openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs NAC Portals API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: "NAC Portals are for onboard Wireless and Wired client with 802.1X\n\nThe NAC Portal is a web-based interface that allows users to authenticate and\ngain access to the network. It is typically used for guest access or for devices\nthat do not have a pre-configured certificate for 802.1X authentication.\n\nIt can also be used to provision certificates for devices that require them with the Mist Application.\n\n\n### NAC-Based External Guest Portal Authorization / How to implement a External Guest Portal\n\n#### Context\n\nIn the guest portal flow, context such as SSID, guest MAC, AP MAC is required to unique identify the guest, if it's already authorized (e.g. roam to another AP), and used to instruct the AP to stop redirecting/blocking the user traffic\n\n#### Redirect\n\nGuest Device (or CNA in MacOS/iOS term) will be redirected to, e.g. “?ap_mac=5c5b35001234&ssid=Guest&…”\n\n| Name | Type | Description |\n |------|------|-------------|\n | ap_mac | string | AP's MAC address |\n | site_id | string | Site ID |\n | device_mac | string | Device's MAC Address (the device that blocks the traffic) |\n | ssid | string | for wireless |\n | port_name | string | for wired (e.g. eth0, ge-0/0/13) |\n | client_mac | string | Client's MAC Address |\n \n\n#### Authorize\n\nOnce the guest has gone through your portal flow, authorize them by redirect the user to\n\n```\nGET https://url_generated_by_portal_authorize_url?jwt=<signature>\n```\n\nThis can be generated by\n\n```python\nimport jwt\n\nsecret = \"EIfPMOykI3lMlDdNPub2WcbqT6dNOtWwmYHAd6bY\"  # from portal_authorize_jwt_secret above \npayload = {\n    # for wireless\n    \"ap_mac\": \"5c5b35001234\",\n    \"wlan_id\": \"be22bba7-8e22-e1cf-5185-b880816fe2cf\",  # only for _wireless_ captive portal\n    \"client_mac\": \"d58f6bb4c9d8\",\n\n    # for wired\n    \"device_mac\": \"5c5b35001234\",\n    \"port_name\": \"eth0\",  # only for _wired_ captive portal\"\n    \"client_mac\": \"d58f6bb4c9d8\",\n\n    # common\n    # how long should we authorize this session\n    \"minutes\": 480,  \n    \"expires\": 1768587994,  # alternatively\n    # instead of the original URL the user is trying to go to, redirect the user to this URL    \n    \"forward\": \"http://www.mist.com\",\n    # for testing: if authorize_only=true and authorization is successful, 200 OK will be returned instead of 302 Redirect the user to the `forward` URL\n    \"authorize_only\": False\n}\n\nencoded_jwt = jwt.encode(payload, secret, algorithm='HS256')\n```\n"
  name: Orgs NAC Portals
paths:
  /api/v1/orgs/{org_id}/nacportals:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: List Org NAC Portals
      operationId: listOrgNacPortals
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/NacPortalArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacPortals
      tags:
      - Orgs NAC Portals
    post:
      description: Create Org NAC Portal
      operationId: createOrgNacPortal
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_portal'
      responses:
        '200':
          $ref: '#/components/responses/NacPortal'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgNacPortal
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    delete:
      description: Delete Org NAC Portal
      operationId: deleteOrgNacPortal
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacPortal
      tags:
      - Orgs NAC Portals
    get:
      description: Get Org NAC Portal
      operationId: getOrgNacPortal
      responses:
        '200':
          $ref: '#/components/responses/NacPortal'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacPortal
      tags:
      - Orgs NAC Portals
    put:
      description: Update Org NAC Portal
      operationId: updateOrgNacPortal
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_portal'
      responses:
        '200':
          $ref: '#/components/responses/NacPortal'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacPortal
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/failures:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    get:
      description: Get List of Org NAC Portal SSO Latest Failures
      operationId: listOrgNacPortalSsoLatestFailures
      parameters:
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/SsoLatestFailures'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacPortalSsoLatestFailures
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/portal_image:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    delete:
      description: 'Delete background image for NAC Portal



