password`.' examples: - md5 bfd_minimum_interval: maximum: 255000 minimum: 1 type: integer description: Minimum BFD interval for this OSPF network, in milliseconds contentEncoding: int32 examples: - 500 dead_interval: maximum: 65535 minimum: 1 type: integer description: OSPF dead interval for this network, in seconds contentEncoding: int32 examples: - 40 export_policy: type: string description: Routing policy used to export routes from this OSPF network examples: - export_policy hello_interval: maximum: 255 minimum: 1 type: integer description: OSPF hello interval for this network, in seconds contentEncoding: int32 import_policy: type: string description: Routing policy used to import routes for this OSPF network examples: - import_policy interface_type: allOf: - $ref: '#/components/schemas/ospf_area_network_interface_type2' - description: 'OSPF interface type used for this network. enum: `broadcast`, `nbma`, `p2mp`, `p2p`.' metric: maximum: 65535 minimum: 1 type: - integer - 'null' description: OSPF metric assigned to this network contentEncoding: int32 examples: - 10000 no_readvertise_to_overlay: type: boolean description: By default, we'll re-advertise all learned OSPF routes toward overlay default: false passive: type: boolean description: Whether to send OSPF-Hello default: false description: Property key is the network name. Networks to participate in an OSPF area site_engagement_dwell_tags2: title: site_engagement_dwell_tags2 type: object properties: bounce: type: - string - 'null' description: Visit duration range for bounce visits, in seconds default: 301-14400 engaged: type: - string - 'null' description: Visit duration range for engaged visits, in seconds default: 14401-28800 passerby: type: - string - 'null' description: Visit duration range for passerby visits, in seconds default: 1-300 stationed: type: - string - 'null' description: Visit duration range for stationed visits, in seconds default: 28801-42000 description: Visit duration ranges used to assign engagement categories snmp_vacm_security_to_group2: title: snmp_vacm_security_to_group2 type: object properties: content: type: array items: $ref: '#/components/schemas/snmp_vacm_security_to_group_content_item' description: VACM security-name to group mapping entries security_model: allOf: - $ref: '#/components/schemas/snmp_vacm_security_model2' - description: 'Required security model for these VACM group mappings. enum: `usm`, `v1`, `v2c`.' description: VACM security-name to group mappings site_setting_critical_url_monitoring2: title: site_setting_critical_url_monitoring2 type: object properties: enabled: type: boolean description: Whether critical URL monitoring is enabled default: true monitors: type: array items: $ref: '#/components/schemas/site_setting_critical_url_monitoring_monitor' description: Critical URLs monitored for site health latency description: Monitoring configuration for critical URLs at the site switch_port_usage_dynamic_rule_src2: title: switch_port_usage_dynamic_rule_src2 enum: - link_peermac - lldp_chassis_id - lldp_hardware_revision - lldp_manufacturer_name - lldp_oui - lldp_serial_number - lldp_system_description - lldp_system_name - radius_dynamicfilter - radius_usermac - radius_username type: string description: 'Source attribute evaluated by this dynamic rule. enum: `link_peermac`, `lldp_chassis_id`, `lldp_hardware_revision`, `lldp_manufacturer_name`, `lldp_oui`, `lldp_serial_number`, `lldp_system_description`, `lldp_system_name`, `radius_dynamicfilter`, `radius_usermac`, `radius_username`.' mxedge_das2: title: mxedge_das2 type: object properties: coa_servers: type: array items: $ref: '#/components/schemas/mxedge_das_coa_server' description: Dynamic authorization clients allowed to send CoA or Disconnect-Message requests enabled: type: boolean description: Whether cloud-assisted DAS is enabled for the Mist Edge cluster default: false description: DAS service settings for the site Mist Edge cluster wlan_mist_nac3: title: wlan_mist_nac3 type: object properties: acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled. contentEncoding: int32 default: 0 examples: - 60 auth_servers_retries: maximum: 10 minimum: 1 type: integer description: RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3. contentEncoding: int32 default: 2 examples: - 3 auth_servers_timeout: maximum: 30 minimum: 1 type: integer description: RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10. contentEncoding: int32 default: 5 examples: - 5 coa_enabled: type: boolean description: Allows a RADIUS server to dynamically modify the authorization status of a user session. default: false coa_port: maximum: 65535 minimum: 1 type: integer description: the communication port used for “Change of Authorization” (CoA) messages contentEncoding: int32 examples: - 3799 enabled: type: boolean description: "When enabled:\n * `auth_servers` is ignored\n * `acct_servers` is ignored\n * `auth_servers_*` are ignored\n * `coa_servers` is ignored\n * `radsec` is ignored\n * `coa_enabled` is assumed" default: false fast_dot1x_timers: type: boolean description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`. default: false network: type: - string - 'null' description: Which network the mist nac server resides in examples: - default source_ip: type: - string - 'null' description: In case there is a static IP for this network, we can specify it using source ip examples: - 1.2.3.4 description: Juniper Mist NAC settings used by AP port authentication gateway_port_wan_source_nat2: title: gateway_port_wan_source_nat2 type: object properties: disabled: type: boolean description: Or to disable the source-nat default: false nat6_pool: type: string description: If alternative nat_pool is desired examples: - 2601:1700:43c0:dc0:20c:29ff:fea7:93bc/126 nat_pool: type: string description: If alternative nat_pool is desired examples: - 64.2.4.0/30 description: Source NAT settings applied to traffic leaving this WAN port site_mxtunnel_protocol2: title: site_mxtunnel_protocol2 enum: - ip - udp type: string description: 'Encapsulation protocol used for this additional Mist Tunnel. enum: `ip`, `udp`.' examples: - udp switch_multicast_config1: title: switch_multicast_config1 type: object properties: anycast_rp: type: boolean description: When `true`, auto-generates a shared RP on `is_l3_border` devices (ERB/IPClos topologies only) default: false rp_ip: type: string description: RP address used when `anycast_rp`==`false`. If the address matches a device SVI, it is configured as a local RP; otherwise a static RP is configured examples: - 10.2.1.10 sbd_subnet: type: string description: SBD IRB subnet; Mist auto-assigns per-device IPs from this range (EVPN eOISM only) examples: - 10.99.0.0/24 sbd_vlan_id: type: integer description: Supplemental Bridge Domain VLAN ID (EVPN topology / eOISM only) contentEncoding: int32 examples: - 3900 description: Multicast settings for networks in the master VRF (not assigned to any vrf_instances); PIM is automatically enabled when any master-VRF network has `multicast.enabled`==`true` gw_routing_policy: title: gw_routing_policy type: object properties: terms: uniqueItems: true type: array items: $ref: '#/components/schemas/gw_routing_policy_term' description: Ordered terms evaluated by this gateway routing policy description: Gateway routing policy made of ordered match-action terms gateway_wan_probe_override_http2: title: gateway_wan_probe_override_http2 type: object properties: accepted_status_codes: type: array items: type: integer contentEncoding: int32 description: HTTP response status codes that indicate a successful probe. Defaults to 200 if not specified. examples: - - 204 urls: type: array items: type: string description: HTTP or HTTPS URLs to probe examples: - - http://www.google.com/generate_204 - https://www.google.com/generate_204 description: HTTP probe settings; success from any ICMP or HTTP probe indicates the WAN is up setting_ssr2: title: setting_ssr2 type: object properties: auto_upgrade: allOf: - $ref: '#/components/schemas/setting_ssr_auto_upgrade2' - description: Automatic SSR firmware upgrade settings for newly onboarded devices conductor_hosts: type: array items: type: string description: IP addresses or hostnames of conductors used by SSR devices conductor_token: type: string description: Registration token used by SSR devices to connect to the conductor disable_stats: type: boolean description: Whether stats collection is disabled on SSR devices proxy: allOf: - $ref: '#/components/schemas/ssr_proxy2' - description: Network proxy settings used by SSR devices to reach Mist description: Session Smart Router settings for the site switch_port_usage_dot1x2: title: switch_port_usage_dot1x2 const: dot1x type: string description: 'Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage. enum: `dot1x`.' tunterm_monitoring_protocol2: title: tunterm_monitoring_protocol2 enum: - arp - ping - tcp type: string description: 'Monitoring method used for this tunnel termination check. enum: `arp`, `ping`, `tcp`.' examples: - tcp system_defined_port_usages: title: system_defined_port_usages enum: - ap - iot - uplink type: string description: 'system-default port usages. enum: `ap`, `iot`, `uplink``' site_setting_ap_matching2: title: site_setting_ap_matching2 type: object properties: enabled: type: boolean description: Whether AP matching rules are enabled rules: type: array items: $ref: '#/components/schemas/site_setting_ap_matching_rule' description: Ordered AP matching rules for applying port configuration description: Rules that apply model-specific AP port configuration site_mxtunnel_radsec2: title: site_mxtunnel_radsec2 type: object properties: acct_servers: type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by the site Mist Tunnel RadSec proxy auth_servers: type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by the site Mist Tunnel RadSec proxy enabled: type: boolean description: Whether RadSec proxying is enabled for this site Mist Tunnel default: false use_mxedge: type: boolean description: Whether RadSec proxying uses Mist Edge description: TLS-secured RADIUS proxy settings for the site Mist Tunnel radio_band_preamble1: title: radio_band_preamble1 enum: - auto - long - short type: string description: '802.11 preamble mode used by the 5 GHz radio. enum: `auto`, `long`, `short`.' gateway_port_wan_type2: title: gateway_port_wan_type2 enum: - broadband - dsl - lte type: string description: 'Only if `usage`==`wan`. WAN uplink type configured on the port. enum: `broadband`, `dsl`, `lte`.' gateway_wan_probe_override2: title: gateway_wan_probe_override2 type: object properties: hostnames: uniqueItems: true type: array items: type: string description: List of hostnames used as probe destinations; applicable for both IPv4 and IPv6 http: allOf: - $ref: '#/components/schemas/gateway_wan_probe_override_http2' - description: HTTP probe settings; success from any ICMP or HTTP probe indicates the WAN is up ip6s: uniqueItems: true type: array items: type: string description: List of IPv6 probe host addresses used by this WAN override ips: uniqueItems: true type: array items: type: string description: List of IPv4 probe host addresses used by this WAN override probe_profile: allOf: - $ref: '#/components/schemas/gateway_wan_probe_override_probe_profile2' - description: 'WAN probe profile used for health checks on this port. enum: `broadband`, `lte`.' description: Optional WAN health probe override settings for this port evpn_options_underlay2: title: evpn_options_underlay2 type: object properties: as_base: maximum: 65535 minimum: 1 type: integer description: Underlay BGP Base AS Number contentEncoding: int32 default: 65001 examples: - 65001 routed_id_prefix: type: string description: Prefix length used for automatically derived underlay router identifiers examples: - /24 subnet: type: string description: Underlay subnet, by default, `10.255.240.0/20`, or `fd31:5700::/64` for ipv6 examples: - 10.255.240.0/20 use_ipv6: type: boolean description: If v6 is desired for underlay default: false description: EVPN underlay BGP and subnet settings for the topology switch_radius2: title: switch_radius2 type: object properties: enabled: type: boolean description: Whether RADIUS is enabled for switch management authentication radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config1' - description: RADIUS configuration used when alternate RADIUS settings are required use_different_radius: type: string description: Selector for alternate RADIUS settings instead of the default switch `radius_config` description: Management authentication settings using RADIUS ap_port_config_port_auth2: title: ap_port_config_port_auth2 enum: - dot1x - none type: string description: 'Authentication mode for this AP Ethernet port. enum: `dot1x`, `none`.' examples: - none marvis1: title: marvis1 type: object properties: auto_operations: allOf: - $ref: '#/components/schemas/marvis_auto_operations2' - description: Automatic remediation operations controlled by Marvis description: AI assistant settings for Marvis at the site ap_radio_antenna_mode2: title: ap_radio_antenna_mode2 enum: - 1x1 - 2x2 - 3x3 - 4x4 - default type: string description: 'Selected radio chain mode for AP models that support antenna mode control. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' snmp_vacm2: title: snmp_vacm2 type: object properties: access: type: array items: $ref: '#/components/schemas/snmp_vacm_access_item' description: VACM access rules for SNMPv3 security_to_group: allOf: - $ref: '#/components/schemas/snmp_vacm_security_to_group2' - description: VACM security-name to group mappings description: SNMPv3 VACM access control configuration dhcpd_config_property: title: dhcpd_config_property type: object properties: dns_servers: type: array items: type: string description: If `type`==`local` or `type6`==`local`, DNS servers advertised to DHCP clients examples: - - 8.8.8.8 - 4.4.4.4 - 2001:4860:4860::8888 dns_suffix: type: array items: type: string description: If `type`==`local` or `type6`==`local`, DNS search suffixes advertised to DHCP clients examples: - - .mist.local - .mist.com fixed_bindings: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_fixed_binding' description: If `type`==`local` or `type6`==`local`, fixed client bindings for local DHCP service examples: - 5684dae9ac8b: ip: 192.168.70.35 name: John gateway: type: string description: If `type`==`local` - optional, `ip` will be used if not provided examples: - 192.168.70.1 ip6_end: type: string description: If `type6`==`local`, ending IPv6 address for the DHCP lease pool examples: - 2607:f8b0:4005:808::ff ip6_start: type: string description: If `type6`==`local`, starting IPv6 address for the DHCP lease pool examples: - 2607:f8b0:4005:808::2 ip_end: type: string description: If `type`==`local`, ending IPv4 address for the DHCP lease pool examples: - 192.168.70.200 ip_start: type: string description: If `type`==`local`, starting IPv4 address for the DHCP lease pool examples: - 192.168.70.100 lease_time: maximum: 604800 minimum: 3600 type: integer description: In seconds, lease time has to be between 3600 [1hr] - 604800 [1 week], default is 86400 [1 day] contentEncoding: int32 default: 86400 options: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_option' description: If `type`==`local` or `type6`==`local`, custom DHCP options advertised to clients server_id_override: type: boolean description: "`server_id_override`==`true` means the device, when acts as DHCP relay and forwards DHCP responses from DHCP server to clients, \nshould overwrite the Sever Identifier option (i.e. DHCP option 54) in DHCP responses with its own IP address." default: false servers: type: array items: type: string description: If `type`==`relay`, upstream IPv4 DHCP servers examples: - - 11.2.3.4 serversv6: type: array items: type: string description: If `type6`==`relay`, upstream IPv6 DHCP servers examples: - - 2607:f8b0:4005:808::64 type: allOf: - $ref: '#/components/schemas/dhcpd_config_type2' - description: 'IPv4 DHCP mode for this network. enum: `local`, `none`, `relay`.' type6: allOf: - $ref: '#/components/schemas/dhcpd_config_type62' - description: 'IPv6 DHCP mode for this network. enum: `local`, `none`, `relay`.' vendor_encapsulated: type: object additionalProperties: $ref: '#/components/schemas/dhcpd_config_vendor_option' description: If `type`==`local` or `type6`==`local`, vendor-encapsulated DHCP options advertised to clients description: DHCP server or relay configuration for one network snmpv3_config_notify_type2: title: snmpv3_config_notify_type2 enum: - inform - trap type: string description: Delivery mode for this SNMPv3 notification, such as trap or inform switch_port_mirroring_property: title: switch_port_mirroring_property type: object properties: input_networks_ingress: type: array items: type: string description: At least one mirror input source should be specified. Networks whose ingress traffic is mirrored input_port_ids_egress: type: array items: type: string description: At least one mirror input source should be specified. Switch ports whose egress traffic is mirrored input_port_ids_ingress: type: array items: type: string description: At least one mirror input source should be specified. Switch ports whose ingress traffic is mirrored output_ip_address: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - 1.2.3.4 output_network: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - analyze output_port_id: type: string description: Exactly one of the `output_ip_address`, `output_port_id` or `output_network` should be provided examples: - ge-0/0/5 description: Input and output settings for one switch port mirroring session idp_profile_base_profile2: title: idp_profile_base_profile2 enum: - critical - standard - strict type: string description: 'Built-in IDP baseline profile inherited before applying overwrites. enum: `critical`, `standard`, `strict`.' examples: - strict snmp_usm_user_authentication_type2: title: snmp_usm_user_authentication_type2 enum: - authentication-md5 - authentication-none - authentication-sha - authentication-sha224 - authentication-sha256 - authentication-sha384 - authentication-sha512 type: string description: 'Authentication protocol used by this SNMPv3 USM user. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`.' tunnel_config_auto_provision2: title: tunnel_config_auto_provision2 required: - provider type: object properties: enabled: type: boolean description: Enable auto provisioning for the tunnel. If enabled, the `primary` and `secondary` nodes will be ignored. latlng: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_lat_lng2' - description: Geographic coordinate override used for tunnel POP selection primary: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_node3' - description: Main auto-provisioned tunnel endpoint settings provider: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_provider2' - description: 'Tunnel provider used for automatic endpoint provisioning. enum: `jse-ipsec`, `zscaler-ipsec`.' region: type: string description: API override for POP selection in the case user wants to override the auto discovery of remote network location and force the tunnel to use the specified peer location. secondary: allOf: - $ref: '#/components/schemas/tunnel_config_auto_provision_node1' - description: Backup auto-provisioned tunnel endpoint settings service_connection: type: string description: if `provider`==`prisma-ipsec`. By default, we'll use the location of the site to determine the optimal Remote Network location, optionally, service_connection can be considered, then we'll also consider this along with the site location. Define service_connection if the traffic is to be routed to a specific service connection. This field takes a service connection name that is configured in the Prisma cloud, Prisma Access Setup -> Service Connections. examples: - Juniper-Lab-SC-1 description: Provider auto-provisioning settings for tunnel endpoints service_policy_skyatp_http_inspection2: title: service_policy_skyatp_http_inspection2 type: object properties: enabled: type: boolean description: Whether Sky ATP HTTP inspection is enabled profile: allOf: - $ref: '#/components/schemas/service_policy_skyatp_http_inspection_profile2' - description: 'Sky ATP HTTP inspection profile to apply. enum: `standard`, `strict`.' description: Web traffic inspection settings provided by Sky ATP snmp_usm_engine_type2: title: snmp_usm_engine_type2 enum: - local_engine - remote_engine type: string description: 'SNMP engine type used for this USM configuration. enum: `local_engine`, `remote_engine`.' site_setting_tunterm_multicast_config_ssdp2: title: site_setting_tunterm_multicast_config_ssdp2 type: object properties: enabled: type: boolean description: Whether SSDP multicast forwarding is enabled default: false vlan_ids: type: array items: type: integer contentEncoding: int32 description: VLAN IDs where SSDP multicast forwarding is enabled examples: - - 2 - 3 - 5 description: Simple Service Discovery Protocol forwarding settings for tunneled VLANs snmpv3_config_target_param: title: snmpv3_config_target_param type: object properties: message_processing_model: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_mess_process_model2' - description: 'SNMP message processing model used by this target parameter profile. enum: `v1`, `v2c`, `v3`.' name: type: string description: Target parameter profile name notify_filter: type: string description: Notification filter profile referenced by this target parameter profile security_level: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_security_level2' - description: 'Required security level for this target parameter profile. enum: `authentication`, `none`, `privacy`.' security_model: allOf: - $ref: '#/components/schemas/snmpv3_config_target_param_security_model2' - description: 'Required security model for this target parameter profile. enum: `usm`, `v1`, `v2c`.' security_name: type: string description: USM security name referenced by this target parameter profile examples: - m01620 description: SNMPv3 target parameter profile service_policy_appqoe1: title: service_policy_appqoe1 type: object properties: enabled: type: boolean description: Whether application QoE is enabled for the service policy default: false description: Application QoE settings applied by this service policy day_of_week7: title: day_of_week7 enum: - any - fri - mon - sat - sun - thu - tue - wed type: string description: 'Scheduled weekday for auto preemption. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' site_setting_auto_upgrade2: title: site_setting_auto_upgrade2 type: object properties: custom_versions: type: object additionalProperties: type: string description: Per-AP-model firmware versions or channels used for auto-upgrade examples: - AP21: alpha AP41: 0.1.5135 AP61: 0.1.7215 day_of_week: allOf: - $ref: '#/components/schemas/day_of_week4' - description: 'Weekly AP auto-upgrade day for the maintenance window. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' enabled: type: boolean description: Whether auto upgrade should happen (Note that Mist may auto-upgrade if the version is not supported) default: false time_of_day: type: string description: '`any` / HH:MM (24-hour format), upgrade will happen within up to 1-hour from this time' examples: - 720 version: allOf: - $ref: '#/components/schemas/site_auto_upgrade_version2' - description: 'Firmware release channel or custom version used for AP auto-upgrade. enum: `beta`, `custom`, `stable`.' examples: - beta description: Automatic AP firmware upgrade settings for the site. Overrides org setting when provided. ospf_area: title: ospf_area type: object properties: include_loopback: type: boolean description: Whether loopback interfaces are included in this OSPF area default: false networks: type: object additionalProperties: $ref: '#/components/schemas/ospf_areas_network' description: OSPF network settings keyed by network name examples: - corp: auth_keys: '1': auth-key-1 auth_type: md5 bfd_minimum_interval: 500 dead_interval: 40 hello_interval: 10 interface_type: nbma metric: 10000 guest: passive: true type: allOf: - $ref: '#/components/schemas/ospf_area_type2' - description: 'Area type for this OSPF area. enum: `default`, `nssa`, `stub`.' examples: - default description: Property key is the OSPF Area (Area should be a number (0-255) / IP address) ap_uwb_config3: title: ap_uwb_config3 type: object properties: enabled: type: boolean description: Whether UWB RTLS integration is enabled default: false host: type: string description: RTLS server hostname or IP address examples: - coriva.example.com port: maximum: 65535 minimum: 1 type: integer description: RTLS server port number contentEncoding: int32 examples: - 9000 slot: maximum: 15 minimum: 0 type: integer description: UWB time slot assigned to this AP, 0–15 contentEncoding: int32 default: 0 examples: - 0 type: allOf: - $ref: '#/components/schemas/ap_uwb_config_type' - description: 'UWB integration type. enum: `zigpos`' description: UWB RTLS (OMLOX asset visibility) settings for the site, only effective on AP models with a UWB radio and in countries where the UWB radio is permitted. Overridden by the device profile and device-level settings dhcpd_config3: title: dhcpd_config3 type: object properties: enabled: type: boolean description: If set to `false`, disable the DHCP server default: true additionalProperties: allOf: - $ref: '#/components/schemas/dhcpd_config_property' - description: DHCP server or relay configuration for one network description: DHCP server defaults provided by this gateway template site_setting_ap_port_config2: title: site_setting_ap_port_config2 type: object properties: model_specific: type: object additionalProperties: $ref: '#/components/schemas/ap_port_config' description: Property key is the AP model (e.g. "AP32") description: Ethernet port configuration overrides for APs at the site extra_route6: title: extra_route6 type: object properties: discard: type: boolean description: Whether to install a discard route; this takes precedence over next-hop settings default: false metric: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route metric for the IPv6 static route contentEncoding: int32 next_qualified: type: object additionalProperties: $ref: '#/components/schemas/extra_route6_next_qualified_properties' description: Qualified next-hop settings keyed by IPv6 next-hop address examples: - 2a02:1234:200a::100: metric: null preference: 40 no_resolve: type: boolean description: Whether to prevent recursive next-hop resolution for the IPv6 static route default: false preference: maximum: 2147483647 minimum: 0 type: - integer - 'null' description: Route preference for the IPv6 static route contentEncoding: int32 examples: - 30 via: oneOf: - type: string - type: array items: type: string description: Next-hop IPv6 address or ECMP next-hop IPv6 addresses for the route examples: - 10.2.1.1 - "[\n \"10.2.1.1\",\n \"10.2.1.2\"\n]" description: IPv6 static route settings for a destination prefix site_setting_rtsa2: title: site_setting_rtsa2 type: object properties: app_waking: type: boolean description: Whether app wake-up support is enabled for managed mobility default: false disable_dead_reckoning: type: boolean description: Whether dead reckoning is disabled for managed mobility disable_pressure_sensor: type: boolean description: Whether pressure sensor use is disabled for managed mobility default: false enabled: type: boolean description: Whether managed mobility features are enabled track_asset: type: boolean description: Whether BLE asset tracking is enabled for managed mobility default: false description: Managed mobility and asset tracking settings for the site gateway_extra_route6: title: gateway_extra_route6 type: object properties: via: type: string description: Next-hop IPv6 address for the gateway extra route contentEncoding: ipv6 description: Gateway IPv6 extra route next-hop settings ssl_proxy_ciphers_category2: title: ssl_proxy_ciphers_category2 enum: - medium - strong - weak type: string description: 'Allowed cipher strength category for SSL proxy inspection. enum: `medium`, `strong`, `weak`.' tunnel_config_ike_mode2: title: tunnel_config_ike_mode2 enum: - aggressive - main type: string description: 'Only if `provider`==`custom-ipsec`. IKE negotiation mode for the tunnel. enum: `aggressive`, `main`.' tacacs_default_role2: title: tacacs_default_role2 enum: - admin - helpdesk - none - read type: string description: 'Default switch-management role to use for TACACS+ logins. enum: `admin`, `helpdesk`, `none`, `read`.' snmp_config2: title: snmp_config2 type: object properties: client_list: type: array items: $ref: '#/components/schemas/snmp_config_client_list' description: SNMP client allowlists that can be referenced by communities contact: type: string description: Administrative contact string advertised through SNMP examples: - cns@juniper.net description: type: string description: Device description string advertised through SNMP examples: - Juniper QFX Series Switch - 1K_5LA enabled: type: boolean description: Whether SNMP is enabled default: true engine_id: maxLength: 27 type: string description: SNMP engine ID used for SNMPv3 engine_id_type: allOf: - $ref: '#/components/schemas/snmp_config_engine_id_type2' - description: 'Method used to derive the SNMP engine ID. enum: `local`, `use_mac_address`.' location: type: string description: Physical location string advertised through SNMP examples: - Las Vegas, NV name: type: string description: System name advertised through SNMP examples: - TGH-1K-QFX10K network: type: string description: Management network used for SNMP traffic default: default trap_groups: type: array items: $ref: '#/components/schemas/snmp_config_trap_group' description: SNMP trap group definitions v2c_config: type: array items: $ref: '#/components/schemas/snmp_config_v2c_config' description: SNMPv2c community configuration entries for this SNMP profile v3_config: allOf: - $ref: '#/components/schemas/snmpv3_config2' - description: SNMPv3 user, VACM, notify, and target configuration views: type: array items: $ref: '#/components/schemas/snmp_config_view' description: SNMP MIB view definitions description: SNMP defaults provided by this network template mxedge_mgmt_oob_ip_type2: title: mxedge_mgmt_oob_ip_type2 enum: - dhcp - disabled - static type: string description: 'IPv4 address assignment mode for out-of-band management. enum: `dhcp`, `disabled`, `static`.' mxedge_das_coa_server: title: mxedge_das_coa_server type: object properties: disable_event_timestamp_check: type: boolean description: Whether to disable Event-Timestamp Check default: false enabled: type: boolean description: Whether this DAS CoA or Disconnect-Message client is enabled host: type: string description: Server host allowed to send CoA or Disconnect-Message requests to Mist Edges port: type: integer description: UDP port where Mist Edges accept CoA or Disconnect-Message requests from this host contentEncoding: int32 default: 3799 require_message_authenticator: type: boolean description: Whether to require Message-Authenticator in requests default: false secret: type: string description: Shared secret used by this DAS CoA or Disconnect-Message client contentEncoding: password description: CoA or Disconnect-Message client allowed to contact Mist Edge DAS gateway_wan_ppoe_auth2: title: gateway_wan_ppoe_auth2 enum: - chap - none - pap type: string description: 'Authentication protocol used for PPPoE when `type`==`pppoe`. enum: `chap`, `none`, `pap`.' day_of_week1: title: day_of_week1 enum: - any - fri - mon - sat - sun - thu - tue - wed type: string description: 'Scheduled weekday for automatic signature updates. enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`.' switch_matching1: title: switch_matching1 type: object properties: enable: type: boolean description: Whether custom switch matching rules are enabled rules: uniqueItems: true type: array items: $ref: '#/components/schemas/switch_matching_rule' description: Switch matching rules evaluated to apply custom configuration description: Rules for matching switches to model-specific settings ap_radio_band53: title: ap_radio_band53 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 5 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 5 GHz radio contentEncoding: int32 default: 0 antenna_beam_pattern: allOf: - $ref: '#/components/schemas/radio_band_antenna_beam_pattern3' - description: 'Beam pattern used by the 5 GHz radio antenna. enum: `narrow`, `medium`, `wide`.' antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode1' - description: 'Radio chain mode for the 5 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth52' - description: 'Channel width configured for the 5 GHz radio. enum: `0`, `20`, `40`, `80`.' examples: - 40 channel: type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 100 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 5 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 6 power_max: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 17 minimum: 5 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble1' - description: '802.11 preamble mode used by the 5 GHz radio. enum: `auto`, `long`, `short`.' description: 5 GHz radio settings for this access point account_oauth_info_account_service_connection: title: account_oauth_info_account_service_connection type: object properties: region: type: string description: Prisma Access region where this service connection is provisioned examples: - us-southwest description: Prisma Access service connection region for a linked OAuth account push_policy_push_window1: title: push_policy_push_window1 type: object properties: enabled: type: boolean description: Whether configuration pushes are limited to the configured push window default: false hours: allOf: - $ref: '#/components/schemas/hours1' - description: Day-of-week hour ranges when configuration pushes are allowed description: Allowed time window during which configuration pushes may run allow_deny2: title: allow_deny2 enum: - allow - deny type: string description: Allow or deny action for traffic matched by this service policy ap_uplink_port_config3: title: ap_uplink_port_config3 type: object properties: dot1x: type: boolean description: Whether to do 802.1x against uplink switch. When enabled, AP cert will be used to do EAP-TLS and the Org's CA Cert has to be provisioned at the switch default: false keep_wlans_up_if_down: type: boolean description: By default, WLANs are disabled when uplink is down. In some scenario, like SiteSurvey, one would want the AP to keep sending beacons. default: false description: AP uplink port configuration for the site dot11_bandwidth52: title: dot11_bandwidth52 enum: - 0 - 20 - 40 - 80 type: integer description: 'Channel width configured for the 5 GHz radio. enum: `0`, `20`, `40`, `80`.' examples: - 40 app_probing1: title: app_probing1 type: object properties: apps: type: array items: type: string description: Predefined application keys to probe examples: - - facebook custom_apps: type: array items: $ref: '#/components/schemas/app_probing_custom_app' description: User-defined application probe definitions enabled: type: boolean description: Whether gateway application probing is enabled description: Application probing configuration for gateway monitoring response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response wan_extra_routes: title: wan_extra_routes type: object properties: via: type: string description: IPv4 next-hop address for this WAN extra route contentEncoding: ipv4 description: Additional IPv4 route for a WAN interface snmp_vacm_access_item_prefix_list_item_model2: title: snmp_vacm_access_item_prefix_list_item_model2 enum: - any - usm - v1 - v2c type: string description: 'Required security model for this VACM access rule. enum: `any`, `usm`, `v1`, `v2c`.' mxcluster_radsec_src_ip_source2: title: mxcluster_radsec_src_ip_source2 enum: - any - oob - oob6 - tunnel - tunnel6 type: string description: 'Connection source interface or address used when reaching RADIUS servers. enum: `any`, `oob`, `oob6`, `tunnel`, `tunnel6`.' tunnel_config_auth_algo1: title: tunnel_config_auth_algo1 enum: - md5 - sha1 - sha2 type: string description: 'Integrity algorithm used by this IPsec proposal. enum: `md5`, `sha1`, `sha2`.' tunnel_config_version2: title: tunnel_config_version2 enum: - '1' - '2' type: string description: 'Only if `provider`==`custom-gre` or `provider`==`custom-ipsec`. Tunnel version value for custom tunnel configuration. enum: `1`, `2`.' site_setting_wan_vna2: title: site_setting_wan_vna2 type: object properties: enabled: type: boolean description: Whether WAN VNA is enabled for the site default: false description: Virtual Network Assistant settings for WAN experiences at the site switch_port_usage: title: switch_port_usage type: object properties: all_networks: type: boolean description: Only if `mode`==`trunk`. Whether to trunk all network/vlans default: false allow_dhcpd: type: boolean description: 'Only applies when `mode`!