openapi: 3.2.0
info:
  title: Mist Sites Skyatp API
  description: '> Version: **2607.1.1**

    >

    > Date: **August 17, 2026**


    NOTE:

    Some important API changes will be introduced.'
  contact:
    name: Thomas Munzer
    email: tmunzer@juniper.net
  version: 2607.1.1
servers:
- url: https://api.mist.com
  variables: {}
- url: https://api.gc1.mist.com
  variables: {}
- url: https://api.ac2.mist.com
  variables: {}
- url: https://api.gc2.mist.com
  variables: {}
- url: https://api.gc4.mist.com
  variables: {}
- url: https://api.eu.mist.com
  variables: {}
- url: https://api.gc3.mist.com
  variables: {}
- url: https://api.ac6.mist.com
  variables: {}
- url: https://api.gc6.mist.com
  variables: {}
- url: https://api.ac5.mist.com
  variables: {}
- url: https://api.gc5.mist.com
  variables: {}
- url: https://api.gc7.mist.com
  variables: {}
security:
- apiToken: []
- csrfToken: []
tags:
- name: Sites Skyatp
  description: 'SkyATP is a cloud-based solution that provides advanced threat protection for network security.


    It allows security analysts to update their defense against new attack techniques in real-time and distribute threat intelligence quickly.