        If image is not uploaded or is deleted, NAC Portal will use default image.'
      operationId: deleteOrgNacPortalImage
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacPortalImage
      tags:
      - Orgs NAC Portals
    post:
      description: Upload background image for NAC Portal
      operationId: uploadOrgNacPortalImage
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/psk_portal_image'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: uploadOrgNacPortalImage
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/portal_template:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    put:
      description: Update Org NAC Portal Template
      operationId: updateOrgNacPortalTemplate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_portal_template'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacPortalTemplate
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/saml_metadata:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    get:
      description: Get Org NAC Portal SAML Metadata
      operationId: getOrgNacPortalSamlMetadata
      responses:
        '200':
          $ref: '#/components/responses/SamlMetadata'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacPortalSamlMetadata
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/saml_metadata.xml:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    get:
      description: "Download Org NAC Portal SAML Metadata\n\nExample of metadata.xml:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" validUntil=\"2027-10-12T21:59:01Z\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n    <md:SPSSODescriptor AuthnRequestsSigned=\"false\" WantAssertionsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n        <md:SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/logout\" />\n        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n        <md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" index=\"0\" isDefault=\"true\"/>\n        <md:AttributeConsumingService index=\"0\">\n            <md:ServiceName xml:lang=\"en-US\">Mist</md:ServiceName>\n            <md:RequestedAttribute Name=\"Role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"true\"/>\n            <md:RequestedAttribute Name=\"FirstName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n            <md:RequestedAttribute Name=\"LastName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n        </md:AttributeConsumingService>\n    </md:SPSSODescriptor>\n</md:EntityDescriptor>\n```"
      operationId: downloadOrgNacPortalSamlMetadata
      responses:
        '200':
          $ref: '#/components/responses/File'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: downloadOrgNacPortalSamlMetadata
      tags:
      - Orgs NAC Portals
components:
  schemas:
    response_sso_failure_search:
      additionalProperties: false
      properties:
        results:
          $ref: '#/components/schemas/response_sso_failure_search_results'
      required:
      - results
      type: object
    nac_portal_access_type:
      default: wireless
      description: 'if `type`==`marvis_client`. enum: `wireless`, `wireless+wired`'
      enum:
      - wireless
      - wireless+wired
      type: string
    psk_portal_image:
      additionalProperties: false
      properties:
        file:
          contentMediaType: application/octet-stream
          description: Binary file
          type: string
        json:
          description: JSON string describing the upload
          type: string
      type: object
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    portal_template_alignment:
      default: center
      description: 'defines alignment on portal. enum: `center`, `left`, `right`'
      enum:
      - center
      - left
      - right
      type: string
    nac_portal_type:
      description: "enum: \n  * `guest_admin`: NAC-Based Portal Admin for Pre Created Guest Authentication\n  * `guest_portal`: NAC-Based Guest Portal\n  * `marvis_client`\n"
      enum:
      - guest_admin
      - guest_portal
      - marvis_client
      type: string
    nac_portal_additional_cacerts:
      description: Optional list of additional CA certificates to be used
      examples:
      - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
      items:
        type: string
      type: array
    saml_metadata:
      additionalProperties: false
      properties:
        acs_url:
          description: If `idp_type`==`saml`
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/login
          readOnly: true
          type: string
        entity_id:
          description: If `idp_type`==`saml`
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/login
          readOnly: true
          type: string
        logout_url:
          description: If `idp_type`==`saml`
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/logout
          readOnly: true
          type: string
        metadata:
          description: If `idp_type`==`saml`
          examples:
          - <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://api.mist.com/api/v1/saml/llDfa13f/login" validUntil="2027-10-12T21:59:01Z" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://api.mist.com/api/v1/saml/llDfa13f/login" index="0" isDefault="true"/></md:SPSSODescriptor></md:EntityDescriptor>
          readOnly: true
          type: string
        scim_base_url:
          description: If `idp_type`==`oauth` and `scim_enabled`==`true`
          examples:
          - https://scim.nac-staging.mistsys.com/S_41b2525a-e8b8-4809-8168-f1d8dcbe9735/azure/4d72b1dc-7503-4717-81ea-80d0125b886e
          type: string
      type: object
    nac_portal_guest_portal_auth:
      description: 'Guest portal authentication type. enum: `external`, `multi`, `none`'
      enum:
      - external
      - multi
      - none
      type: string
    response_sso_failure_search_results:
      items:
        $ref: '#/components/schemas/response_sso_failure_search_item'
      type: array
      uniqueItems: true
    nac_portal_sso_idp_sign_algo:
      default: sha256
      description: 'Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`.'
      enum:
      - sha1
      - sha256
      - sha384
      - sha512
      type: string
    nac_portal_sso:
      additionalProperties: false
      properties:
        idp_cert:
          examples:
          - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
          type: string
        idp_sign_algo:
          $ref: '#/components/schemas/nac_portal_sso_idp_sign_algo'
        idp_sso_url:
          examples:
          - https://yourorg.onelogin.com/trust/saml2/http-post/sso/138130
          type: string
        issuer:
          examples:
          - https://app.onelogin.com/saml/metadata/138130
          type: string
        nameid_format:
          examples:
          - email
          type: string
        sso_role_matching:
          $ref: '#/components/schemas/nac_portal_sso_role_matchings'
        use_sso_role_for_cert:
          description: If it's desired to inject a role into Cert's Subject (so it can be used later on in policy)
          type: boolean
      type: object
    nac_portal_guest_portal:
      additionalProperties: false
      description: "Guest portal configuration when `type`==`guest_portal`. If \n  * `auth`==`none`, the user is presented with a terms of service and can click and continue.\n  * `auth`==`external`, the user is redirected to an external URL for authentication.\n  * `auth`==`multi`, the user is presented with a choice of authentication methods:\n    - social logins: facebook / google / amazon / microsoft / azure\n    - sponsor\n    - sms: supported provider: twillio\n    - email\n    - sso\n    - userpass: pre created guest list\n"
      properties:
        auth:
          $ref: '#/components/schemas/nac_portal_guest_portal_auth'
        expire:
          description: If `auth`==`none` or `auth`==`multi`, whether to expire the guest after a certain time
          examples:
          - 1440
          type: integer
        external_portal_url:
          description: If `auth`==`external`, the URL to redirect the user to for authentication
          examples:
          - https://yourorg.com/external-guest-portal
          type: string
        force_reconnect:
          description: Disconnect client (workaround for reauth issues)
          type: boolean
        forward:
          description: If `auth`==`none` or `auth`==`multi`, whether to forward the user to the guest portal after authentication
          examples:
          - true
          type: boolean
        forward_url:
          description: If `auth`==`none` or `auth`==`multi`, URL to forward the user to after authentication
          examples:
          - https://yourorg.com/guest-portal-redirect
          type: string
        max_num_devices:
          default: 0
          description: Maximum number of clients allowed per guest. 0 (default, unlimited), 1-100 range
          examples:
          - 10
          maximum: 100
          minimum: 0
          type: integer
        privacy:
          description: If `auth`==`none` or `auth`==`multi`, whether to show the privacy policy
          examples:
          - true
          type: boolean
      type: object
    nac_portal_sso_role_matchings:
      items:
        $ref: '#/components/schemas/nac_portal_sso_role_matching'
      type: array
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    timestamp:
      description: Epoch (seconds)
      format: double
      readOnly: true
      type: number
    response_sso_failure_search_item:
      additionalProperties: false
      properties:
        detail:
          type: string
        saml_assertion_xml:
          type: string
        timestamp:
          $ref: '#/components/schemas/timestamp'
      required:
      - timestamp
      - detail
      - saml_assertion_xml
      type: object
    nac_portal_sso_role_matching:
      additionalProperties: false
      properties:
        assigned:
          examples:
          - user
          type: string
        match:
          examples:
          - Student
          type: string
      type: object
    nac_portal_eap_type:
      default: wpa2
      description: 'enum: `wpa2`, `wpa3`'
      enum:
      - wpa2
      - wpa3
      type: string
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    nac_portal_template:
      properties:
        alignment:
          $ref: '#/components/schemas/portal_template_alignment'
        color:
          default: '#1074bc'
          type: string
        logo:
          description: Custom logo custom logo with "data:image/png;base64," format. default null, uses Juniper Mist Logo.
          type: string
        poweredBy:
          default: false
          description: Whether to hide "Powered by Juniper Mist" and email footers
          type: boolean
      type: object
    nac_portal:
      properties:
        access_type:
          $ref: '#/components/schemas/nac_portal_access_type'
        additional_cacerts:
          $ref: '#/components/schemas/nac_portal_additional_cacerts'
        additional_nac_server_name:
          description: Optional list of additional NAC server names
          examples:
          - - nac1.corp.com
            - nac2.corp.com
          items:
            type: string
          type: array
        bg_image_url:
          description: Background image
          type: string
        cert_expire_time:
          description: In days
          examples:
          - 365
          type: integer
        eap_type:
          $ref: '#/components/schemas/nac_portal_eap_type'
        enable_telemetry:
          description: Model, version, fingering, events (connecting, disconnect, roaming), which ap
          type: boolean
        expiry_notification_time:
          description: In days
          type: integer
        name:
          examples:
          - get-wifi
          type: string
        notify_expiry:
          description: phase 2
          type: boolean
        portal:
          $ref: '#/components/schemas/nac_portal_guest_portal'
        portal_authorize_jwt_secret:
          description: If `type`==`guest_portal` and `auth`==`external`, the `portal_authorize_jwt_secret` will be generated
          examples:
          - 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
          readOnly: true
          type: string
        portal_authorize_url:
          description: If `type`==`guest_portal` and `auth`==`external`, the `portal_authorize_url` will be generated
          examples:
          - https://guest-mistnac.mist.com/callback/be22bba7-8e22-e1cf-5185-b880816fe2cf/authorize
          readOnly: true
          type: string
        portal_sso_url:
          description: If `type`==`guest_portal` or `type`==`guest_admin` and ans SSO is enabled, the `portal_sso_url` will be generated (which needs to be configured in your IDP
          examples:
          - https://guest-mistnac.mist.com/callback/be22bba7-8e22-e1cf-5185-b880816fe2cf/acs
          readOnly: true
          type: string
        ssid:
          examples:
          - Corp
          type: string
        sso:
          $ref: '#/components/schemas/nac_portal_sso'
        template_url:
          type: string
        thumbnail_url:
          readOnly: true
          type: string
        tos:
          type: string
        type:
          $ref: '#/components/schemas/nac_portal_type'
        ui_url:
          description: If `auth`==`guest_admin`, the URL to the guest admin portal
          examples:
          - https://guest-mistnac.mist.com/admin/51908ea7-dea7-4581-a578-f7320c4d5216/login
          readOnly: true
          type: string
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    nac_portals:
      items:
        $ref: '#/components/schemas/nac_portal'
      type: array
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    start:
      description: Start time (epoch timestamp in seconds, or relative string like "-1d", "-1w")
      in: query
      name: start
      schema:
        type: string
    duration:
      description: Duration like 7d, 2w
      in: query
      name: duration
      schema:
        default: 1d
        examples:
        - 10m
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    end:
      description: End time (epoch timestamp in seconds, or relative string like "-1d", "-2h", "now")
      in: query
      name: end
      schema:
        type: string
    nacportal_id:
      in: path
      name: nacportal_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  responses:
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    File:
      content:
        application/json:
          schema:
            contentMediaType: application/octet-stream
            description: File
            type: string
        application/vnd.api+json:
          schema:
            contentMediaType: application/octet-stream
            description: File
            type: string
      description: OK
    NacPortal:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/NacPortalExample'
          schema:
            $ref: '#/components/schemas/nac_portal'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/NacPortalExample'
          schema:
            $ref: '#/components/schemas/nac_portal'
      description: OK
    NacPortalArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/NacPortalArrayExample'
          schema:
            $ref: '#/components/schemas/nac_portals'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/NacPortalArrayExample'
          schema:
            $ref: '#/components/schemas/nac_portals'
      description: OK
    SamlMetadata:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SamlMetadataExample'
          schema:
            $ref: '#/components/schemas/saml_metadata'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SamlMetadataExample'
          schema:
            $ref: '#/components/schemas/saml_metadata'
      description: OK
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    OK:
      description: OK
    SsoLatestFailures:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SsoLatestFailuresExample'
          schema:
            $ref: '#/components/schemas/response_sso_failure_search'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SsoLatestFailuresExample'
          schema:
            $ref: '#/components/schemas/response_sso_failure_search'
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    SsoLatestFailuresExample:
      value:
        results:
        - detail: string
          saml_assertion_xml: string
          timestamp: 0
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    NacPortalArrayExample:
      value:
      - access_type: wireless
        additional_cacerts:
        - '-----BEGIN CERTIFICATE-----

          MIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE

          -----END CERTIFICATE-----'
        cert_expire_time: 365
        enable_telemetry: true
        expiry_notification_time: 2
        name: get-wifi
        notify_expiry: true
        ssid: Corp
        sso:
          idp_cert: '-----BEGIN CERTIFICATE-----

            MIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE

            -----END CERTIFICATE-----'
          idp_sign_algo: sha256
          idp_sso_url: https://yourorg.onelogin.com/trust/saml2/http-post/sso/138130
          issuer: https://app.onelogin.com/saml/metadata/138130
          nameid_format: email
          sso_role_matching:
          - assigned: user
            match: Student
          use_sso_role_for_cert: true
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    NacPortalExample:
      value:
        access_type: wireless
        cert_expire_time: 365
        enable_telemetry: true
        expiry_notification_time: 2
        name: get-wifi
        notify_expiry: true
        ssid: Corp
        sso:
          idp_cert: '-----BEGIN CERTIFICATE-----

            MIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE

            -----END CERTIFICATE-----'
          idp_sign_algo: sha256
          idp_sso_url: https://yourorg.onelogin.com/trust/saml2/http-post/sso/138130
          issuer: https://app.onelogin.com/saml/metadata/138130
          nameid_format: email
          sso_role_matching:
          - assigned: user
            match: Student
          use_sso_role_for_cert: true
    SamlMetadataExample:
      value:
        acs_url: https://api.mist.com/api/v1/saml/llDfa13f/login
        entity_id: https://api.mist.com/api/v1/saml/llDfa13f/login
        logout_url: https://api.mist.com/api/v1/saml/llDfa13f/logout
        metadata: <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://api.mist.com/api/v1/saml/llDfa13f/login" validUntil="2027-10-12T21:59:01Z" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://api.mist.com/api/v1/saml/llDfa13f/login" index="0" isDefault="true"/></md:SPSSODescriptor></md:EntityDescriptor>
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey