openapi: 3.2.0 info: title: Mist Utilities PCAPs API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Utilities PCAPs description: API Calls to start, stop or managed Packet Captures at the device level paths: /api/v1/orgs/{org_id}/pcaps: parameters: [] get: tags: - Utilities PCAPs summary: listOrgPacketCaptures description: List organization packet capture sessions and generated capture files for the selected time range. operationId: listOrgPacketCaptures parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: start in: query description: Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d` or `-1w` style: form explode: true schema: type: string - name: end in: query description: Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d`, `-2h`, or `now` style: form explode: true schema: type: string - name: duration in: query description: Time range duration for the query, using relative units such as `10m`, `7d`, or `2w` style: form explode: true schema: type: string default: 1d examples: - 10m - name: limit in: query description: Maximum number of results to return per page style: form explode: true schema: minimum: 0 type: integer contentEncoding: int32 default: 100 - name: page in: query description: Select the page number to return when using page-based pagination; starts at `1` style: form explode: true schema: minimum: 1 type: integer contentEncoding: int32 default: 1 responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_pcap_search' - description: Paginated response for packet capture search results examples: - end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 contentMediaType: application/json examples: Example: value: end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_pcap_search' - description: Paginated response for packet capture search results examples: - end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 contentMediaType: application/vnd.api+json examples: Example: value: end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/orgs/{org_id}/pcaps/capture: parameters: [] delete: tags: - Utilities PCAPs summary: stopOrgPacketCapture description: Stop the currently running organization packet capture and end its websocket output stream. operationId: stopOrgPacketCapture parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false get: tags: - Utilities PCAPs summary: getOrgCapturingStatus description: Retrieve the current organization packet capture status, including active capture targets and progress. operationId: getOrgCapturingStatus parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_pcap_status' - description: Current status of a packet capture session examples: - aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client contentMediaType: application/json examples: Example: value: aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_pcap_status' - description: Current status of a packet capture session examples: - aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client contentMediaType: application/vnd.api+json examples: Example: value: aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Utilities PCAPs summary: startOrgPacketCapture description: 'Start an organization-level packet capture for org-level Mist Edges **NOTE**: For packet captures of org level Mist Edges only. Use Start Site Packet Capture for site level Mist Edges. The output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux. #### Subscribe to Device Command outputs `WS /api-ws/v1/stream` ```json { "subscribe": "/orgs/:org_id/pcaps" } ``` #### Response (MxEdge) ```json { "event": "data" "channel": "/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps" "data": { "capture_id": "f039b1b4-a23e-48b2-906a-0da40524de73", "pcap_dict": { "dst_mac": "68:ec:c5:09:2e:87", "src_mac": "8c:3b:ad:e0:47:40", "vlan": 1, "src_ip": "34.224.147.117", "dst_ip": "192.168.1.55", "dst_port": 51635, "src_port": 443, "protocol": "TCP", "mxedge_id": "00000000-0000-0000-1000-001122334455", "direction": "tx", "timestamp": 1652247615, "length": 159.0, "lost_messages": 0, "interface": "port0", "info": "1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq \n 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\n", }, "pcap_raw": "1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==" } } ``` #### Stop Response ```json { "event": "data" "channel": "/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps" "data": { "capture_id": "a2f7374d-6a70-41fd-8a3f-71e42573baaf", "pcap_dict": null } } ```' operationId: startOrgPacketCapture parameters: - name: org_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/capture_org' - description: Request Body examples: - duration: 600 format: stream max_pkt_len: 1500 mxedges: 00000000-0000-0000-1000-001122334455: interfaces: port1: tcpdump_expression: udp port 67 or udp port 68 num_packets: 100 type: mxedge contentMediaType: application/json examples: MxEdge-Packet-Capture: value: duration: 600 format: stream max_pkt_len: 1500 mxedges: 00000000-0000-0000-1000-001122334455: interfaces: port1: tcpdump_expression: udp port 67 or udp port 68 num_packets: 100 type: mxedge required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_pcap_start' - description: Packet capture session created by a start request examples: - ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap contentMediaType: application/json examples: Example: value: ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_pcap_start' - description: Packet capture session created by a start request examples: - ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap contentMediaType: application/vnd.api+json examples: Example: value: ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/pcaps: parameters: [] get: tags: - Utilities PCAPs summary: listSitePacketCaptures description: List packet captures for a site, optionally filtered by client MAC address and time range. Use List Org Packet Captures to retrieve packet captures across the organization. operationId: listSitePacketCaptures parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: client_mac in: query description: Optional client mac filter style: form explode: true schema: type: string - name: start in: query description: Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d` or `-1w` style: form explode: true schema: type: string - name: end in: query description: Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d`, `-2h`, or `now` style: form explode: true schema: type: string - name: duration in: query description: Time range duration for the query, using relative units such as `10m`, `7d`, or `2w` style: form explode: true schema: type: string default: 1d examples: - 10m - name: limit in: query description: Maximum number of results to return per page style: form explode: true schema: minimum: 0 type: integer contentEncoding: int32 default: 100 - name: page in: query description: Select the page number to return when using page-based pagination; starts at `1` style: form explode: true schema: minimum: 1 type: integer contentEncoding: int32 default: 1 responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_pcap_search' - description: Paginated response for packet capture search results examples: - end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 contentMediaType: application/json examples: Example: value: end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_pcap_search' - description: Paginated response for packet capture search results examples: - end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 contentMediaType: application/vnd.api+json examples: Example: value: end: 1461089816 limit: 100 next: /api/v1/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps?start=1461099816&search_after=%5B1694537121217%5D&limit=100&end=1461089816 results: - ap_macs: - 5c5b35000010 timestamp: 1461869041 type: new_assoc url: https://... - duration: 9999 format: stream id: 80cec4c9-322c-4712-95ce-6ba47fb54fc0 last_seen: 1693482149.417 mxedges: - 00000000-0000-0000-1000-001122334455 org_id: 78c11da8-f984-4425-bedb-a7ddd7d0f6da pcap_url: https://... site_id: null termination_reason: default timestamp: 1693525333.234066 type: mxedge url: https://... start: 1461099816 '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/pcaps/capture: parameters: [] delete: tags: - Utilities PCAPs summary: stopSitePacketCapture description: Stop current capture operationId: stopSitePacketCapture parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false get: tags: - Utilities PCAPs summary: getSiteCapturingStatus description: Get Capturing status operationId: getSiteCapturingStatus parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_pcap_status' - description: Current status of a packet capture session examples: - aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client contentMediaType: application/json examples: Example: value: aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_pcap_status' - description: Current status of a packet capture session examples: - aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client contentMediaType: application/vnd.api+json examples: Example: value: aps: - 5c5b350e001c - 5c5b350e001b client_mac: 60a10a773412 duration: 300 failed: [] id: a9a84e13-a714-b1eb-152f-a434416217d5 includes_mcast: false max_pkt_len: 128 num_packets: 1000 ok: - 5c5b350e001c - 5c5b350e001b started_time: 1435080709 type: client '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false post: tags: - Utilities PCAPs summary: startSitePacketCapture description: 'Initiate a Site Packet Capture The output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux. #### Subscribe to Device Command outputs `WS /api-ws/v1/stream` ```json { "subscribe": "/sites/{site_id}/pcaps" } ``` #### Response (MxEdge) ```json { "event": "data" "channel": "/sites/{site_id}/pcaps" "data": { "capture_id": "6b1be4fb-b239-44d9-9d3b-cb1ff3af1721", "lost_messages": 0 "pcap_dict": { "channel_frequency": 2412, "channel": "1", "datarate": "1.0 Mbps", "rssi": -75, "dst": "78:bd:bc:ca:0b:0a", "src": "18:b8:1f:4c:91:c0", "bssid": "18:b8:1f:4c:91:c0", "frame_type": "Management", "frame_subtype": "Probe Response", "proto": "802.11", "ap_mac": "d4:20:b0:81:99:2e", "direction": "tx", "timestamp": 1652246543, "length": 416.0, "interface": "radiotap", "info": "1652246544.467733 1683216786us tsft 1.0 Mb/s 2412 MHz 11g -75dBm signal -82dBm noise antenna 0 Probe Response (ATTKmsWiVS) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] CH: 2, PRIVACY\\n", }, "pcap_raw": "1MOyoQIABAAAAAAAAAAAAP//AAABAAAAEEh7Yh5VBwCgAQAAoAEAAAAAKwBvCADAAQAAAIw7reCS2VNkAAAAABACbAmABLWuAAEAEBgAAwACAABQADoBeL28ygsKGLgfTJHAGLgfTJHAcIZ2WDlBJQAAAGQAERUACkFUVEttc1dpVlMBCIKEi5YkMEhsAwECBwZVUyABCx4gAQAjAhkAKgEEMgQMEhhgMBQBAAAPrAQBAAAPrAQBAAAPrAIMAAsFAQAbAABGBTIIAQAALRqtCR////8AAAAAAAAAAAAAAAAAAAAAAAAAAD0WAggVAAAAAAAAAAAAAAAAAAAAAAAAAH8IBAAIAAAAAEDdkwBQ8gQQSgABEBBEAAECEDsAAQMQRwAQn2481frn3KT+uGod2ERx+RAhAAtBcnJpcywgSW5jLhAjAApCR1cyMTAtNzAwECQACkJHVzIxMC03MDAQQgAKQkdXMjEwLTcwMBBUAAgABgBQ8gQAARARAA5BcnJpcyBXaXJlbGVzcxAIAAIgCBA8AAEBEEkABgA3KgABIN0JABAYAgEQHAAA3RgAUPICAQGEAAOkAAAnpAAAQkNeAGIyLwAzjakr" } ``` #### Response (Wired) ```json { "event": "data" "channel": "/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps" "data": { "capture_id": "f039b1b4-a23e-48b2-906a-0da40524de73", "pcap_dict": { "dst_mac": "68:ec:c5:09:2e:87", "src_mac": "8c:3b:ad:e0:47:40", "vlan": 1, "src_ip": "34.224.147.117", "dst_ip": "192.168.1.55", "dst_port": 51635, "src_port": 443, "proto": "TCP", "ap_mac": "d4:20:b0:81:99:2e", "direction": "tx", "timestamp": 1652247615, "length": 159.0, "interface": "wired", "info": "1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\n", }, "pcap_raw": "1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==" } } ``` #### Stop Response (Wired/Wireless) ```json { "event": "data" "channel": "/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps" "data": { "capture_id": "a2f7374d-6a70-41fd-8a3f-71e42573baaf", "lost_messages": 0, "pcap_dict": null } } ```' operationId: startSitePacketCapture parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab requestBody: description: Request Body content: application/json: schema: allOf: - $ref: '#/components/schemas/capture_site' - description: Request Body examples: - '{"client_mac":"60a10a773412","duration":600,"includes_mcast":false,"max_pkt_len":128,"num_packets":100,"type":"new_assoc"}' - '{"duration":600,"max_pkt_len":68,"num_packets":100,"type":"radiotap"}' - '{"ap_mac":"string","client_mac":"38f9d3972ff1","duration":600,"max_pkt_len":128,"num_packets":1024,"ssid":"string","type":"radiotap,wired"}' - '{"ap_mac":null,"band":"24","bandwidth":20,"channel":1,"client_mac":"38f9d3972ff1","duration":600,"format":"stream","max_pkt_len":68,"num_packets":100,"tcpdump_expression":"tcp port 80","type":"scan"}' - '{"duration":600,"max_pkt_len":68,"num_packets":100,"tcpdump_expression":"tcp port 80","type":"wired"}' - '{"ap_mac":null,"band":"24","duration":600,"max_pkt_len":128,"num_packets":100,"type":"wireless"}' - '{"client_mac":"60a10a773412","duration":300,"includes_mcast":false,"max_pkt_len":128,"num_packets":1000,"type":"client"}' - '{"duration":600,"format":"stream","gateways":{"001122334455":{"ports":{"ge-0/0/0":{"tcpdump_expression":"tcp"},"ge-0/0/1":{"tcpdump_expression":"port 443"},"ge-1/0/0":{"tcpdump_expression":"tcp"},"ge-1/0/1":{"tcpdump_expression":"port 443"}}},"001122334466":{"ports":{"ge-0/0/0":{"tcpdump_expression":"udp"},"ge-0/0/1":{"tcpdump_expression":"port 32768"}}}},"max_pkt_len":1500,"num_packets":100,"type":"gateway"}' - '{"duration":600,"format":"stream","max_pkt_len":1500,"num_packets":100,"switches":{"001122334455":{"ports":{"ge-0/0/0":{"tcpdump_expression":"udp"},"ge-0/0/1":{},"ge-1/0/0":{},"ge-1/0/1":{}}},"001122334466":{"ports":{"ge-0/0/0":{},"ge-0/0/1":{}}}},"tcpdump_expression":"port 443","type":"switch"}' contentMediaType: application/json examples: AP-New-Wireless-Client-Associations-Packet-Capture: value: client_mac: 60a10a773412 duration: 600 includes_mcast: false max_pkt_len: 128 num_packets: 100 type: new_assoc AP-Radiotap-Packet-Capture: value: duration: 600 max_pkt_len: 68 num_packets: 100 type: radiotap AP-Radiotap-Packet-Capture-and-Wired-Packet-Capture: value: ap_mac: string client_mac: 38f9d3972ff1 duration: 600 max_pkt_len: 128 num_packets: 1024 ssid: string type: radiotap,wired AP-Scan-radio-Packet-Capture: value: ap_mac: null band: '24' bandwidth: 20 channel: 1 client_mac: 38f9d3972ff1 duration: 600 format: stream max_pkt_len: 68 num_packets: 100 tcpdump_expression: tcp port 80 type: scan AP-Wired-Packet-Capture: value: duration: 600 max_pkt_len: 68 num_packets: 100 tcpdump_expression: tcp port 80 type: wired AP-Wireless-Packet-Capture: value: ap_mac: null band: '24' duration: 600 max_pkt_len: 128 num_packets: 100 type: wireless Client-Packet-Capture: value: client_mac: 60a10a773412 duration: 300 includes_mcast: false max_pkt_len: 128 num_packets: 1000 type: client SSR-Packet-Capture: value: duration: 600 format: stream gateways: '001122334455': ports: ge-0/0/0: tcpdump_expression: tcp ge-0/0/1: tcpdump_expression: port 443 ge-1/0/0: tcpdump_expression: tcp ge-1/0/1: tcpdump_expression: port 443 '001122334466': ports: ge-0/0/0: tcpdump_expression: udp ge-0/0/1: tcpdump_expression: port 32768 max_pkt_len: 1500 num_packets: 100 type: gateway Switch-Packet-Capture: value: duration: 600 format: stream max_pkt_len: 1500 num_packets: 100 switches: '001122334455': ports: ge-0/0/0: tcpdump_expression: udp ge-0/0/1: {} ge-1/0/0: {} ge-1/0/1: {} '001122334466': ports: ge-0/0/0: {} ge-0/0/1: {} tcpdump_expression: port 443 type: switch required: false responses: '200': description: OK headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_pcap_start' - description: Packet capture session created by a start request examples: - ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap contentMediaType: application/json examples: Example: value: ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_pcap_start' - description: Packet capture session created by a start request examples: - ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap contentMediaType: application/vnd.api+json examples: Example: value: ap_count: 3 aps: [] duration: 600 enabled: true expiry: 1614886726.5411825 format: stream id: a9a84e13-a714-b1eb-152f-a434416217d5 include_mcast: false max_pkt_len: 68 num_packets: 100 org_id: a9346fba-f920-e99a-cc51-2e8dcc57fa3c raw: true site_id: 67970e46-4e12-11e6-9188-0242ac110007 ssid: '' timestamp: 1614886126.5411825 type: radiotap '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false /api/v1/sites/{site_id}/pcaps/{pcap_id}: parameters: [] put: tags: - Utilities PCAPs summary: updateSitePacketCapture description: Update or add notes to a completed packet capture operationId: updateSitePacketCapture parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: pcap_id in: path description: '' required: true schema: type: string contentEncoding: uuid requestBody: description: '' content: application/json: schema: allOf: - $ref: '#/components/schemas/notes_string' - examples: - notes: wired pcap test contentMediaType: application/json examples: Example: value: notes: wired pcap test required: false responses: '200': description: OK headers: {} content: {} '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response capture_switch: title: capture_switch required: - switches - type type: object properties: duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_switch_format2' - description: 'Output format for the switch packet capture. enum: `stream`.' max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 ports: type: object additionalProperties: $ref: '#/components/schemas/capture_switch_ports_tcpdump_expression' description: Switch ports to include in the packet capture switches: type: object additionalProperties: $ref: '#/components/schemas/capture_switch_switches' description: Property key is the switch MAC address tcpdump_expression: type: string description: tcpdump expression, port specific if specified under ports dict, otherwise applicable across ports if specified at top level of payload. Port specific value overrides top level value when both exist. examples: - port 443 type: const: switch type: string description: Packet capture type discriminator for switch captures examples: - switch description: Initiate a Switch (Junos) Packet Capture capture_client: title: capture_client required: - type type: object properties: ap_mac: type: - string - 'null' description: AP MAC address used to target the client packet capture client_mac: type: - string - 'null' description: Client MAC address, required if `type`==`client`; optional otherwise examples: - 60a10a773412 duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 includes_mcast: type: boolean description: Whether to include multicast traffic in the packet capture default: false max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 ssid: type: - string - 'null' description: Optional SSID filter for the packet capture type: const: client type: string description: Packet capture type discriminator for client captures examples: - client description: Initiate a Client Packet Capture capture_wired: title: capture_wired required: - type type: object properties: ap_mac: type: - string - 'null' description: AP MAC address used to target the wired packet capture duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_wired_format2' - description: 'Output format for the wired packet capture. enum: `pcap`, `stream`.' max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 tcpdump_expression: type: - string - 'null' description: Filter expression applied to the wired packet capture examples: - tcp port 80 type: const: wired type: string description: Packet capture type discriminator for wired captures examples: - wired description: Initiate a Wired Packet Capture response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response capture_mxedge_mxedges: title: capture_mxedge_mxedges type: object properties: interfaces: type: object additionalProperties: $ref: '#/components/schemas/capture_mxedge_mxedges_interfaces' description: Mx Edge interfaces to include in the capture, keyed by interface name description: Property key is the Mx Edge ID, currently limited to one mxedge per org capture session response_pcap_search_item_pcap_aps_item: title: response_pcap_search_item_pcap_aps_item type: object properties: band: type: string description: Radio band used for this AP capture bandwidth: type: string description: Channel bandwidth used for this AP capture, in MHz channel: type: integer description: Radio channel used for this AP capture contentEncoding: int32 tcpdump_expression: type: - string - 'null' description: Tcpdump filter expression applied to this AP capture, or null when no filter is applied description: AP radio settings captured for a packet capture record dot11_bandwidth1: title: dot11_bandwidth1 enum: - 0 - 20 - 40 - 80 - 160 type: integer description: 'Channel bandwidth to use for the scan radio packet capture. enum: `0`, `20`, `40`, `80`, `160`.' examples: - 20 capture_mxedge_mxedges_interfaces: title: capture_mxedge_mxedges_interfaces type: object properties: tcpdump_expression: type: string description: tcpdump expression common for wired,radiotap description: Property key is the Port name (e.g. "port1", "kni0", "lacp0", "ipsec", "drop", "oobm"), currently limited to specifying one interface per mxedge response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response notes_string: title: notes_string type: object properties: notes: type: string description: Text to attach to the target resource as notes examples: - wired pcap test description: Request body containing notes text response_pcap_status_mxedges_item: title: response_pcap_status_mxedges_item type: object properties: interfaces: type: object additionalProperties: $ref: '#/components/schemas/capture_mxedge_mxedges_interfaces' description: Dict of interfaces to capture on, property key is the port name description: Mist Edge interface settings for a packet capture capture_scan_format2: title: capture_scan_format2 enum: - pcap - stream type: string description: 'Output format for the scan radio packet capture. enum: `pcap`, `stream`.' examples: - stream capture_radiotapwired: title: capture_radiotapwired required: - type type: object properties: ap_mac: type: - string - 'null' description: AP MAC address used to target the combined radiotap and wired packet capture band: allOf: - $ref: '#/components/schemas/capture_radiotapwired_band2' - description: 'Radio band to capture for the radiotap portion. enum: `24`, `24,5,6`, `5`, `6`.' examples: - '24' client_mac: type: - string - 'null' description: Client MAC address used to filter the combined packet capture examples: - 38f9d3972ff1 duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_radiotapwired_format2' - description: 'Output format for the combined packet capture. enum: `pcap`, `stream`.' examples: - stream max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 radiotap_tcpdump_expression: type: string description: tcpdump expression for radiotap interface (802.11 + radio headers) examples: - type ssid: type: - string - 'null' description: Wireless network SSID used to filter the radiotap portion examples: - test tcpdump_expression: type: - string - 'null' description: Filter expression applied across the combined packet capture examples: - tcp port 80 type: const: radiotap,wired type: string description: 'Packet capture type discriminator for combined radiotap and wired captures. enum: `radiotap,wired`.' examples: - radiotap,wired wired_tcpdump_expression: type: - string - 'null' description: Filter expression applied to the wired portion of the capture examples: - tcp port 80 wireless_tcpdump_expression: type: string description: tcpdump expression for radiotap interface (802.11) wlan_id: type: - string - 'null' description: WLAN id associated with the respective ssid. examples: - fac8e973-feb9-421a-b381-aabbc4b61f5a description: Initiate a Radiotap Packet Capture and Wired Packet Capture capture_switch_format2: title: capture_switch_format2 const: stream type: string description: 'Output format for the switch packet capture. enum: `stream`.' capture_gateway_format2: title: capture_gateway_format2 const: stream type: string description: 'Output format for the gateway packet capture. enum: `stream`.' examples: - stream capture_org: oneOf: - $ref: '#/components/schemas/capture_mxedge' description: Packet capture request payload for organization-level captures capture_wireless_format2: title: capture_wireless_format2 enum: - pcap - stream type: string description: 'Output format for the wireless packet capture. enum: `pcap`, `stream`.' capture_switch_switches: title: capture_switch_switches type: object properties: ports: type: object additionalProperties: $ref: '#/components/schemas/capture_switch_ports_tcpdump_expression' description: Switch ports to include in the capture, keyed by port ID description: Switch-specific packet capture settings keyed under a switch MAC address response_pcap_search_item: title: response_pcap_search_item required: - timestamp - type - url type: object properties: ap_macs: uniqueItems: true type: array items: type: string description: AP MAC addresses associated with the packet capture aps: type: array items: type: string description: AP MAC addresses included in the packet capture duration: type: number description: Packet capture duration in seconds examples: - 600 format: type: string description: Output format requested for the packet capture examples: - stream id: type: string description: Unique identifier for the packet capture contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f last_seen: type: number description: Last seen timestamp of the capture examples: - 1693482149.417 max_num_packets: type: number description: Maximum number of packets requested for the capture examples: - 1024 mxedges: type: array items: type: string description: List of Mist Edge IDs included in the capture org_id: type: string description: Organization associated with the packet capture contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 pcap_aps: type: object additionalProperties: $ref: '#/components/schemas/response_pcap_search_item_pcap_aps_item' description: Per-AP radio capture settings keyed by AP MAC address examples: - 5c5b35000010: band: '6' bandwidth: '20' channel: 133 tcpdump_expression: null pcap_url: type: string description: URL for downloading the generated PCAP file site_id: type: - string - 'null' description: Site associated with the packet capture, when the capture is site-scoped contentEncoding: uuid termination_reason: type: string description: Reason the packet capture session ended examples: - default timestamp: type: number description: Epoch timestamp, in seconds, when the packet capture record was created readOnly: true type: type: string description: Packet capture type represented by this record url: type: string description: Link for accessing the packet capture output or stream description: Packet capture record returned by organization or site packet capture search capture_gateway: title: capture_gateway required: - gateways - type type: object properties: duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_gateway_format2' - description: 'Output format for the gateway packet capture. enum: `stream`.' examples: - stream gateways: type: object additionalProperties: $ref: '#/components/schemas/capture_gateway_gateways' description: List of SSRs. Property key is the SSR MAC max_pkt_len: maximum: 1520 minimum: 64 type: - integer - 'null' description: minimum is 64 (SSR) / 68 (SRX) maximum is 10240 (SSR) / 1520 (SRX) contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 ports: type: object additionalProperties: $ref: '#/components/schemas/capture_gateway_gateways_port' description: Gateway ports to include in the packet capture type: const: gateway type: string description: Packet capture type discriminator for gateway captures examples: - gateway description: Initiate a Gateway (SSR/SRX) Packet Capture response_pcap_ap: title: response_pcap_ap type: object properties: band: type: integer description: Radio band used for the AP packet capture contentEncoding: int32 bandwidth: type: integer description: Channel bandwidth used for the AP packet capture, in MHz contentEncoding: int32 channel: type: integer description: Radio channel used for the AP packet capture contentEncoding: int32 tcpdump_expression: type: - string - 'null' description: Tcpdump filter expression applied to the AP packet capture, or null when no filter is applied description: AP radio settings used for a packet capture capture_mxedge_format2: title: capture_mxedge_format2 enum: - stream - tzsp type: string description: 'Output format for packet capture data. enum: `stream`, `tzsp`.' capture_scan_aps: title: capture_scan_aps type: object properties: band: allOf: - $ref: '#/components/schemas/capture_scan_aps_band2' - description: 'Radio band on which to start the scan capture. enum: `24`, `5`, `6`.' channel: type: string description: Specify the channel value where scan PCAP has to be started tcpdump_expression: type: string description: tcpdump expression, port specific if specified under ports dict, otherwise applicable across ports if specified at top level of payload. Port specific value overrides top level value when both exist. width: type: string description: Specify the bandwidth value with respect to the channel. description: Property key is the AP MAC address (e.g. "5c5b35000001"). All optionals, parent parameters will be used if not defined capture_switch_ports_tcpdump_expression: title: capture_switch_ports_tcpdump_expression type: object properties: tcpdump_expression: type: string description: tcpdump expression, port specific if specified under ports dict, otherwise applicable across ports if specified at top level of payload. Port specific value overrides top level value when both exist. examples: - port 443 description: Per-port tcpdump filter for a switch packet capture response_pcap_search: title: response_pcap_search required: - end - limit - results - start type: object properties: end: type: integer description: Epoch timestamp, in seconds, for the end of the packet capture search window contentEncoding: int32 limit: type: integer description: Maximum number of packet capture records returned in this page contentEncoding: int32 next: type: string description: URL for retrieving the next page of packet capture search results results: uniqueItems: true type: array items: $ref: '#/components/schemas/response_pcap_search_item' description: Packet capture records matching the search filters start: type: integer description: Epoch timestamp, in seconds, for the start of the packet capture search window contentEncoding: int32 total: type: integer description: Number of packet capture records matching the search filters across all pages contentEncoding: int32 description: Paginated response for packet capture search results capture_gateway_gateways: title: capture_gateway_gateways type: object properties: ports: type: object additionalProperties: $ref: '#/components/schemas/capture_gateway_gateways_port' description: Gateway ports to include in the capture, keyed by port ID description: Gateway-specific packet capture settings keyed under a gateway MAC address capture_radiotap_band2: title: capture_radiotap_band2 enum: - '24' - 24,5,6 - '5' - '6' type: string description: 'Radio band to capture for radiotap packets. enum: `24`, `24,5,6`, `5`, `6`.' examples: - '24' capture_radiotapwired_band2: title: capture_radiotapwired_band2 enum: - '24' - 24,5,6 - '5' - '6' type: string description: 'Radio band to capture for the radiotap portion. enum: `24`, `24,5,6`, `5`, `6`.' examples: - '24' capture_new_assoc: title: capture_new_assoc required: - type type: object properties: ap_mac: type: string description: AP MAC address used to target new association capture examples: - a83a79a947ee client_mac: type: string description: Client MAC address, required if `type`==`client`; optional otherwise examples: - 60a10a773412 duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 includes_mcast: type: boolean description: Whether to include multicast traffic in the packet capture default: false max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 ssid: type: string description: Optional SSID filter for new association capture type: const: new_assoc type: string description: 'Packet capture type discriminator for new association captures. enum: `new_assoc`.' examples: - new_assoc description: Initiate a packet Capture for New Wireless Client Associations capture_radiotapwired_format2: title: capture_radiotapwired_format2 enum: - pcap - stream type: string description: 'Output format for the combined packet capture. enum: `pcap`, `stream`.' examples: - stream capture_wireless_band2: title: capture_wireless_band2 enum: - '24' - '5' - '6' type: string description: 'Radio band to capture for wireless packets. enum: `24`, `5`, `6`.' capture_wireless: title: capture_wireless required: - type type: object properties: ap_mac: type: - string - 'null' description: AP MAC address used to target the wireless packet capture band: allOf: - $ref: '#/components/schemas/capture_wireless_band2' - description: 'Radio band to capture for wireless packets. enum: `24`, `5`, `6`.' duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_wireless_format2' - description: 'Output format for the wireless packet capture. enum: `pcap`, `stream`.' max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 ssid: type: string description: Wireless network SSID used to filter the packet capture type: const: wireless type: string description: Packet capture type discriminator for wireless captures examples: - wireless wlan_id: type: string description: WLAN identifier used to filter the wireless packet capture contentEncoding: uuid description: Initiate a Wireless Packet Capture capture_radiotap: title: capture_radiotap required: - type type: object properties: ap_mac: type: string description: AP MAC address used to target the radiotap packet capture examples: - a83a79a947ee band: allOf: - $ref: '#/components/schemas/capture_radiotap_band2' - description: 'Radio band to capture for radiotap packets. enum: `24`, `24,5,6`, `5`, `6`.' examples: - '24' client_mac: type: string description: Client MAC address used to filter the radiotap packet capture examples: - 38f9d3972ff1 duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_radiotap_format2' - description: 'Output format for the radiotap packet capture. enum: `pcap`, `stream`.' examples: - stream max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 ssid: type: string description: Wireless network SSID used to filter the radiotap packet capture examples: - test tcpdump_expression: type: - string - 'null' description: Filter expression applied to the radiotap packet capture examples: - tcp port 80 type: const: radiotap type: string description: Packet capture type discriminator for radiotap captures examples: - radiotap wlan_id: type: string description: WLAN id associated with the respective ssid. contentEncoding: uuid examples: - fac8e973-feb9-421a-b381-aabbc4b61f5a description: Initiate a Radiotap Packet Capture capture_scan_aps_band2: title: capture_scan_aps_band2 enum: - '24' - '5' - '6' type: string description: 'Radio band on which to start the scan capture. enum: `24`, `5`, `6`.' capture_wired_format2: title: capture_wired_format2 enum: - pcap - stream type: string description: 'Output format for the wired packet capture. enum: `pcap`, `stream`.' capture_scan_band2: title: capture_scan_band2 enum: - '24' - '5' - '6' type: string description: 'Radio band to capture for scan radio packets. enum: `24`, `5`, `6`.' examples: - '24' capture_mxedge_format3: title: capture_mxedge_format3 enum: - stream - tzsp type: string description: 'Output format for the Mist Edge packet capture. enum: `stream`, `tzsp`.' capture_mxedge: title: capture_mxedge required: - type type: object properties: duration: maximum: 10800 minimum: 60 type: integer description: Packet capture duration, in seconds. Default is 600, minimum is 60 and maximum is 10800 (3h) contentEncoding: int32 default: 600 examples: - 600 format: allOf: - $ref: '#/components/schemas/capture_mxedge_format3' - description: 'Output format for the Mist Edge packet capture. enum: `stream`, `tzsp`.' max_pkt_len: maximum: 2048 minimum: 64 type: integer description: Max_len of each packet to capture. Default is 512, minimum is 64 and maximum is 2048 contentEncoding: int32 default: 512 examples: - 512 mxedges: type: object additionalProperties: $ref: '#/components/schemas/capture_mxedge_mxedges' description: Dict of Mist Edges to capture on, property key is the Mist Edge ID. Property value is a dict of interfaces to capture for the given Mist Edge (e.g. port1, kni0, lacp0, ipsec, drop, oobm) num_packets: maximum: 10000 minimum: 0 type: integer description: Number of packets to capture. Default is 1024, maximum is 10000, minimum 1, or 0 for unlimited (local/remote streaming only) contentEncoding: int32 default: 1024 examples: - 100 tcpdump_expression: type: string description: tcpdump expression, applicable across all interfaces if specified at top level. An interface-specific value (under the `interfaces` dict) overrides this top-level value. type: const: mxedge type: string description: 'Packet capture type discriminator for Mist Edge captures. enum: `mxedge`.' examples: - mxedge tzsp_host: type: string description: Required if `format`==`tzsp`. Remote host accessible to mxedges over the network for receiving the captured packets examples: - 192.168.1.2 tzsp_port: maximum: 65535 minimum: 1 type: integer description: Optional port on remote host for receiving the captured packets. Default is 37008 (TZSP) contentEncoding: int32 default: 37008 description: Initiate a Mist Edge Packet Capture capture_scan: title: capture_scan required: - type type: object properties: ap_mac: type: - string - 'null' description: AP MAC address used to filter the scan radio packet capture aps: type: object additionalProperties: $ref: '#/components/schemas/capture_scan_aps' description: Dictionary key is AP mac and value is a dictionary which contains key "band", "bandwidth", "channel" and "tcpdump_expression". In case keys are missed we will take parent value if parent values are not set we will use default value band: allOf: - oneOf: - {} - $ref: '#/components/schemas/capture_scan_band2' - description: 'Radio band to capture for scan radio packets. enum: `24`, `5`, `6`.' examples: - '24' bandwidth: allOf: - $ref: '#/components/schemas/dot11_bandwidth1' - description: 'Channel bandwidth to use for the scan radio packet capture. enum: `0`, `20`, `40`, `80`, `160`.' examples: - 20 channel: type: integer description: Specify the channel value where scan PCAP has to be started, default value gets applied when user provides wrong values contentEncoding: int32 default: 1 examples: - 1 client_mac: type: - string - 'null' description: Client MAC address used to filter the scan radio packet capture examples: - 38f9d3972ff1 duration: maximum: 86400 minimum: 60 type: - integer - 'null' description: Packet capture duration, in seconds contentEncoding: int32 default: 600 examples: - 300 format: allOf: - $ref: '#/components/schemas/capture_scan_format2' - description: 'Output format for the scan radio packet capture. enum: `pcap`, `stream`.' examples: - stream max_pkt_len: maximum: 2048 minimum: 64 type: - integer - 'null' description: Maximum number of bytes captured from each packet contentEncoding: int32 default: 512 examples: - 128 num_packets: maximum: 10000 minimum: 0 type: - integer - 'null' description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 default: 1024 examples: - 1000 tcpdump_expression: type: string description: tcpdump expression, port specific if specified under ports dict, otherwise applicable across ports if specified at top level of payload. Port specific value overrides top level value when both exist. examples: - tcp port 80 type: const: scan type: string description: Packet capture type discriminator for scan radio captures examples: - scan width: type: string description: Specify the bandwidth value with respect to the channel. description: Initiate a Scan Radio Packet Capture capture_gateway_gateways_port: title: capture_gateway_gateways_port type: object properties: tcpdump_expression: type: string description: tcpdump expression per port description: Per-port tcpdump filter for a gateway packet capture capture_radiotap_format2: title: capture_radiotap_format2 enum: - pcap - stream type: string description: 'Output format for the radiotap packet capture. enum: `pcap`, `stream`.' examples: - stream capture_site: oneOf: - $ref: '#/components/schemas/capture_client' - $ref: '#/components/schemas/capture_gateway' - $ref: '#/components/schemas/capture_new_assoc' - $ref: '#/components/schemas/capture_radiotap' - $ref: '#/components/schemas/capture_radiotapwired' - $ref: '#/components/schemas/capture_scan' - $ref: '#/components/schemas/capture_switch' - $ref: '#/components/schemas/capture_wired' - $ref: '#/components/schemas/capture_wireless' description: Packet capture request payload for site-level captures discriminator: propertyName: type mapping: client: capture_client gateway: capture_gateway new_assoc: capture_new_assoc radiotap: capture_radiotap radiotap,wired: capture_radiotapwired scan: capture_scan switch: capture_switch wired: capture_wired wireless: capture_wireless response_pcap_status: title: response_pcap_status required: - id - type type: object properties: ap_mac: type: - string - 'null' description: AP MAC address targeted by the packet capture, or null when no single AP filter is set aps: type: array items: type: string description: AP MAC addresses targeted by the packet capture client_mac: type: - string - 'null' description: Client MAC address filter applied to the packet capture, or null when no client filter is used examples: - 60a10a773412 duration: type: integer description: Configured packet capture duration, in seconds contentEncoding: int32 examples: - 300 enabled: type: boolean description: Whether the packet capture session is currently enabled expiry: type: number description: Epoch timestamp, in seconds, when the capture session expires examples: - 1695838060.309526 failed: type: array items: type: string description: AP MAC addresses where capture configuration failed format: allOf: - $ref: '#/components/schemas/capture_mxedge_format2' - description: 'Output format for packet capture data. enum: `stream`, `tzsp`.' gateways: type: array items: type: string description: Gateway devices included in the packet capture session id: type: string description: Unique identifier for the packet capture session contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f includes_mcast: type: boolean description: Whether multicast traffic is included in the packet capture invalid_mxedges: type: object description: Map of Mist Edge IDs that could not be configured for capture max_num_packets: type: integer description: Max number of packets configured by user contentEncoding: int32 examples: - 1000 max_pkt_len: type: integer description: Maximum number of bytes captured from each packet contentEncoding: int32 examples: - 512 mxedge_count: type: integer description: Number of Mist Edges in the capture session contentEncoding: int32 mxedges: type: object additionalProperties: $ref: '#/components/schemas/response_pcap_status_mxedges_item' description: Mist Edge capture settings keyed by Mist Edge ID num_packets: type: integer description: total number of packets captured by all AP, not applicable for type [client, new_assoc] contentEncoding: int32 ok: type: array items: type: string description: AP MAC addresses successfully configured for packet capture org_id: type: string description: Organization associated with the packet capture session contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 pcap_aps: type: object additionalProperties: $ref: '#/components/schemas/response_pcap_ap' description: Per-AP radio capture settings keyed by AP MAC address examples: - 5c5b35000010: band: 6 bandwidth: 20 channel: 133 tcpdump_expression: null radiotap_tcpdump_expression: type: string description: When `type`==`radiotap`, radiotap_tcpdump_expression expression provided by the user raw: type: boolean description: Whether raw packet data is included in the capture output scan_tcpdump_expression: type: string description: When `type`==`scan`, scan_tcpdump_expression provided by the user site_id: type: string description: Site associated with the packet capture session, when site-scoped contentEncoding: uuid readOnly: true examples: - 441a1214-6928-442a-8e92-e1d34b8ec6a6 ssid: type: - string - 'null' description: Wireless network SSID filter applied to the packet capture, or null when no SSID filter is used started_time: type: integer description: Epoch timestamp, in seconds, when the capture session started contentEncoding: int32 examples: - 1435080709 switches: type: array items: type: string description: Switch devices included in the packet capture session tcpdump_expression: type: string description: tcpdump expression provided by the user (common) timestamp: type: number description: Epoch timestamp, in seconds, when the packet capture status was reported readOnly: true type: allOf: - $ref: '#/components/schemas/pcap_type1' - description: 'Packet capture type for the current session. enum: `client`, `gateway`, `new_assoc`, `radiotap`, `radiotap,wired`, `wired`, `wireless`.' examples: - client tzsp_host: type: string description: Required if `format`==`tzsp`. Remote host accessible to Mist Edges over the network for receiving the captured packets. examples: - 192.168.1.2 tzsp_port: maximum: 65535 minimum: 1 type: integer description: If `format`==`tzsp`. Port on remote host for receiving the captured packets contentEncoding: int32 wired_tcpdump_expression: type: string description: When `type`==`wired`, wired_tcpdump_expression provided by the user wireless_tcpdump_expression: type: string description: When `type`==`‘wireless’`, wireless_tcpdump_expression provided by the user description: Current status of a packet capture session response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response response_pcap_start: title: response_pcap_start required: - id - org_id - site_id - timestamp - type type: object properties: ap_count: type: integer description: Number of APs targeted by the packet capture contentEncoding: int32 aps: uniqueItems: true type: array items: type: string description: AP MAC addresses targeted by the packet capture client_mac: type: - string - 'null' description: Client MAC address filter applied to the packet capture, or null when no client filter is used duration: type: number description: Packet capture duration in seconds enabled: type: boolean description: Whether the packet capture session is enabled after the start request expiry: type: number description: Epoch timestamp, in seconds, when the capture session expires format: type: string description: Output format for packet capture data id: type: string description: Unique identifier for the packet capture session contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f include_mcast: type: boolean description: Whether multicast traffic is included in the packet capture max_pkt_len: type: integer description: Maximum number of bytes captured from each packet contentEncoding: int32 num_packets: type: integer description: Maximum number of packets to capture; use 0 for unlimited contentEncoding: int32 org_id: type: string description: Organization associated with the packet capture session contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 raw: type: boolean description: Whether raw packet data is included in the capture output site_id: type: - string - 'null' description: Site associated with the packet capture session, when site-scoped contentEncoding: uuid ssid: type: - string - 'null' description: Wireless network SSID filter applied to the packet capture, or null when no SSID filter is used tcpdump_parser_expression: type: - string - 'null' description: Tcpdump parser expression applied to the packet capture, or null when no parser expression is used timestamp: type: number description: Epoch timestamp, in seconds, when the packet capture session was created readOnly: true type: type: string description: Packet capture type requested by the start operation description: Packet capture session created by a start request pcap_type1: title: pcap_type1 enum: - client - gateway - new_assoc - radiotap - radiotap,wired - wired - wireless type: string description: 'Packet capture type for the current session. enum: `client`, `gateway`, `new_assoc`, `radiotap`, `radiotap,wired`, `wired`, `wireless`.' examples: - client response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header