    SkyATP inspects network traffic and blocks devices that have downloaded malware or accessed command and control servers. It also offers configuration and troubleshooting capabilities for administrators.'
paths:
  /api/v1/sites/{site_id}/skyatp/events/count:
    parameters: []
    get:
      tags:
      - Sites Skyatp
      summary: countSiteSkyatpEvents
      description: Count by Distinct Attributes of Skyatp Events (WIP)
      operationId: countSiteSkyatpEvents
      parameters:
      - name: site_id
        in: path
        description: ''
        required: true
        schema:
          type: string
          contentEncoding: uuid
          examples:
          - 000000ab-00ab-00ab-00ab-0000000000ab
      - name: distinct
        in: query
        description: 'Field used to group this count response. enum: `device_mac`, `mac`, `threat_level`, `type`'
        style: form
        explode: true
        schema:
          allOf:
          - $ref: '#/components/schemas/site_sky_atp_events_count_distinct'
          - description: 'Field used to group this count response. enum: `device_mac`, `mac`, `threat_level`, `type`'
      - name: type
        in: query
        description: Event type, e.g. cc, fs, mw
        style: form
        explode: true
        schema:
          type: string
      - name: mac
        in: query
        description: Filter results by MAC address
        style: form
        explode: true
        schema:
          type: string
      - name: device_mac
        in: query
        description: Filter results by device MAC address
        style: form
        explode: true
        schema:
          type: string
      - name: threat_level
        in: query
        description: Filter results by threat level
        style: form
        explode: true
        schema:
          type: integer
          contentEncoding: int32
      - name: ip
        in: query
        description: Filter results by IPv4 address
        style: form
        explode: true
        schema:
          type: string
          contentEncoding: ipv4
          examples:
          - 192.168.1.1
      - name: start
        in: query
        description: Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d` or `-1w`
        style: form
        explode: true
        schema:
          type: string
      - name: end
        in: query
        description: Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d`, `-2h`, or `now`
        style: form
        explode: true
        schema:
          type: string
      - name: duration
        in: query
        description: Time range duration for the query, using relative units such as `10m`, `7d`, or `2w`
        style: form
        explode: true
        schema:
          type: string
          default: 1d
          examples:
          - 10m
      - name: limit
        in: query
        description: Maximum number of results to return per page
        style: form
        explode: true
        schema:
          minimum: 0
          type: integer
          contentEncoding: int32
          default: 100
      responses:
        '200':
          description: Result of Count
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_count'
                - description: Distinct count response for time-bounded search results
                  examples:
                  - distinct: string
                    end: 0
                    limit: 0
                    results:
                    - count: 0
                      property: string
                    start: 0
                    total: 0
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    distinct: string
                    end: 0
                    limit: 0
                    results:
                    - count: 0
                      property: string
                    start: 0
                    total: 0
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_count'
                - description: Distinct count response for time-bounded search results
                  examples:
                  - distinct: string
                    end: 0
                    limit: 0
                    results:
                    - count: 0
                      property: string
                    start: 0
                    total: 0
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    distinct: string
                    end: 0
                    limit: 0
                    results:
                    - count: 0
                      property: string
                    start: 0
                    total: 0
        '400':
          description: Bad Syntax
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http400'
                - description: Standard HTTP 400 bad request error response
                  examples:
                  - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http400'
                - description: Standard HTTP 400 bad request error response
                  examples:
                  - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
        '401':
          description: Unauthorized
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http401'
                - description: Standard HTTP 401 authentication error response
                  examples:
                  - detail: Authentication credentials were not provided.
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: Authentication credentials were not provided.
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http401'
                - description: Standard HTTP 401 authentication error response
                  examples:
                  - detail: Authentication credentials were not provided.
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: Authentication credentials were not provided.
        '403':
          description: Permission Denied
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http403'
                - description: Standard HTTP 403 permission error response
                  examples:
                  - detail: You do not have permission to perform this action.
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: You do not have permission to perform this action.
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http403'
                - description: Standard HTTP 403 permission error response
                  examples:
                  - detail: You do not have permission to perform this action.
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: You do not have permission to perform this action.
        '404':
          description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http404'
                - description: Standard HTTP 404 not found error response
                contentMediaType: application/json
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http404'
                - description: Standard HTTP 404 not found error response
                contentMediaType: application/vnd.api+json
        '429':
          description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http429'
                - description: Standard HTTP 429 rate limit error response
                  examples:
                  - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http429'
                - description: Standard HTTP 429 rate limit error response
                  examples:
                  - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
      deprecated: false
  /api/v1/sites/{site_id}/skyatp/events/search:
    parameters: []
    get:
      tags:
      - Sites Skyatp
      summary: searchSiteSkyatpEvents
      description: Search Skyatp Events (WIP)
      operationId: searchSiteSkyatpEvents
      parameters:
      - name: site_id
        in: path
        description: ''
        required: true
        schema:
          type: string
          contentEncoding: uuid
          examples:
          - 000000ab-00ab-00ab-00ab-0000000000ab
      - name: type
        in: query
        description: Event type, e.g. cc, fs, mw
        style: form
        explode: true
        schema:
          type: string
      - name: mac
        in: query
        description: Filter results by MAC address
        style: form
        explode: true
        schema:
          type: string
      - name: device_mac
        in: query
        description: Filter results by device MAC address
        style: form
        explode: true
        schema:
          type: string
      - name: threat_level
        in: query
        description: Filter results by threat level
        style: form
        explode: true
        schema:
          type: integer
          contentEncoding: int32
      - name: ip
        in: query
        description: Filter results by IPv4 address
        style: form
        explode: true
        schema:
          type: string
          contentEncoding: ipv4
          examples:
          - 192.168.1.1
      - name: limit
        in: query
        description: Maximum number of results to return per page
        style: form
        explode: true
        schema:
          minimum: 0
          type: integer
          contentEncoding: int32
          default: 100
      - name: start
        in: query
        description: Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d` or `-1w`
        style: form
        explode: true
        schema:
          type: string
      - name: end
        in: query
        description: Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d`, `-2h`, or `now`
        style: form
        explode: true
        schema:
          type: string
      - name: duration
        in: query
        description: Time range duration for the query, using relative units such as `10m`, `7d`, or `2w`
        style: form
        explode: true
        schema:
          type: string
          default: 1d
          examples:
          - 10m
      - name: sort
        in: query
        description: On which field the list should be sorted, -prefix represents DESC order
        style: form
        explode: true
        schema:
          type: string
          default: timestamp
          examples:
          - -site_id
      - name: search_after
        in: query
        description: Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the `next` URL from the previous response and should not be manually constructed.
        style: form
        explode: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_events_sky_atp_search'
                - description: Paginated response for Sky ATP event search results
                  examples:
                  - end: 1513176951
                    limit: 10
                    results:
                    - device_mac: 658279bb1fa4
                      ip: 172.16.0.11
                      mac: b019c66c8348
                      org_id: 3139f2c2-fac6-11e5-8156-0242ac110006
                      site_id: 70e0f468-fc13-11e5-85ad-0242ac110008
                      threat_level: 7
                      timestamp: 1592524478
                      type: cc
                    start: 1512572151
                    total: 1
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    end: 1513176951
                    limit: 10
                    results:
                    - device_mac: 658279bb1fa4
                      ip: 172.16.0.11
                      mac: b019c66c8348
                      org_id: 3139f2c2-fac6-11e5-8156-0242ac110006
                      site_id: 70e0f468-fc13-11e5-85ad-0242ac110008
                      threat_level: 7
                      timestamp: 1592524478
                      type: cc
                    start: 1512572151
                    total: 1
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_events_sky_atp_search'
                - description: Paginated response for Sky ATP event search results
                  examples:
                  - end: 1513176951
                    limit: 10
                    results:
                    - device_mac: 658279bb1fa4
                      ip: 172.16.0.11
                      mac: b019c66c8348
                      org_id: 3139f2c2-fac6-11e5-8156-0242ac110006
                      site_id: 70e0f468-fc13-11e5-85ad-0242ac110008
                      threat_level: 7
                      timestamp: 1592524478
                      type: cc
                    start: 1512572151
                    total: 1
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    end: 1513176951
                    limit: 10
                    results:
                    - device_mac: 658279bb1fa4
                      ip: 172.16.0.11
                      mac: b019c66c8348
                      org_id: 3139f2c2-fac6-11e5-8156-0242ac110006
                      site_id: 70e0f468-fc13-11e5-85ad-0242ac110008
                      threat_level: 7
                      timestamp: 1592524478
                      type: cc
                    start: 1512572151
                    total: 1
        '400':
          description: Bad Syntax
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http400'
                - description: Standard HTTP 400 bad request error response
                  examples:
                  - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http400'
                - description: Standard HTTP 400 bad request error response
                  examples:
                  - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
        '401':
          description: Unauthorized
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http401'
                - description: Standard HTTP 401 authentication error response
                  examples:
                  - detail: Authentication credentials were not provided.
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: Authentication credentials were not provided.
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http401'
                - description: Standard HTTP 401 authentication error response
                  examples:
                  - detail: Authentication credentials were not provided.
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: Authentication credentials were not provided.
        '403':
          description: Permission Denied
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http403'
                - description: Standard HTTP 403 permission error response
                  examples:
                  - detail: You do not have permission to perform this action.
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: You do not have permission to perform this action.
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http403'
                - description: Standard HTTP 403 permission error response
                  examples:
                  - detail: You do not have permission to perform this action.
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: You do not have permission to perform this action.
        '404':
          description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http404'
                - description: Standard HTTP 404 not found error response
                contentMediaType: application/json
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http404'
                - description: Standard HTTP 404 not found error response
                contentMediaType: application/vnd.api+json
        '429':
          description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http429'
                - description: Standard HTTP 429 rate limit error response
                  examples:
                  - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
                contentMediaType: application/json
              examples:
                Example:
                  value:
                    detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
            application/vnd.api+json:
              schema:
                allOf:
                - $ref: '#/components/schemas/response_http429'
                - description: Standard HTTP 429 rate limit error response
                  examples:
                  - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
                contentMediaType: application/vnd.api+json
              examples:
                Example:
                  value:
                    detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
      deprecated: false
components:
  schemas:
    response_http403:
      title: response_http403
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
      description: Standard HTTP 403 permission error response
    events_skyatp:
      title: events_skyatp
      required:
      - device_mac
      - ip
      - mac
      - org_id
      - site_id
      - threat_level
      - timestamp
      - type
      type: object
      properties:
        device_mac:
          type: string
          description: Network device MAC address that reported the SkyATP event
          readOnly: true
        for_site:
          type: boolean
          description: Whether the SkyATP event is scoped to a site rather than only the organization
          readOnly: true
        ip:
          type: string
          description: Client IP address associated with the SkyATP event
          readOnly: true
        mac:
          type: string
          description: Client MAC address associated with the SkyATP event
          readOnly: true
        org_id:
          type: string
          description: Organization that contains the SkyATP event
          contentEncoding: uuid
          readOnly: true
          examples:
          - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
        site_id:
          type: string
          description: Site where the SkyATP event occurred
          contentEncoding: uuid
          readOnly: true
          examples:
          - 441a1214-6928-442a-8e92-e1d34b8ec6a6
        threat_level:
          type: integer
          description: Numeric SkyATP threat level reported for the event
          contentEncoding: int32
          readOnly: true
        timestamp:
          type: number
          description: Time when the SkyATP event occurred
          readOnly: true
        type:
          type: string
          description: SkyATP event type, such as `cc`, `fs`, or `mw`
          readOnly: true
      description: SkyATP threat event returned by SkyATP event search APIs
    count_result:
      title: count_result
      required:
      - count
      type: object
      properties:
        count:
          type: integer
          description: Number of matching items for the distinct value or values in this result
          contentEncoding: int32
      additionalProperties:
        type: string
      description: Count result row with the matching distinct field values
    response_http400:
      title: response_http400
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
      description: Standard HTTP 400 bad request error response
    response_http404:
      title: response_http404
      type: object
      properties:
        id:
          type: string
          description: Missing resource identifier, when the API includes one
      description: Standard HTTP 404 not found error response
    site_sky_atp_events_count_distinct:
      title: site_sky_atp_events_count_distinct
      enum:
      - device_mac
      - mac
      - threat_level
      - type
      type: string
      description: 'enum: `device_mac`, `mac`, `threat_level`, `type`'
    response_count:
      title: response_count
      required:
      - distinct
      - end
      - limit
      - results
      - start
      - total
      type: object
      properties:
        distinct:
          type: string
          description: Field used to group the count results
        end:
          type: integer
          description: Search window end timestamp for the count request, in epoch seconds
          contentEncoding: int32
        limit:
          type: integer
          description: Maximum number of distinct count results requested
          contentEncoding: int32
        results:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/count_result'
          description: Count results grouped by the distinct field
        start:
          type: integer
          description: Search window start timestamp for the count request, in epoch seconds
          contentEncoding: int32
        total:
          type: integer
          description: Number of distinct result buckets returned
          contentEncoding: int32
      description: Distinct count response for time-bounded search results
    response_http401:
      title: response_http401
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
      description: Standard HTTP 401 authentication error response
    response_http429:
      title: response_http429
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
      description: Standard HTTP 429 rate limit error response
    response_events_sky_atp_search:
      title: response_events_sky_atp_search
      required:
      - end
      - limit
      - results
      - start
      - total
      type: object
      properties:
        end:
          type: integer
          description: Epoch timestamp for the end of the Sky ATP event search window
          contentEncoding: int32
        limit:
          type: integer
          description: Maximum number of Sky ATP event records returned in this page
          contentEncoding: int32
        next:
          type: string
          description: Pagination cursor or URL for retrieving the next page of Sky ATP event records
        results:
          uniqueItems: true
          type: array
          items:
            $ref: '#/components/schemas/events_skyatp'
          description: Sky ATP event records matching the search filters
        start:
          type: integer
          description: Epoch timestamp for the start of the Sky ATP event search window
          contentEncoding: int32
        total:
          type: integer
          description: Number of Sky ATP event records matching the search filters across all pages
          contentEncoding: int32
      description: Paginated response for Sky ATP event search results
  securitySchemes:
    apiToken:
      type: apiKey
      description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n  `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
      name: Authorization
      in: header
    csrfToken:
      type: apiKey
      description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.


        **Format**:

        ```

        X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx

        ```


        For automation, API Token authentication is preferred.'
      name: X-CSRFToken
      in: header