=`dynamic`. Controls whether DHCP server traffic is allowed on ports using this configuration if DHCP snooping is enabled. This is a tri-state setting; `true`: ports become trusted ports allowing DHCP server traffic, `false`: ports become untrusted blocking DHCP server traffic, undefined: use system defaults (access ports default to untrusted, trunk ports default to trusted).' allow_multiple_supplicants: type: boolean description: Only if `mode`!=`dynamic` default: false bypass_auth_when_server_down: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Bypass auth for known clients if set to true when RADIUS server is down default: false bypass_auth_when_server_down_for_unknown_client: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`=`dot1x`. Bypass auth for all (including unknown clients) if set to true when RADIUS server is down default: false bypass_auth_when_server_down_for_voip: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Bypass auth for VOIP if set to true when RADIUS server is down default: false community_vlan_id: type: integer description: Only if `mode`!=`dynamic`. To be used together with `isolation` under networks. Signaling that this port connects to the networks isolated but wired clients belong to the same community can talk to each other contentEncoding: int32 description: type: string description: Only if `mode`!=`dynamic` disable_autoneg: type: boolean description: Only if `mode`!=`dynamic`. If speed and duplex are specified, whether to disable autonegotiation default: false disabled: type: boolean description: Only if `mode`!=`dynamic`. Whether the port is disabled default: false duplex: allOf: - $ref: '#/components/schemas/switch_port_usage_duplex2' - description: 'Only if `mode`!=`dynamic`. Link duplex mode for this port usage. enum: `auto`, `full`, `half`.' dynamic_vlan_networks: type: array items: type: string description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Networks or VLANs that RADIUS can return for dynamic VLAN assignment examples: - - corp - user enable_mac_auth: type: boolean description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Whether to enable MAC Auth default: false enable_qos: type: boolean description: Only if `mode`!=`dynamic` default: false guest_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Which network to put the device into if the device cannot do dot1x. default is null (i.e. not allowed) inter_isolation_network_link: type: boolean description: Only if `mode`!=`dynamic`. `inter_isolation_network_link` is used together with `isolation` under networks, signaling that this port connects to isolated networks default: false inter_switch_link: type: boolean description: 'Only if `mode`!=`dynamic`. `inter_switch_link` is used together with `isolation` under networks. NOTE: `inter_switch_link` works only between Juniper devices. This has to be applied to both ports connected together' default: false mac_auth_only: type: boolean description: Only if `mode`!=`dynamic` and `enable_mac_auth`==`true` mac_auth_preferred: type: boolean description: Only if `mode`!=`dynamic` + `enable_mac_auth`==`true` + `mac_auth_only`==`false`, dot1x will be given priority then mac_auth. Enable this to prefer mac_auth over dot1x. mac_auth_protocol: allOf: - $ref: '#/components/schemas/switch_port_usage_mac_auth_protocol2' - description: 'Only if `mode`!=`dynamic` and `enable_mac_auth`==`true`. MAC authentication protocol to use; ignored if Mist NAC is enabled. enum: `eap-md5`, `eap-peap`, `pap`.' mac_limit: anyOf: - maximum: 16383 minimum: 0 type: integer contentEncoding: int32 default: 0 - type: string description: Only if `mode`!=`dynamic`. Maximum number of MAC addresses allowed on the port; 0 means unlimited mode: allOf: - $ref: '#/components/schemas/switch_port_usage_mode2' - description: 'Switching mode for this port usage. enum: `access`, `dynamic`, `inet`, `trunk`.' mtu: anyOf: - maximum: 9216 minimum: 256 type: integer contentEncoding: int32 - type: string description: Only if `mode`!=`dynamic`. MTU for ports using this port usage networks: type: array items: type: string description: Only if `mode`==`trunk`. Network or VLAN names to trunk persist_mac: type: boolean description: Only if `mode`==`access` and `port_auth`!=`dot1x`. Whether the port should retain dynamically learned MAC addresses default: false poe_disabled: type: boolean description: Only if `mode`!=`dynamic`. Whether PoE capabilities are disabled for a port default: false poe_keep_state_when_reboot: type: boolean description: Only if `mode`!=`dynamic`. Whether Perpetual PoE is enabled; keeps PoE state across reboots default: false poe_priority: allOf: - $ref: '#/components/schemas/poe_priority3' - description: 'Only if `mode`!=`dynamic`. PoE priority for ports using this port usage. enum: `low`, `high`.' port_auth: allOf: - oneOf: - {} - $ref: '#/components/schemas/switch_port_usage_dot1x2' - description: 'Only if `mode`!=`dynamic`. 802.1X authentication mode for this port usage. enum: `dot1x`.' port_network: type: string description: Only if `mode`!=`dynamic`. Native network/vlan for untagged traffic reauth_interval: anyOf: - maximum: 65535 minimum: 10 type: integer contentEncoding: int32 default: 3600 - type: string description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. RADIUS reauthentication interval for clients on the port reset_default_when: allOf: - $ref: '#/components/schemas/switch_port_usage_dynamic_reset_default_when2' - description: 'Only if `mode`==`dynamic`. Condition that resets a dynamic port to the default port usage. enum: `link_down`, `none`.' examples: - link_down rules: type: array items: $ref: '#/components/schemas/switch_port_usage_dynamic_rule' description: Only if `mode`==`dynamic`. Dynamic matching rules that select the port usage to apply server_fail_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Sets server fail fallback vlan server_fail_retry_interval: maximum: 65535 minimum: 120 type: integer description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. Interval, in seconds. Sets the wait time before retrying authentication after RADIUS failure to reduce client flapping. Range 120-65535 contentEncoding: int32 default: 120 server_reject_network: type: - string - 'null' description: Only if `mode`!=`dynamic` and `port_auth`==`dot1x`. When RADIUS server reject / fails speed: allOf: - $ref: '#/components/schemas/switch_port_usage_speed2' - description: 'Only if `mode`!=`dynamic`. Link speed for this port usage. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' storm_control: allOf: - $ref: '#/components/schemas/switch_port_usage_storm_control2' - description: Only if `mode`!=`dynamic`. Storm-control settings for this port usage stp_disable: type: boolean description: Only if `mode`!=`dynamic` and `stp_required`==`false`. Drop bridge protocol data units (BPDUs ) that enter any interface or a specified interface default: false stp_edge: type: boolean description: Only if `mode`!=`dynamic`. When enabled, the port is not expected to receive BPDU frames default: false stp_no_root_port: type: boolean description: Only if `mode`!=`dynamic` default: false stp_p2p: type: boolean description: Only if `mode`!=`dynamic` default: false stp_required: type: boolean description: Only if `mode`!=`dynamic`. Whether to remain in block state if no BPDU is received default: false ui_evpntopo_id: type: string description: Optional for Campus Fabric Core-Distribution ESI-LAG profile. Helper used by the UI to select this port profile as the ESI-Lag between Distribution and Access switches contentEncoding: uuid use_vstp: type: boolean description: If this is connected to a vstp network default: false voip_network: type: - string - 'null' description: Only if `mode`!=`dynamic`. Network/vlan for voip traffic, must also set port_network. to authenticate device, set port_auth description: Junos switch port usage template and authentication settings gateway_matching_rule: title: gateway_matching_rule type: object properties: additional_config_cmds: type: array items: type: string description: For SRX only, additional Junos CLI commands appended when this gateway matching rule applies name: type: string description: Display name for the gateway matching rule port_config: type: object additionalProperties: $ref: '#/components/schemas/gateway_port_config' description: Property key is the port(s) name or range (e.g. "ge-0/0/0-10"). additionalProperties: type: string description: 'Property key defines the type of matching. e.g: `match_name[0:3]`, `match_model[0-6]` or `match_role`' description: Gateway matching rule that applies settings when its match keys select a gateway ip_type2: title: ip_type2 enum: - dhcp - static type: string description: 'IP assignment mode for the out-of-band management interface. enum: `dhcp`, `static`.' examples: - static tunnel_config_node_probe_http2: title: tunnel_config_node_probe_http2 type: object properties: accepted_status_codes: type: array items: type: integer contentEncoding: int32 description: HTTP response status codes that indicate a successful probe. Defaults to 200 if not specified. examples: - - 204 urls: type: array items: type: string description: HTTP or HTTPS URLs to probe examples: - - http://www.google.com/generate_204 - https://www.google.com/generate_204 description: HTTP probe settings for this tunnel node; success from any ICMP or HTTP probe indicates the tunnel is up mxcluster_nac_client_vendor2: title: mxcluster_nac_client_vendor2 enum: - aruba - cisco-aironet - cisco-dnac - cisco-ios - cisco-meraki - brocade - generic - juniper - paloalto type: string description: 'RADIUS client vendor profile for this IP or subnet. enum: `aruba`, `cisco-aironet`, `cisco-dnac`, `cisco-ios`, `cisco-meraki`, `brocade`, `generic`, `juniper`, `paloalto`.' examples: - cisco-ios snmp_usm_user: title: snmp_usm_user type: object properties: authentication_password: minLength: 7 type: string description: Not required if `authentication_type`==`authentication-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters. authentication_type: allOf: - $ref: '#/components/schemas/snmp_usm_user_authentication_type2' - description: 'Authentication protocol used by this SNMPv3 USM user. enum: `authentication-md5`, `authentication-none`, `authentication-sha`, `authentication-sha224`, `authentication-sha256`, `authentication-sha384`, `authentication-sha512`.' encryption_password: minLength: 8 type: string description: Not required if `encryption_type`==`privacy-none`. Include alphabetic, numeric, and special characters, but it cannot include control characters encryption_type: allOf: - $ref: '#/components/schemas/snmp_usm_user_encryption_type2' - description: 'Privacy protocol used by this SNMPv3 USM user. enum: `privacy-3des`, `privacy-aes128`, `privacy-des`, `privacy-none`.' name: type: string description: Username for the SNMPv3 USM user description: SNMPv3 USM user definition tunnel_config_auto_provision_node1: title: tunnel_config_auto_provision_node1 type: object properties: probe_ips: uniqueItems: true type: array items: type: string description: Probe IP addresses used to monitor auto-provisioned tunnel reachability wan_names: type: array items: type: string description: WAN interface names used by the auto-provisioned tunnel endpoint description: Backup auto-provisioned tunnel endpoint settings vs_instance_property: title: vs_instance_property type: object properties: networks: type: array items: type: string description: List of network names included in this virtual-switch instance description: EX9200 virtual-switch instance settings switch_matching_rule: title: switch_matching_rule type: object properties: additional_config_cmds: type: array items: type: string description: Additional Junos CLI commands applied when this matching rule matches default_port_usage: type: string description: 'Port usage to assign to switch ports without any port usage assigned. Default: `default` to preserve default behavior' default: default ip_config: allOf: - $ref: '#/components/schemas/switch_matching_rule_ip_config2' - description: In-band management IP configuration applied when this matching rule matches name: maxLength: 32 minLength: 1 type: string description: 'Rule name. WARNING: the name `default` is reserved and can only be used for the last rule in the list' oob_ip_config: allOf: - $ref: '#/components/schemas/switch_matching_rule_oob_ip_config2' - description: Out-of-band management IP configuration applied when this matching rule matches port_config: type: object additionalProperties: $ref: '#/components/schemas/junos_port_config' description: Per-port wired configuration applied when this matching rule matches port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Port mirroring configuration applied when this matching rule matches stp_config: allOf: - $ref: '#/components/schemas/switch_stp_config2' - description: Spanning Tree Protocol configuration applied when this matching rule matches switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt2' - description: Management-plane settings applied when this matching rule matches additionalProperties: type: string description: "Property key defines the type of matching, value is the string to match. e.g:\n * `match_name[0:3]`: switch name must match the first 3 letters of the property value\n * `match_name[2:6]`: switch name must match the property value from the 2nd to the 6th letter\n * `match_model[0-8]`: switch model must match the first 8 letters of the property value\n * `match_role`: switch role must match the property value" examples: - match_model: EX4300 match_name[0:3]: abc gateway_path_preferences: title: gateway_path_preferences type: object properties: paths: type: array items: $ref: '#/components/schemas/gateway_path_preferences_path' description: Candidate paths evaluated for this gateway path preference strategy: allOf: - $ref: '#/components/schemas/gateway_path_strategy2' - description: 'Selection strategy used to evaluate the candidate paths. enum: `ecmp`, `ordered`, `weighted`.' description: Gateway path preference that selects among one or more local, WAN, VPN, or tunnel paths sle_thresholds2: title: sle_thresholds2 type: object properties: capacity: maximum: 50 minimum: 5 type: integer description: Threshold percentage for capacity SLE scoring contentEncoding: int32 default: 20 coverage: maximum: -60 minimum: -90 type: integer description: RSSI threshold for coverage SLE scoring, in dBm contentEncoding: int32 default: -72 throughput: maximum: 100 minimum: 1 type: integer description: Minimum throughput threshold for SLE scoring, in Mbps contentEncoding: int32 default: 10 time-to-connect: maximum: 10 minimum: 2 type: integer description: Time to connect, in seconds contentEncoding: int32 default: 4 description: Service level expectation threshold settings for the site switch_mist_nac3: title: switch_mist_nac3 type: object properties: enabled: type: boolean description: Whether Mist NAC RadSec is enabled for the switch network: type: string description: Switch network used for Mist NAC RadSec connectivity description: Network access control settings for switches at the site dhcpd_config_vendor_option_type2: title: dhcpd_config_vendor_option_type2 enum: - boolean - hex - int16 - int32 - ip - string - uint16 - uint32 type: string description: 'Data type used to encode this vendor option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' remote_syslog_severity3: title: remote_syslog_severity3 enum: - alert - any - critical - emergency - error - info - notice - warning type: string description: 'Syslog severity to match for this selector. enum: `alert`, `any`, `critical`, `emergency`, `error`, `info`, `notice`, `warning`.' tunnel_config_protocol2: title: tunnel_config_protocol2 enum: - gre - ipsec type: string description: 'Only if `provider`==`custom-ipsec`. Tunnel protocol for custom tunnel negotiation. enum: `gre`, `ipsec`.' gateway_extra_route: title: gateway_extra_route type: object properties: via: type: string description: Next-hop IPv4 address for the gateway extra route contentEncoding: ipv4 description: Gateway IPv4 extra route next-hop settings switch_port_usage_speed2: title: switch_port_usage_speed2 enum: - 10m - 100m - 1g - 2.5g - 5g - 10g - 25g - 40g - 100g - auto type: string description: 'Only if `mode`!=`dynamic`. Link speed for this port usage. enum: `10m`, `100m`, `1g`, `2.5g`, `5g`, `10g`, `25g`, `40g`, `100g`, `auto`.' service_policy_syslog2: title: service_policy_syslog2 type: object properties: enabled: type: boolean description: Whether syslog logging is enabled for the service policy default: false server_names: type: array items: type: string description: Names of syslog servers that receive logs for this service policy examples: - - dc_syslog_server description: Remote logging settings applied by this service policy gateway_template_type2: title: gateway_template_type2 enum: - spoke - standalone type: string description: 'Gateway template deployment type. enum: `spoke`, `standalone`.' examples: - standalone ssr_upgrade_channel4: title: ssr_upgrade_channel4 enum: - alpha - beta - stable type: string description: 'Firmware release channel used for SSR auto-upgrade. enum: `alpha`, `beta`, `stable`.' ip_type5: title: ip_type5 enum: - dhcp - static type: string description: 'IP assignment mode for the node1 out-of-band management interface. enum: `dhcp`, `static`.' examples: - static service_policy_skyatp_iot_device_policy2: title: service_policy_skyatp_iot_device_policy2 type: object properties: enabled: type: boolean description: Whether Sky ATP IoT device policy inspection is enabled description: Device threat policy settings provided by Sky ATP for IoT clients vrf_extra_route6: title: vrf_extra_route6 type: object properties: via: type: string description: IPv6 next-hop address for this VRF extra route contentEncoding: ipv6 description: Additional IPv6 static route for a VRF instance site_mxtunnel1: title: site_mxtunnel1 type: object properties: additional_mxtunnels: type: object additionalProperties: $ref: '#/components/schemas/site_mxtunnel_additional_mxtunnel' description: Additional named Mist Tunnel definitions configured for the site ap_subnets: type: array items: type: string description: AP source subnets allowed to establish Mist Tunnels auto_preemption: allOf: - $ref: '#/components/schemas/auto_preemption1' - description: Preemption behavior for restoring preferred tunnel peers after failover clusters: type: array items: $ref: '#/components/schemas/site_mxtunnel_cluster' description: Tunnel peer clusters used by APs for this site Mist Tunnel created_time: type: number description: Timestamp when the site Mist Tunnel configuration was created readOnly: true enabled: type: boolean description: Whether site Mist Tunnel tunneling is enabled for_site: type: boolean description: Whether this Mist Tunnel configuration is scoped to a site readOnly: true hello_interval: maximum: 300 minimum: 1 type: integer description: In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by hello_retries contentEncoding: int32 default: 60 examples: - 60 hello_retries: maximum: 30 minimum: 2 type: integer description: Number of missed hello heartbeats before an AP tries another tunnel peer contentEncoding: int32 default: 7 examples: - 3 hosts: type: array items: type: string description: Tunnel peer hostnames or IP addresses reachable from APs id: type: string description: Unique value identifying the site Mist Tunnel configuration contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f modified_time: type: number description: Timestamp when the site Mist Tunnel configuration was last modified readOnly: true mtu: maximum: 1500 minimum: 0 type: integer description: 0 to enable MTU, 552-1500 to start MTU with a lower MTU contentEncoding: int32 default: 0 examples: - 1100 org_id: type: string description: Identifier of the org that owns the site Mist Tunnel configuration contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 protocol: allOf: - $ref: '#/components/schemas/mxtunnel_protocol2' - description: 'Encapsulation protocol used for the site Mist Tunnel. enum: `ip`, `udp`.' radsec: allOf: - $ref: '#/components/schemas/site_mxtunnel_radsec2' - description: TLS-secured RADIUS proxy settings for the site Mist Tunnel site_id: type: string description: Identifier of the site that owns this Mist Tunnel configuration contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 vlan_ids: type: array items: type: integer contentEncoding: int32 description: List of VLAN IDs carried by this site Mist Tunnel description: Site Mist Tunnel configuration dhcpd_config_vendor_option: title: dhcpd_config_vendor_option type: object properties: type: allOf: - $ref: '#/components/schemas/dhcpd_config_vendor_option_type2' - description: 'Data type used to encode this vendor option value. enum: `boolean`, `hex`, `int16`, `int32`, `ip`, `string`, `uint16`, `uint32`.' value: type: string description: Option value to send for this vendor option description: Vendor-encapsulated DHCP option value switch_radius_config3: title: switch_radius_config3 type: object properties: acct_immediate_update: type: boolean description: Whether immediate RADIUS accounting updates are sent acct_interim_interval: maximum: 65535 minimum: 0 type: integer description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled contentEncoding: int32 default: 0 acct_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_acct_server' description: RADIUS accounting servers used by this switch configuration auth_server_selection: allOf: - $ref: '#/components/schemas/switch_radius_config_auth_server_selection2' - description: 'Selection strategy for RADIUS authentication servers. enum: `ordered`, `unordered`.' auth_servers: uniqueItems: true type: array items: $ref: '#/components/schemas/radius_auth_server' description: RADIUS authentication servers used by this switch configuration auth_servers_retries: type: integer description: RADIUS auth session retries contentEncoding: int32 default: 3 auth_servers_timeout: type: integer description: RADIUS auth session timeout contentEncoding: int32 default: 5 coa_enabled: type: boolean description: Whether RADIUS Change of Authorization (CoA) is enabled default: false coa_port: anyOf: - maximum: 65545 minimum: 1 type: integer contentEncoding: int32 - type: string description: UDP port used for RADIUS Change of Authorization (CoA) fast_dot1x_timers: type: boolean description: Whether fast 802.1X timers are enabled for RADIUS authentication default: false network: type: string description: Use `network`or `source_ip`. Which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip source_ip: type: string description: Use `network` or `source_ip`. Explicit source IP address for RADIUS traffic description: RADIUS authentication and accounting defaults in this network template account_oauth_info_account: title: account_oauth_info_account type: object properties: account_id: type: string description: Linked app account id readOnly: true examples: - iojzXIJWEuiD73ZvydOfg auto_probe_subnet: type: string description: For Prisma accounts only, tunnel auto probe subnet readOnly: true examples: - 11.0.0.0/8 client_id: type: string description: Customer account Client ID readOnly: true cloud_name: type: string description: Name of the company whose account mist has subscribed to readOnly: true examples: - Tapi.sase.paloaltonetworks.com company: type: string description: Name of the company whose account mist has subscribed to readOnly: true examples: - Test Company1 Ltd enable_probe: type: boolean description: For Prisma accounts only, tunnel probe enable/disable readOnly: true examples: - false error: type: string description: This error is provided when the account fails to fetch token/data readOnly: true examples: - OAuth token refresh failed, please re-link your account errors: type: array items: type: string description: Problems reported during OAuth token refresh or account data sync readOnly: true examples: - - OAuth token refresh failed, please re-link your account - API daily rate limit reached for your account instance_url: type: string description: Customer account instance URL readOnly: true key_id: type: string description: For ZDX Account only, Customer account API key ID examples: - L72frZcK3JvrZc last_status: type: string description: Is the last data pull for account is successful or not readOnly: true examples: - failed last_sync: type: integer description: Last data pull timestamp, background jobs that pull account data contentEncoding: int64 readOnly: true examples: - 1665465339000 linked_by: type: string description: First name of the user who linked the account readOnly: true examples: - Testname1 linked_timestamp: type: number description: Timestamp when this third-party account was linked readOnly: true examples: - 1665465339000 max_daily_api_requests: type: integer description: Zoom daily api request quota, https://developers.zoom.us/docs/api/rest/rate-limits/ contentEncoding: int32 readOnly: true examples: - 5000 name: type: string description: Display name of the linked third-party account or company readOnly: true examples: - Test Compay1 Ltd password: type: string description: Customer account password instance URL contentEncoding: password readOnly: true region: type: string description: For Prisma accounts only readOnly: true examples: - americas regions: type: object additionalProperties: $ref: '#/components/schemas/account_oauth_info_account_region' description: Prisma Access regions with allocated bandwidth for this linked account service_account_name: type: string description: For Prisma accounts only readOnly: true examples: - Corp SA service_connections: type: object additionalProperties: $ref: '#/components/schemas/account_oauth_info_account_service_connection' description: Prisma Access service connections configured for this linked account smartgroup_name: type: string description: Smart group membership for determining compliance status readOnly: true examples: - CompliantGroup1 tsg_id: type: string description: For Prisma accounts only, Prisma Tenant Service Group id readOnly: true examples: - '189953456' username: type: string description: Login name configured for the linked third-party account readOnly: true webhook_auth_type: type: string description: For Crowdstrike, JAMF, SentinelOne and VMWare accounts only examples: - Basic - Bearer webhook_enabled: type: boolean description: For Crowdstrike, JAMF, SentinelOne and VMWare accounts only webhook_password: type: string description: For VMWare accounts only contentEncoding: password examples: - password_1234 webhook_secret: type: string description: For Crowdstrike accounts only contentEncoding: password examples: - secret-value webhook_token: type: string description: For JAMF and SentinelOne accounts only examples: - token-value webhook_url: type: string description: For Crowdstrike, JAMF, SentinelOne and VMWare accounts only examples: - https://websync.nac-staging.mistsys.com/v1/S_org-8dcbe9005/ae9dee49-69e7-4710-a114-5b827a777738/crowdstrike/edr - https://websync.nac-staging.mistsys.com/v1/S_org-8dcbe9005/ae9dee49-69e7-4710-a114-5b827a777738/jamf/mdm - https://websync.nac-staging.mistsys.com/v1/S_org-8dcbe9005/00fd8b39-cf92-4b43-a2ff-a461b48e7059/sentinelone/edr - https://websync.nac-staging.mistsys.com/v1/S_41b2525af1d8dcbe9005/f43ea4c48f22/vmware/mdm webhook_username: type: string description: For VMWare accounts only examples: - username_1234 zdx_org_id: type: string description: For ZDX Account only, ZDX organization id examples: - '123456' description: OAuth linked apps account info site_setting_mxedge2: title: site_setting_mxedge2 type: object properties: mist_das: allOf: - $ref: '#/components/schemas/mxedge_das2' - description: DAS service settings for the site Mist Edge cluster mist_nac: allOf: - $ref: '#/components/schemas/mxcluster_nac2' - description: RADIUS settings for Mist NAC on the site Mist Edge cluster mist_nacedge: allOf: - $ref: '#/components/schemas/mist_nacedge1' - description: NAC Edge service settings for the site Mist Edge cluster radsec: allOf: - $ref: '#/components/schemas/mxcluster_radsec2' - description: TLS-secured RADIUS proxy settings for the site Mist Edge cluster description: Site Mist Edge service settings synthetictest_config_custom_probe_type3: title: synthetictest_config_custom_probe_type3 enum: - application - curl - icmp - reachability - tcp type: string description: 'Probe type used by this custom synthetic probe. enum: `application`, `curl`, `icmp`, `reachability`, `tcp`.' tunnel_provider_options_jse2: title: tunnel_provider_options_jse2 type: object properties: num_users: type: integer description: User capacity to provision on Juniper Secure Edge contentEncoding: int32 examples: - 5 org_name: type: string description: JSE Organization name. The list of available organizations can be retrieved with the [Get Org JSE Info]($e/Orgs%20Integration%20JSE/getOrgJseInfo) API Call examples: - JSE_ORG1 description: Juniper Secure Edge provisioning options for tunnel endpoints dhcpd_config_fixed_binding: title: dhcpd_config_fixed_binding type: object properties: ip: type: string description: Reserved IPv4 address for this fixed DHCP binding examples: - 192.168.70.35 ip6: type: string description: Reserved IPv6 address for this fixed DHCP binding examples: - 2607:f8b0:4005:808::2 name: type: string description: Friendly name for this fixed DHCP binding description: Static DHCP binding for a client MAC address network_internet_access_static_nat_property: title: network_internet_access_static_nat_property type: object properties: internal_ip: type: string description: The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.3 name: type: string description: Label for this direct internet static NAT rule examples: - pos_station-1 wan_name: type: string description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}") examples: - wan0 description: Direct-internet static NAT rule target settings acl_tag_type2: title: acl_tag_type2 enum: - any - aruba_user_role - dynamic_gbp - gbp_resource - mac - network - port_usage - radius_group - resource - static_gbp - subnet type: string description: 'Classifier type that determines which ACL tag fields are evaluated. enum: `any`, `aruba_user_role`, `dynamic_gbp`, `gbp_resource`, `mac`, `network`, `port_usage`, `radius_group`, `resource`, `static_gbp`, `subnet`.' idp_profile_overwrite: title: idp_profile_overwrite type: object properties: action: allOf: - $ref: '#/components/schemas/idp_profile_action2' - description: 'Enforcement action applied when this overwrite rule matches. enum: `alert`, `close`, `drop`.' examples: - alert matching: allOf: - $ref: '#/components/schemas/idp_profile_matching2' - description: Criteria that select signatures for this overwrite rule name: type: string description: Display name for this IDP profile overwrite rule description: Override rule that changes the IDP action for matching signatures remote_syslog_console2: title: remote_syslog_console2 type: object properties: contents: type: array items: $ref: '#/components/schemas/remote_syslog_content' description: Syslog facilities and severities forwarded from console logs description: Log forwarding filters for console messages sent to remote syslog ap_radio_band242: title: ap_radio_band242 type: object properties: allow_rrm_disable: type: boolean description: Whether RRM may disable the 2.4 GHz radio when optimizing RF settings default: false ant_gain: maximum: 10 minimum: 0 type: - integer - 'null' description: External antenna gain for the 2.4 GHz radio contentEncoding: int32 default: 0 antenna_mode: allOf: - $ref: '#/components/schemas/radio_band_antenna_mode4' - description: 'Radio chain mode for the 2.4 GHz radio. enum: `1x1`, `2x2`, `3x3`, `4x4`, `default`.' examples: - default bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth242' - description: 'Channel width configured for the 2.4 GHz radio. enum: `0`, `20`, `40`.' examples: - 20 channel: maximum: 13 minimum: 1 type: - integer - 'null' description: For Device. (primary) channel for the band, 0 means using the Site Setting contentEncoding: int32 examples: - 6 channels: type: - array - 'null' items: type: integer contentEncoding: int32 description: Allowed channel list for the 2.4 GHz radio; null or an empty array uses automatic selection default: [] disabled: type: boolean description: Whether to disable the radio default: false power: maximum: 25 minimum: 0 type: - integer - 'null' description: Radio Tx power, in dBm. Can be an integer 0-25 for static power configuration, or `null` or unset for auto power mode contentEncoding: int32 examples: - 3 power_max: maximum: 18 minimum: 3 type: - integer - 'null' description: When power=null/unset, max tx power to use, HW-specific values will be used if not set contentEncoding: int32 power_min: maximum: 18 minimum: 3 type: - integer - 'null' description: When power=null/unset, min tx power to use, HW-specific values will be used if not set contentEncoding: int32 preamble: allOf: - $ref: '#/components/schemas/radio_band_preamble4' - description: '802.11 preamble mode used by the 2.4 GHz radio. enum: `auto`, `long`, `short`.' description: 2.4 GHz radio settings for this access point snmp_usm: title: snmp_usm type: object properties: engine_type: allOf: - $ref: '#/components/schemas/snmp_usm_engine_type2' - description: 'SNMP engine type used for this USM configuration. enum: `local_engine`, `remote_engine`.' remote_engine_id: type: string description: Required only if `engine_type`==`remote_engine` examples: - 00:00:00:0b:00:00:70:10:6f:08:b6:3f users: type: array items: $ref: '#/components/schemas/snmp_usm_user' description: SNMPv3 USM users for this engine description: SNMPv3 User-based Security Model configuration snmp_config_view: title: snmp_config_view type: object properties: include: type: boolean description: Whether the root OID is included in this SNMP view oid: type: string description: Root OID for this SNMP view examples: - 1.3.6.1 view_name: type: string description: Name of the SNMP MIB view definition examples: - all description: SNMP MIB view definition ble_config3: title: ble_config3 type: object properties: beacon_enabled: type: boolean description: Whether Mist beacons is enabled default: true beacon_rate: type: integer description: Required if `beacon_rate_mode`==`custom`, 1-10, in number-beacons-per-second contentEncoding: int32 examples: - 3 beacon_rate_mode: allOf: - $ref: '#/components/schemas/ble_config_beacon_rate_mode2' - description: 'Beacon rate mode for Mist BLE beacons; use custom to set beacon_rate. enum: `custom`, `default`.' examples: - custom beam_disabled: type: array items: type: integer contentEncoding: int32 description: AP BLE beam numbers disabled for location advertisements examples: - - 1 - 3 - 6 custom_ble_packet_enabled: type: boolean description: Can be enabled if `beacon_enabled`==`true`, whether to send custom packet default: false custom_ble_packet_frame: type: string description: The custom frame to be sent out in this beacon. The frame must be a hexstring examples: - 0x........ custom_ble_packet_freq_msec: minimum: 0 type: integer description: Frequency (msec) of data emitted by custom ble beacon contentEncoding: int32 default: 0 examples: - 300 eddystone_uid_adv_power: maximum: 20 minimum: -100 type: integer description: Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default contentEncoding: int32 default: 0 examples: - -65 eddystone_uid_beams: type: string description: BLE beams used to transmit Eddystone-UID advertisements, expressed as ranges such as `2-4,7` examples: - 2-4,7 eddystone_uid_enabled: type: boolean description: Only if `beacon_enabled`==`false`, Whether Eddystone-UID beacon is enabled default: false eddystone_uid_freq_msec: type: integer description: Frequency (msec) of data emit by Eddystone-UID beacon contentEncoding: int32 default: 0 examples: - 200 eddystone_uid_instance: type: string description: Eddystone-UID instance for the device examples: - 5c5b35000001 eddystone_uid_namespace: type: string description: Eddystone-UID namespace broadcast by the AP, as a 10-byte hex string examples: - 2818e3868dec25629ede eddystone_url_adv_power: maximum: 20 minimum: -100 type: integer description: Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default contentEncoding: int32 default: 0 examples: - -65 eddystone_url_beams: type: string description: BLE beams used to transmit Eddystone-URL advertisements, expressed as ranges such as `2-4,7` examples: - 2-4,7 eddystone_url_enabled: type: boolean description: Only if `beacon_enabled`==`false`, Whether Eddystone-URL beacon is enabled default: false eddystone_url_freq_msec: type: integer description: Frequency (msec) of data emitted by Eddystone-URL beacon contentEncoding: int32 default: 0 examples: - 1000 eddystone_url_url: type: string description: URL pointed by Eddystone-URL beacon examples: - https://www.abc.com ibeacon_adv_power: maximum: 20 minimum: -100 type: integer description: Advertised TX Power, -100 to 20 (dBm), omit this attribute to use default contentEncoding: int32 default: 0 examples: - -65 ibeacon_beams: type: string description: BLE beams used to transmit iBeacon advertisements, expressed as ranges such as `2-4,7` examples: - 2-4,7 ibeacon_enabled: type: boolean description: Can be enabled if `beacon_enabled`==`true`, whether to send iBeacon default: false ibeacon_freq_msec: type: integer description: Frequency (msec) of data emit for iBeacon contentEncoding: int32 default: 0 ibeacon_major: maximum: 65535 minimum: 1 type: - integer - 'null' description: iBeacon major value broadcast by the AP contentEncoding: int32 examples: - 1234 ibeacon_minor: maximum: 65535 minimum: 1 type: - integer - 'null' description: iBeacon minor value broadcast by the AP contentEncoding: int32 examples: - 1234 ibeacon_uuid: type: string description: Optional, if not specified, the same UUID as the beacon will be used contentEncoding: uuid examples: - f3f17139-704a-f03a-2786-0400279e37c3 power: maximum: 10 minimum: 1 type: integer description: Required if `power_mode`==`custom`; else use `power_mode` as default contentEncoding: int32 default: 9 examples: - 6 power_mode: allOf: - $ref: '#/components/schemas/ble_config_power_mode3' - description: 'Transmit power mode for BLE beacons; use custom to set `power`. enum: `custom`, `default`.' examples: - custom description: Bluetooth Low Energy configuration applied to APs at the site radsec_server: title: radsec_server type: object properties: host: type: string description: Address or hostname of the RadSec server examples: - 1.1.1.1 port: maximum: 65535 minimum: 1 type: integer description: TCP port used by the RadSec server contentEncoding: int32 examples: - 1812 description: External RadSec server settings service_policy_skyatp_dns_tunnel_detection_profile2: title: service_policy_skyatp_dns_tunnel_detection_profile2 enum: - default - standard - strict type: string description: 'Sky ATP DNS tunneling detection profile to apply. enum: `default`, `standard`, `strict`.' account_oauth_info_account_region: title: account_oauth_info_account_region type: object properties: aggregate_region: type: string description: Bandwidth Aggregate region for this region examples: - us-southwest allocated_bandwidth: type: integer description: Allocated bandwidth for the region, in Mbps contentEncoding: int32 readOnly: true examples: - 1000 name: type: string description: Display name for this region examples: - US West description: Prisma Access region bandwidth allocation for a linked OAuth account site_setting_derived: title: site_setting_derived type: object properties: acl_policies: type: array items: $ref: '#/components/schemas/acl_policy' description: Access control policies configured for the site acl_tags: type: object additionalProperties: $ref: '#/components/schemas/acl_tag' description: Access control tag definitions available to site policies additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands applied through the site setting allow_mist: type: boolean description: whether to allow Mist to look at this org default: false analytic: allOf: - $ref: '#/components/schemas/site_setting_analytic2' - description: Advanced analytics configuration for the site ap_matching: allOf: - $ref: '#/components/schemas/site_setting_ap_matching2' - description: Rules that apply model-specific AP port configuration ap_port_config: allOf: - $ref: '#/components/schemas/site_setting_ap_port_config2' - description: Ethernet port configuration overrides for APs at the site ap_synthetic_test: allOf: - $ref: '#/components/schemas/site_setting_ap_synthetic_test2' - description: Synthetic test configuration for APs at the site ap_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: Enable threshold-based device down delivery for AP devices only. When configured it takes effect for AP devices and `device_updown_threshold` is ignored. contentEncoding: int32 default: 0 auto_placement: allOf: - $ref: '#/components/schemas/site_setting_auto_placement2' - description: Automatic AP placement settings for the site auto_upgrade: allOf: - $ref: '#/components/schemas/site_setting_auto_upgrade2' - description: Automatic AP firmware upgrade settings for the site. Overrides org setting when provided. auto_upgrade_esl: allOf: - $ref: '#/components/schemas/site_setting_auto_upgrade_esl2' - description: Automatic ESL firmware upgrade settings for the site auto_upgrade_linecard: type: boolean description: Whether line cards are included in automatic switch upgrades default: true bgp_neighbor_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based bgp neighbor down delivery. contentEncoding: int32 blacklist_url: type: string description: Read-only URL for the site blacklist file readOnly: true examples: - https://papi.s3.amazonaws.com/blacklist/xxx... ble_config: allOf: - $ref: '#/components/schemas/ble_config3' - description: Bluetooth Low Energy configuration applied to APs at the site config_auto_revert: type: boolean description: Whether to enable ap auto config revert default: false config_push_policy: allOf: - $ref: '#/components/schemas/site_setting_config_push_policy2' - description: Policy controlling how site configuration pushes are applied created_time: type: number description: Timestamp when the site settings were created readOnly: true critical_url_monitoring: allOf: - $ref: '#/components/schemas/site_setting_critical_url_monitoring2' - description: Monitoring configuration for critical URLs at the site device_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: By default, device_updown_threshold, if set, will apply to all devices types if different values for specific device type is desired, use the following contentEncoding: int32 default: 0 dhcp_snooping: allOf: - $ref: '#/components/schemas/dhcp_snooping4' - description: Layer 2 DHCP snooping settings for the site disabled_system_defined_port_usages: type: array items: $ref: '#/components/schemas/system_defined_port_usages' description: System-defined switch port usages disabled for the site dns_servers: type: array items: type: string description: Name server addresses configured for the site dns_suffix: type: array items: type: string description: Search suffixes used for DNS lookups at the site enable_unii_4: type: boolean description: Whether UNII-4 channels are enabled for the site default: false engagement: allOf: - $ref: '#/components/schemas/site_engagement1' - description: Dwell-time analytics rules for the site evpn_options: allOf: - $ref: '#/components/schemas/evpn_options3' - description: Fabric EVPN options for the site extra_routes: type: object additionalProperties: $ref: '#/components/schemas/extra_route' description: Additional IPv4 routes configured for the site examples: - 0.0.0.0/0: via: 192.168.1.10 extra_routes6: type: object additionalProperties: $ref: '#/components/schemas/extra_route6' description: Additional IPv6 routes configured for the site examples: - 2a02:1234:420a:10c9::/64: via: 2a02:1234:200a::100 flags: type: object additionalProperties: type: string description: Feature flags enabled for the site for_site: type: boolean description: Whether this settings object is scoped to a site readOnly: true gateway: allOf: - $ref: '#/components/schemas/gateway_template1' - description: Template settings applied to site gateways gateway_additional_config_cmds: type: array items: type: string description: Additional CLI configuration commands applied to gateways at the site gateway_mgmt: allOf: - $ref: '#/components/schemas/gateway_mgmt3' - description: Management access settings for gateways at the site gateway_tunnel_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based gateway tunnel (secure edge tunnels) up-down delivery. contentEncoding: int32 gateway_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: Enable threshold-based device down delivery for Gateway devices only. When configured it takes effect for GW devices and `device_updown_threshold` is ignored. contentEncoding: int32 default: 0 id: type: string description: Unique value identifying the site settings object contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f iotproxy: allOf: - $ref: '#/components/schemas/iotproxy1' - description: Proxy settings for IoT traffic at the site juniper_srx: allOf: - $ref: '#/components/schemas/site_setting_juniper_srx2' - description: SRX integration settings for the site led: allOf: - $ref: '#/components/schemas/ap_led3' - description: AP LED behavior configured for the site marvis: allOf: - $ref: '#/components/schemas/marvis1' - description: AI assistant settings for Marvis at the site mist_nac: allOf: - $ref: '#/components/schemas/switch_mist_nac3' - description: Network access control settings for switches at the site modified_time: type: number description: Timestamp when the site settings were last modified readOnly: true mxedge: allOf: - $ref: '#/components/schemas/site_setting_mxedge2' - description: Site Mist Edge service settings mxedge_mgmt: allOf: - $ref: '#/components/schemas/mxedge_mgmt4' - description: Mist Edge management access settings for the site mxtunnel: allOf: - $ref: '#/components/schemas/site_mxtunnel1' - description: Site Mist Tunnel configuration networks: type: object additionalProperties: $ref: '#/components/schemas/switch_network' description: Switch network definitions configured for the site ntp_servers: type: array items: type: string description: Time synchronization server addresses configured for the site occupancy: allOf: - $ref: '#/components/schemas/site_occupancy_analytics' - description: Analytics settings for site occupancy org_id: type: string description: Identifier of the org that owns the site settings contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 ospf_areas: type: object additionalProperties: $ref: '#/components/schemas/ospf_area' description: Routing area settings for OSPF on site switches paloalto_networks: allOf: - $ref: '#/components/schemas/site_setting_paloalto_networks2' - description: Firewall integration settings for Palo Alto Networks at the site persist_config_on_device: type: boolean description: Whether to store the config on AP default: false port_mirroring: type: object additionalProperties: $ref: '#/components/schemas/switch_port_mirroring_property' description: Switch port mirroring settings for the site port_usages: type: object additionalProperties: $ref: '#/components/schemas/switch_port_usage' description: Switch port usage profiles available at the site proxy: allOf: - $ref: '#/components/schemas/proxy3' - description: Network proxy settings for devices at the site radio_config: allOf: - $ref: '#/components/schemas/ap_radio3' - description: AP radio configuration for the site radius_config: allOf: - $ref: '#/components/schemas/switch_radius_config4' - description: Switch RADIUS configuration for the site remote_syslog: allOf: - $ref: '#/components/schemas/remote_syslog4' - description: Syslog forwarding settings for devices at the site remove_existing_configs: type: boolean description: By default, only the configuration generated by Mist is cleaned up during the configuration process. If `true`, all the existing configuration will be removed. default: false report_gatt: type: boolean description: Whether AP should periodically connect to BLE devices and report GATT device info (device name, manufacturer name, serial number, battery %, temperature, humidity) default: false rogue: allOf: - $ref: '#/components/schemas/site_rogue1' - description: AP threat detection settings for the site routing_policies: type: object additionalProperties: $ref: '#/components/schemas/sw_routing_policy' description: Switch routing policy definitions for the site rtsa: allOf: - $ref: '#/components/schemas/site_setting_rtsa2' - description: Managed mobility and asset tracking settings for the site simple_alert: allOf: - $ref: '#/components/schemas/simple_alert2' - description: Threshold alert settings for the site site_id: type: string description: Identifier of the site these settings apply to contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 skyatp: allOf: - $ref: '#/components/schemas/site_setting_skyatp2' - description: Threat intelligence settings from Sky ATP for the site sle_thresholds: allOf: - $ref: '#/components/schemas/sle_thresholds2' - description: Service level expectation threshold settings for the site snmp_config: allOf: - $ref: '#/components/schemas/snmp_config3' - description: Management polling settings for SNMP on site devices srx_app: allOf: - $ref: '#/components/schemas/site_setting_srx_app' - description: Juniper SRX application visibility settings for the site ssh_keys: type: array items: type: string description: Public SSH keys configured for the site ssr: allOf: - $ref: '#/components/schemas/setting_ssr2' - description: Session Smart Router settings for the site status_portal: allOf: - $ref: '#/components/schemas/site_setting_status_portal' - description: End-user status portal settings for the site switch: allOf: - $ref: '#/components/schemas/site_setting_switch2' - description: Site-level switch feature configuration switch_matching: allOf: - $ref: '#/components/schemas/switch_matching1' - description: Rules for matching switches to model-specific settings switch_mgmt: allOf: - $ref: '#/components/schemas/switch_mgmt4' - description: Management access settings for switches at the site switch_updown_threshold: maximum: 240 minimum: 0 type: - integer - 'null' description: Enable threshold-based device down delivery for Switch devices only. When configured it takes effect for SW devices and `device_updown_threshold` is ignored. contentEncoding: int32 default: 0 synthetic_test: allOf: - $ref: '#/components/schemas/synthetictest_config1' - description: Active monitoring test configuration for the site track_anonymous_devices: type: boolean description: Whether to track anonymous BLE assets (requires ‘track_asset’ enabled) default: false tunterm_monitoring: type: array items: $ref: '#/components/schemas/tunterm_monitoring_item' description: Tunnel termination monitoring settings for the Mist Edges assigned to the site tunterm_monitoring_disabled: type: boolean description: Whether tunnel termination monitoring is disabled for the site default: false tunterm_multicast_config: allOf: - $ref: '#/components/schemas/site_setting_tunterm_multicast_config2' - description: Multicast settings for tunnel termination at the site uplink_port_config: allOf: - $ref: '#/components/schemas/ap_uplink_port_config3' - description: AP uplink port configuration for the site uses_description_from_port_usage: type: boolean description: by default, we only honor description provided in port_config. This allows fallback to those defined in port_usages default: false uwb_config: allOf: - $ref: '#/components/schemas/ap_uwb_config3' - description: UWB RTLS (OMLOX asset visibility) settings for the site, only effective on AP models with a UWB radio and in countries where the UWB radio is permitted. Overridden by the device profile and device-level settings vars: type: object additionalProperties: type: string description: Template variables defined for the site examples: - RADIUS_IP1: 172.31.2.5 RADIUS_SECRET: 11s64632d vars_annotations: type: object additionalProperties: $ref: '#/components/schemas/vars_annotation' description: Metadata annotations for site template variables examples: - MXTUNNEL_GUEST: type: mxtunnel_id RADIUS_IP1: note: RADIUS server IP address for US East Campus vna: allOf: - $ref: '#/components/schemas/site_setting_vna2' - description: Virtual Network Assistant settings for the site vpn_path_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based vpn path down delivery. contentEncoding: int32 vpn_peer_updown_threshold: minimum: 0 type: - integer - 'null' description: enable threshold-based vpn peer down delivery. contentEncoding: int32 vrf_config: allOf: - $ref: '#/components/schemas/vrf_config6' - description: Routing instance configuration for the site vrf_instances: type: object additionalProperties: $ref: '#/components/schemas/switch_vrf_instance' description: Switch VRF instances configured for the site examples: - guest: extra_routes: 0.0.0.0/0: via: 192.168.31.1 networks: - guest vrrp_groups: type: object additionalProperties: $ref: '#/components/schemas/vrrp_group' description: High-availability VRRP group settings for the site vs_instance: type: object additionalProperties: $ref: '#/components/schemas/vs_instance_property' description: EX9200 virtual switch instance definitions for the site wan_vna: allOf: - $ref: '#/components/schemas/site_setting_wan_vna2' - description: Virtual Network Assistant settings for WAN experiences at the site watched_station_url: type: string description: Read-only URL for the watched station list file readOnly: true examples: - https://papi.s3.amazonaws.com/watched_station/xxx... whitelist_url: type: string description: Read-only URL for the site whitelist file readOnly: true examples: - https://papi.s3.amazonaws.com/whitelist/xxx... wids: allOf: - $ref: '#/components/schemas/site_wids2' - description: Wireless intrusion detection settings for the site wifi: allOf: - $ref: '#/components/schemas/site_wifi2' - description: Wireless LAN configuration settings for the site wired_vna: allOf: - $ref: '#/components/schemas/site_setting_wired_vna2' - description: Virtual Network Assistant settings for wired experiences at the site zone_occupancy_alert: allOf: - $ref: '#/components/schemas/site_zone_occupancy_alert2' - description: Occupancy alert settings for site zones account_id: type: string description: Linked app account id readOnly: true examples: - iojzXIJWEuiD73ZvydOfg auto_probe_subnet: type: string description: For Prisma accounts only, tunnel auto probe subnet readOnly: true examples: - 11.0.0.0/8 client_id: type: string description: Customer account Client ID readOnly: true cloud_name: type: string description: Name of the company whose account mist has subscribed to readOnly: true examples: - Tapi.sase.paloaltonetworks.com company: type: string description: Name of the company whose account mist has subscribed to readOnly: true examples: - Test Company1 Ltd enable_probe: type: boolean description: For Prisma accounts only, tunnel probe enable/disable readOnly: true examples: - false error: type: string description: This error is provided when the account fails to fetch token/data readOnly: true examples: - OAuth token refresh failed, please re-link your account errors: type: array items: type: string description: Problems reported during OAuth token refresh or account data sync readOnly: true examples: - - OAuth token refresh failed, please re-link your account - API daily rate limit reached for your account instance_url: type: string description: Customer account instance URL readOnly: true key_id: type: string description: For ZDX Account only, Customer account API key ID examples: - L72frZcK3JvrZc last_status: type: string description: Is the last data pull for account is successful or not readOnly: true examples: - failed last_sync: type: integer description: Last data pull timestamp, background jobs that pull account data contentEncoding: int64 readOnly: true examples: - 1665465339000 linked_by: type: string description: First name of the user who linked the account readOnly: true examples: - Testname1 linked_timestamp: type: number description: Timestamp when this third-party account was linked readOnly: true examples: - 1665465339000 max_daily_api_requests: type: integer description: Zoom daily api request quota, https://developers.zoom.us/docs/api/rest/rate-limits/ contentEncoding: int32 readOnly: true examples: - 5000 name: type: string description: Display name of the linked third-party account or company readOnly: true examples: - Test Compay1 Ltd password: type: string description: Customer account password instance URL contentEncoding: password readOnly: true region: type: string description: For Prisma accounts only readOnly: true examples: - americas regions: type: object additionalProperties: $ref: '#/components/schemas/account_oauth_info_account_region' description: Prisma Access regions with allocated bandwidth for this linked account service_account_name: type: string description: For Prisma accounts only readOnly: true examples: - Corp SA service_connections: type: object additionalProperties: $ref: '#/components/schemas/account_oauth_info_account_service_connection' description: Prisma Access service connections configured for this linked account smartgroup_name: type: string description: Smart group membership for determining compliance status readOnly: true examples: - CompliantGroup1 tsg_id: type: string description: For Prisma accounts only, Prisma Tenant Service Group id readOnly: true examples: - '189953456' username: type: string description: Login name configured for the linked third-party account readOnly: true webhook_auth_type: type: string description: For Crowdstrike, JAMF, SentinelOne and VMWare accounts only examples: - Basic - Bearer webhook_enabled: type: boolean description: For Crowdstrike, JAMF, SentinelOne and VMWare accounts only webhook_password: type: string description: For VMWare accounts only contentEncoding: password examples: - password_1234 webhook_secret: type: string description: For Crowdstrike accounts only contentEncoding: password examples: - secret-value webhook_token: type: string description: For JAMF and SentinelOne accounts only examples: - token-value webhook_url: type: string description: For Crowdstrike, JAMF, SentinelOne and VMWare accounts only examples: - https://websync.nac-staging.mistsys.com/v1/S_org-8dcbe9005/ae9dee49-69e7-4710-a114-5b827a777738/crowdstrike/edr - https://websync.nac-staging.mistsys.com/v1/S_org-8dcbe9005/ae9dee49-69e7-4710-a114-5b827a777738/jamf/mdm - https://websync.nac-staging.mistsys.com/v1/S_org-8dcbe9005/00fd8b39-cf92-4b43-a2ff-a461b48e7059/sentinelone/edr - https://websync.nac-staging.mistsys.com/v1/S_41b2525af1d8dcbe9005/f43ea4c48f22/vmware/mdm webhook_username: type: string description: For VMWare accounts only examples: - username_1234 zdx_org_id: type: string description: For ZDX Account only, ZDX organization id examples: - '123456' additionalProperties: allOf: - $ref: '#/components/schemas/account_oauth_info_account' - description: OAuth linked apps account info description: Site settings with derived OAuth account integration data remote_syslog4: title: remote_syslog4 type: object properties: archive: allOf: - $ref: '#/components/schemas/remote_syslog_archive3' - description: Retention settings for generated syslog archive files cacerts: type: array items: type: string description: CA certificates used to verify TLS syslog servers examples: - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----' - '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----' console: allOf: - $ref: '#/components/schemas/remote_syslog_console2' - description: Log forwarding filters for console messages sent to remote syslog enabled: type: boolean description: Whether remote syslog forwarding is enabled default: false files: type: array items: $ref: '#/components/schemas/remote_syslog_file_config' description: Local syslog file definitions to generate and forward network: type: string description: Source network used for syslog traffic. If `source_address` is configured, Mist uses the VLAN first; otherwise it uses `source_ip` examples: - default send_to_all_servers: type: boolean description: Whether each log entry is sent to all configured remote syslog servers default: false servers: type: array items: $ref: '#/components/schemas/remote_syslog_server' description: Remote syslog server destinations examples: - - facility: config host: syslogd.internal port: 514 protocol: udp severity: info tag: '' time_format: allOf: - $ref: '#/components/schemas/remote_syslog_time_format2' - description: 'Timestamp format used in forwarded syslog messages. enum: `millisecond`, `year`, `year millisecond`.' examples: - millisecond users: type: array items: $ref: '#/components/schemas/remote_syslog_user' description: User-specific syslog logging rules description: Syslog forwarding settings for devices at the site securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header