openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs Security Policies API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: "Security Policy is designed to audit / catch discrepancies between\n\"what's intended to be running\" versus \"what's actually running\" in a network. \n\nMany big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy.\n Whenever an AP is provisioned, the configuration will be checked against the security policy.\n Any violations will be flagged in [Device Config History](/#operations/searchSiteDeviceConfigHistory) where you can search for the when and where the violation occurs."
  name: Orgs Security Policies
paths:
  /api/v1/orgs/{org_id}/secpolicies:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get List of Org Security Policies
      operationId: listOrgSecPolicies
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/SecpoliciesArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgSecPolicies
      tags:
      - Orgs Security Policies
    post:
      description: Create Org Security Policy
      operationId: createOrgSecPolicy
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  name: string
                  wlans:
                  - acct_immediate_update: false
                    acct_interim_interval: 0
                    acct_servers:
                    - host: 1.2.3.4
                      keywrap_enabled: true
                      keywrap_format: hex
                      keywrap_kek: '1122334455'
                      keywrap_mack: '1122334455'
                      port: 1813
                      secret: testing123
                    allow_ipv6_ndp: true
                    allow_mdns: false
                    allow_ssdp: false
                    app_limit:
                      apps:
                        dropbox: 300
                        netflix: 60
                      enabled: false
                      wxtag_ids:
                        f99862d9-2726-931f-7559-3dfdf5d070d3: 30
                    app_qos:
                      apps:
                        skype-business-video:
                          dscp: 32
                          dst_subnet: 10.2.0.0/16
                          src_subnet: 10.2.0.0/16
                      enabled: true
                      others:
                      - dscp: 32
                        dst_subnet: 10.2.0.0/16
                        port_ranges: 80,1024-6553
                        protocol: udp
                        src_subnet: 10.2.0.0/16
                    arp_filter: false
                    auth:
                      anticlog_threshold: 16
                      eap_reauth: false
                      enable_mac_auth: false
                      key_idx: 1
                      keys:
                      - string
                      multi_psk_only: false
                      pairwise:
                      - wpa2-ccmp
                      private_wlan: true
                      psk: foryoureyesonly
                      type: psk
                      wep_as_secondary_auth: true
                    auth_server_selection: ordered
                    auth_servers:
                    - host: 1.2.3.4
                      keywrap_enabled: true
                      keywrap_format: hex
                      keywrap_kek: '1122334455'
                      keywrap_mack: '1122334455'
                      port: 1812
                      secret: testing123
                    auth_servers_nas_id: 5c5b350e0101-nas
                    auth_servers_nas_ip: 15.3.1.5
                    auth_servers_retries: 5
                    auth_servers_timeout: 5
                    band: string
                    band_steer: false
                    band_steer_force_band5: false
                    bands:
                    - '24'
                    - '5'
                    block_blacklist_clients: false
                    bonjour:
                      additional_vlan_ids: 10,20
                      enabled: false
                      services:
                        airplay:
                          radius_groups:
                          - teachers
                          scope: same_ap
                    cisco_cwa:
                      allowed_hostnames:
                      - snapchat.com
                      allowed_subnets:
                      - 63.5.3.0/24
                      blocked_subnets:
                      - 192.168.0.0/16
                      enabled: false
                    client_limit_down: 1000
                    client_limit_down_enabled: false
                    client_limit_up: 512
                    client_limit_up_enabled: false
                    coa_servers:
                    - disable_event_timestamp_check: false
                      enabled: false
                      ip: 1.2.3.4
                      port: 3799
                      secret: testing456
                    disable_11ax: false
                    disable_ht_vht_rates: false
                    disable_uapsd: false
                    disable_v1_roam_notify: false
                    disable_v2_roam_notify: false
                    disable_wmm: false
                    dns_server_rewrite:
                      enabled: false
                      radius_groups:
                        contractor: 172.1.1.1
                        guest: 8.8.8.8
                    dtim: 2
                    dynamic_psk:
                      default_psk: foryoureyesonly
                      default_vlan_id: 999
                      enabled: false
                      source: cloud_psks
                    dynamic_vlan:
                      default_vlan_id: 999
                      enabled: false
                      local_vlan_ids:
                      - 1
                      type: airespace-interface-name
                      vlans:
                        '131': default
                        '322': fast,video
                    enable_local_keycaching: false
                    enable_wireless_bridging: false
                    enabled: true
                    fast_dot1x_timers: false
                    hide_ssid: false
                    hostname_ie: false
                    hotspot20:
                      domain_name:
                      - mist.com
                      enabled: true
                      nai_realms:
                      - string
                      operators:
                      - google
                      - att
                      rcoi:
                      - 5A03BA0000
                      venue_name: some_name
                    interface: all
                    isolation: false
                    l2_isolation: false
                    legacy_overds: false
                    limit_bcast: false
                    limit_probe_response: true
                    max_idletime: 1800
                    mist_nac:
                      enabled: false
                    no_static_dns: false
                    no_static_ip: false
                    portal:
                      amazon_client_id: string
                      amazon_client_secret: string
                      amazon_email_domains:
                      - string
                      amazon_enabled: false
                      auth: none
                      azure_client_id: string
                      azure_client_secret: string
                      azure_enabled: false
                      azure_tenant_id: string
                      broadnet_password: password
                      broadnet_sid: MIST
                      broadnet_user_id: juniper
                      bypass_when_cloud_down: false
                      clickatell_api_key: string
                      cross_site: false
                      email_enabled: true
                      enabled: false
                      expire: 1440
                      external_portal_url: string
                      facebook_client_id: string
                      facebook_client_secret: string
                      facebook_email_domains:
                      - string
                      facebook_enabled: false
                      forward: false
                      forward_url: https://abc.com/promotions
                      google_client_id: string
                      google_client_secret: string
                      google_email_domains:
                      - mydomain.edu
                      - mydomain.org
                      google_enabled: false
                      gupshup_password: string
                      gupshup_userid: string
                      microsoft_client_id: string
                      microsoft_client_secret: string
                      microsoft_email_domains:
                      - string
                      microsoft_enabled: false
                      passphrase_enabled: false
                      password: let me in
                      predefined_sponsors_enabled: true
                      privacy: true
                      puzzel_password: string
                      puzzel_service_id: string
                      puzzel_username: string
                      smsMessageFormat: string
                      sms_enabled: false
                      sms_provider: twilio
                      sponsor_auto_approve: false
                      sponsor_email_domains:
                      - reserved.net
                      - reserved.org
                      sponsor_enabled: false
                      sponsor_link_validity_duration: '30'
                      sponsor_notify_all: false
                      sponsor_status_notify: false
                      sponsors:
                        sponsor1@company.com: FirstName1 LastName1
                        sponsor2@company.com: FirstName2 LastName2
                      sso_default_role: string
                      sso_forced_role: string
                      sso_idp_cert: string
                      sso_idp_sign_algo: sha256
                      sso_idp_sso_url: string
                      sso_issuer: string
                      sso_nameid_format: email
                      telstra_client_id: string
                      telstra_client_secret: string
                      twilio_auth_token: af9dac44c344a875ab5d31cb7abcdefg
                      twilio_phone_number: '+18548888888'
                      twilio_sid: AC72ec6ba0ec5af30e6731c5e47abcdefgh
                    portal_allowed_hostnames:
                    - snapchat.com
                    - ibm.com
                    portal_allowed_subnets:
                    - 63.5.3.0/24
                    portal_denied_hostnames:
                    - msg.snapchat.com
                    qos:
                      class: best_effort
                      overwrite: false
                    radsec:
                      enabled: true
                      idle_timeout: 60
                      mxcluster_ids:
                      - 572586b7-f97b-a22b-526c-8b97a3f609c4
                      proxy_hosts:
                      - mxedge1.local
                      server_name: radsec.abc.com
                      servers:
                      - host: 1.1.1.1
                        port: 1812
                      use_mxedge: true
                      use_site_mxedge: false
                    rateset:
                      '24':
                        ht: 00ff00ff00ff
                        legacy:
                        - '6'
                        - '9'
                        - '12'
                        - '18'
                        - 24b
                        - '36'
                        - '48'
                        - '54'
                        min_rssi: -70
                        template: custom
                        vht: 03ff03ff03ff01ff
                      '5':
                        ht: 00ff00ff00ff
                        legacy:
                        - '6'
                        - '9'
                        - '12'
                        - '18'
                        - 24b
                        - '36'
                        - '48'
                        - '54'
                        min_rssi: -70
                        template: custom
                        vht: 03ff03ff03ff01ff
                    roam_mode: NONE
                    schedule:
                      enabled: false
                      hours:
                        fri: 09:00-17:00
                        mon: 09:00-17:00
                    sle_excluded: false
                    ssid: corporate
                    use_eapol_v1: false
                    vlan_enabled: false
                    vlan_ids:
                    - 3
                    - 4
                    - 5
                    vlan_pooling: false
                    wxtag_ids:
                    - 497f6eca-6276-4993-bfeb-53e4bbba6f08
                    wxtunnel_id: string
                    wxtunnel_remote_id: string
            schema:
              $ref: '#/components/schemas/secpolicy'
      responses:
        '200':
          $ref: '#/components/responses/Secpolicy'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgSecPolicy
      tags:
      - Orgs Security Policies
  /api/v1/orgs/{org_id}/secpolicies/{secpolicy_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/secpolicy_id'
    delete:
      description: Delete Org Security Policy
      operationId: deleteOrgSecPolicy
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgSecPolicy
      tags:
      - Orgs Security Policies
    get:
      description: Get Org Security Policy
      operationId: getOrgSecPolicy
      responses:
        '200':
          $ref: '#/components/responses/Secpolicy'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSecPolicy
      tags:
      - Orgs Security Policies
    put:
      description: Update Org Security Policy
      operationId: updateOrgSecPolicy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/secpolicy'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/Secpolicy'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgSecPolicy
      tags:
      - Orgs Security Policies
components:
  schemas:
    wlan_mxtunnel_ids:
      description: When `interface`=`mxtunnel`, id of the Mist Tunnel
      format: uuid
      items:
        examples:
        - 08cd7499-5841-51c8-e663-fb16b6f3b45e
        type: string
      type: array
    wlan_cisco_cwa_allowed_hostnames:
      description: List of hostnames without http(s):// (matched by substring)
      items:
        examples:
        - snapchat.com
        type: string
      type: array
    coa_server:
      additionalProperties: false
      description: CoA Server
      properties:
        disable_event_timestamp_check:
          default: false
          description: Whether to disable Event-Timestamp Check
          type: boolean
        enabled:
          default: false
          type: boolean
        ip:
          examples:
          - 1.2.3.4
          format: ipv4
          type: string
        port:
          $ref: '#/components/schemas/radius_coa_port'
        secret:
          examples:
          - testing456
          type: string
      required:
      - ip
      - secret
      type: object
    strings:
      items:
        type: string
      type: array
      uniqueItems: true
    wlan_bonjour:
      additionalProperties: false
      description: Bonjour gateway wlan settings
      properties:
        additional_vlan_ids:
          $ref: '#/components/schemas/additional_vlan_ids'
        enabled:
          default: false
          description: Whether to enable bonjour for this WLAN. Once enabled, limit_bcast is assumed true, allow_mdns is assumed false
          type: boolean
        services:
          additionalProperties:
            $ref: '#/components/schemas/wlan_bonjour_service_properties'
          description: "What services are allowed. \nProperty key is the service name"
          examples:
          - airplay:
              radius_groups:
              - teachers
              scope: same_ap
          type: object
      type: object
    wlan_portal_sponsors:
      description: Object of allowed sponsors email with name. Required if `sponsor_enabled` is `true` and `sponsor_email_domains` is empty. Property key is the sponsor email, Property value is the sponsor name. List of email allowed for backward compatibility
      oneOf:
      - $ref: '#/components/schemas/wlan_portal_sponsors_list'
      - $ref: '#/components/schemas/wlan_portal_sponsors_object'
    hour:
      default: ''
      description: Hour range of the day (e.g. `09:00-17:00`). If the hour is not defined then it's treated as 00:00-23:59.
      examples:
      - 09:00-17:00
      type: string
    wlan_schedule:
      additionalProperties: false
      description: WLAN operating schedule, default is disabled
      properties:
        enabled:
          default: false
          type: boolean
        hours:
          $ref: '#/components/schemas/hours'
      type: object
    radsec_idle_timeout:
      anyOf:
      - default: 60
        type: integer
      - type: string
      description: Radsec Idle Timeout in seconds. Default is 60
    radius_acct_port:
      anyOf:
      - maximum: 65545
        minimum: 1
        type: integer
      - type: string
      description: Radius Auth Port, value from 1 to 65535, default is 1813
    wlan_bonjour_service_properties_scope:
      default: same_site
      description: 'how bonjour services should be discovered for the same WLAN. enum: `same_ap`, `same_map`, `same_site`'
      enum:
      - same_ap
      - same_map
      - same_site
      type: string
    wlan_bonjour_service_properties:
      additionalProperties: false
      properties:
        disable_local:
          default: false
          description: Whether to prevent wireless clients to discover bonjour devices on the same WLAN
          type: boolean
        radius_groups:
          $ref: '#/components/schemas/wlan_bonjour_service_properties_radius_groups'
        scope:
          $ref: '#/components/schemas/wlan_bonjour_service_properties_scope'
      type: object
    wlan_dynamic_vlan_default_vlan_ids:
      description: Default VLAN ID(s) can be a number, a range of VLAN IDs, a variable or multiple numbers, ranges or variables as a VLAN pool. Default VLAN as a pool of VLANS requires 0.14.x or newer firmware
      items:
        $ref: '#/components/schemas/wlan_dynamic_vlan_default_vlan_id'
      type: array
    secpolicy_list:
      items:
        $ref: '#/components/schemas/secpolicy'
      type: array
    radius_coa_port:
      anyOf:
      - maximum: 65545
        minimum: 1
        type: integer
      - type: string
      description: Radius CoA Port, value from 1 to 65535, default is 3799
    wlan_portal_allowed_subnets:
      default: []
      description: List of CIDRs
      examples:
      - - 63.5.3.0/24
      items:
        type: string
      type: array
    wlan_portal:
      additionalProperties: false
      description: Portal wlan settings
      properties:
        allow_wlan_id_roam:
          default: false
          description: Optional if `amazon_enabled`==`true`. Whether to allow guest to connect to other Guest WLANs (with different `WLAN.ssid`) of same org without reauthentication (disable random_mac for seamless roaming)
          type: boolean
        amazon_client_id:
          default: ''
          description: Optional if `amazon_enabled`==`true`. Amazon OAuth2 client id. This is optional. If not provided, it will use a default one.
          type:
          - string
          - 'null'
        amazon_client_secret:
          default: ''
          description: Optional if `amazon_enabled`==`true`. Amazon OAuth2 client secret. If amazon_client_id was provided, provide a corresponding value. Else leave blank.
          type:
          - string
          - 'null'
        amazon_email_domains:
          $ref: '#/components/schemas/wlan_portal_amazon_email_domains'
        amazon_enabled:
          default: false
          description: Whether amazon is enabled as a login method
          type: boolean
        amazon_expire:
          default: null
          description: Optional if `amazon_enabled`==`true`. Interval for which guest remains authorized using amazon auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        auth:
          $ref: '#/components/schemas/wlan_portal_auth'
        azure_client_id:
          default: ''
          description: Required if `azure_enabled`==`true`. Azure active directory app client id
          type:
          - string
          - 'null'
        azure_client_secret:
          default: ''
          description: Required if `azure_enabled`==`true`. Azure active directory app client secret
          type:
          - string
          - 'null'
        azure_enabled:
          default: false
          description: Whether Azure Active Directory is enabled as a login method
          type: boolean
        azure_expire:
          default: null
          description: Interval for which guest remains authorized using azure auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        azure_tenant_id:
          default: ''
          description: Required if `azure_enabled`==`true`. Azure active directory tenant id.
          type:
          - string
          - 'null'
        broadnet_password:
          default: ''
          description: Required if `sms_provider`==`broadnet`
          examples:
          - password
          format: password
          type: string
        broadnet_sid:
          description: Required if `sms_provider`==`broadnet`
          examples:
          - MIST
          type: string
        broadnet_user_id:
          description: Required if `sms_provider`==`broadnet`
          examples:
          - juniper
          type: string
        bypass_when_cloud_down:
          default: false
          description: Whether to bypass the guest portal when cloud not reachable (and apply the default policies)
          type: boolean
        clickatell_api_key:
          description: Required if `sms_provider`==`clickatell`
          type: string
        cross_site:
          default: false
          description: Whether to allow guest to roam between WLANs (with same `WLAN.ssid`, regardless of variables) of different sites of same org without reauthentication (disable random_mac for seamless roaming)
          type: boolean
        email_enabled:
          default: false
          description: Whether email (access code verification) is enabled as a login method
          type: boolean
        enabled:
          default: false
          description: Whether guest portal is enabled
          type: boolean
        expire:
          default: 1440
          description: How long to remain authorized, in minutes
          examples:
          - 1440
          type: integer
        external_portal_url:
          default: ''
          description: Required if `wlan_portal_auth`==`external`. External portal URL (e.g. https://host/url) where we can append our query parameters to
          type: string
        facebook_client_id:
          default: ''
          description: Required if `facebook_enabled`==`true`. Facebook OAuth2 app id. This is optional. If not provided, it will use a default one.
          type:
          - string
          - 'null'
        facebook_client_secret:
          default: ''
          description: Required if `facebook_enabled`==`true`. Facebook OAuth2 app secret. If facebook_client_id was provided, provide a corresponding value. Else leave blank.
          type:
          - string
          - 'null'
        facebook_email_domains:
          $ref: '#/components/schemas/wlan_portal_facebook_email_domains'
        facebook_enabled:
          default: false
          description: Whether facebook is enabled as a login method
          type: boolean
        facebook_expire:
          default: null
          description: Optional if `facebook_enabled`==`true`. Interval for which guest remains authorized using facebook auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        forward:
          default: false
          description: Whether to forward the user to another URL after authorized
          type: boolean
        forward_url:
          default: ''
          description: URL to forward the user to
          examples:
          - https://abc.com/promotions
          type:
          - string
          - 'null'
        google_client_id:
          default: ''
          description: Google OAuth2 app id. This is optional. If not provided, it will use a default one.
          type:
          - string
          - 'null'
        google_client_secret:
          default: ''
          description: Optional if `google_enabled`==`true`. Google OAuth2 app secret. If google_client_id was provided, provide a corresponding value. Else leave blank.
          type:
          - string
          - 'null'
        google_email_domains:
          $ref: '#/components/schemas/wlan_portal_google_email_domains'
        google_enabled:
          default: false
          description: Whether Google is enabled as login method
          type: boolean
        google_expire:
          default: null
          description: Optional if `google_enabled`==`true`. Interval for which guest remains authorized using Google Auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        gupshup_password:
          description: Required if `sms_provider`==`gupshup`
          format: password
          type: string
        gupshup_userid:
          description: Required if `sms_provider`==`gupshup`
          type: string
        microsoft_client_id:
          default: ''
          description: Optional if `microsoft_enabled`==`true`. Microsoft 365 OAuth2 client id. This is optional. If not provided, it will use a default one.
          type:
          - string
          - 'null'
        microsoft_client_secret:
          default: ''
          description: Optional if `microsoft_enabled`==`true`. Microsoft 365 OAuth2 client secret. If microsoft_client_id was provided, provide a corresponding value. Else leave blank.
          type:
          - string
          - 'null'
        microsoft_email_domains:
          $ref: '#/components/schemas/wlan_portal_microsoft_email_domains'
        microsoft_enabled:
          default: false
          description: Whether microsoft 365 is enabled as a login method
          type: boolean
        microsoft_expire:
          default: null
          description: Optional if `microsoft_enabled`==`true`. Interval for which guest remains authorized using microsoft auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        passphrase_enabled:
          default: false
          description: Whether password is enabled
          type: boolean
        passphrase_expire:
          default: null
          description: Optional if `passphrase_enabled`==`true`. Interval for which guest remains authorized using passphrase auth (in minutes), if not provided, uses `expire`
          type:
          - integer
          - 'null'
        password:
          default: ''
          description: Required if `passphrase_enabled`==`true`.
          examples:
          - let me in
          type:
          - string
          - 'null'
        predefined_sponsors_enabled:
          default: true
          description: Whether to show list of sponsor emails mentioned in `sponsors` object as a dropdown. If both `sponsor_notify_all` and `predefined_sponsors_enabled` are false, behavior is acc to `sponsor_email_domains`
          type: boolean
        predefined_sponsors_hide_email:
          default: false
          description: Whether to hide sponsor’s email from list of sponsors
          type: boolean
        privacy:
          default: false
          type: boolean
        puzzel_password:
          description: Required if `sms_provider`==`puzzel`
          format: password
          type: string
        puzzel_service_id:
          description: Required if `sms_provider`==`puzzel`
          type: string
        puzzel_username:
          description: Required if `sms_provider`==`puzzel`
          type: string
        smsMessageFormat:
          default: Code {{code}} expires in {{duration}} minutes.
          description: Optional if `sms_enabled`==`true`. SMS Message format
          type: string
        sms_enabled:
          default: false
          description: Whether sms is enabled as a login method
          type: boolean
        sms_expire:
          default: null
          description: Optional if `sms_enabled`==`true`. Interval for which guest remains authorized using sms auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        sms_provider:
          $ref: '#/components/schemas/wlan_portal_sms_provider'
        smsglobal_api_key:
          description: Required if `sms_provider`==`smsglobal`, Client API Key
          type: string
        smsglobal_api_secret:
          description: Required if `sms_provider`==`smsglobal`, Client secret
          format: password
          type: string
        sponsor_auto_approve:
          default: false
          description: Optional if `sponsor_enabled`==`true`. Whether to automatically approve guest and allow sponsor to revoke guest access, needs predefined_sponsors_enabled enabled and sponsor_notify_all disabled
          type: boolean
        sponsor_email_domains:
          $ref: '#/components/schemas/wlan_portal_sponsor_email_domains'
        sponsor_enabled:
          default: false
          description: Whether sponsor is enabled
          type: boolean
        sponsor_expire:
          default: null
          description: Optional if `sponsor_enabled`==`true`. Interval for which guest remains authorized using sponsor auth (in minutes), if not provided, uses expire`
          type:
          - integer
          - 'null'
        sponsor_link_validity_duration:
          $ref: '#/components/schemas/sponsor_link_validity_duration'
        sponsor_notify_all:
          default: false
          description: Optional if `sponsor_enabled`==`true`. whether to notify all sponsors that are mentioned in `sponsors` object. Both `sponsor_notify_all` and `predefined_sponsors_enabled` should be true in order to notify sponsors. If true, email sent to 10 sponsors in no particular order.
          type: boolean
        sponsor_status_notify:
          default: false
          description: Optional if `sponsor_enabled`==`true`. If enabled, guest will get email about sponsor's action (approve/deny)
          type: boolean
        sponsors:
          $ref: '#/components/schemas/wlan_portal_sponsors'
        sso_default_role:
          default: ''
          description: Optional if `wlan_portal_auth`==`sso`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched
          type: string
        sso_forced_role:
          default: ''
          description: Optional if `wlan_portal_auth`==`sso`
          type: string
        sso_idp_cert:
          default: ''
          description: Required if `wlan_portal_auth`==`sso`. IDP Cert (used to verify the signed response)
          type: string
        sso_idp_sign_algo:
          $ref: '#/components/schemas/wlan_portal_idp_sign_algo'
        sso_idp_sso_url:
          default: ''
          description: Required if `wlan_portal_auth`==`sso`, IDP Single-Sign-On URL
          type: string
        sso_issuer:
          default: ''
          description: Required if `wlan_portal_auth`==`sso`, IDP issuer URL
          type: string
        sso_nameid_format:
          $ref: '#/components/schemas/wlan_portal_sso_nameid_format'
        telstra_client_id:
          description: Required if `sms_provider`==`telstra`, Client ID provided by Telstra
          type: string
        telstra_client_secret:
          description: Required if `sms_provider`==`telstra`, Client secret provided by Telstra
          format: password
          type: string
        twilio_auth_token:
          description: Required if `sms_provider`==`twilio`, Auth token account with twilio account
          examples:
          - af9dac44c344a875ab5d31cb7abcdefg
          type:
          - string
          - 'null'
        twilio_phone_number:
          description: Required if `sms_provider`==`twilio`, Twilio phone number associated with the account. See example for accepted format.
          examples:
          - '+18548888888'
          type:
          - string
          - 'null'
        twilio_sid:
          description: Required if `sms_provider`==`twilio`, Account SID provided by Twilio
          examples:
          - af9dac44c344a875ab5d31cb7abcdefg
          type:
          - string
          - 'null'
      type: object
    wlan_auth_servers:
      description: List of RADIUS authentication servers, at least one is needed if `auth type`==`eap`, order matters where the first one is treated as primary
      items:
        $ref: '#/components/schemas/radius_auth_server'
      type: array
    wlan_auth_pairwise:
      default:
      - wpa2-ccmp
      description: When `type`=`psk` or `type`=`eap`, one or more of `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`
      items:
        $ref: '#/components/schemas/wlan_auth_pairwise_item'
      type: array
    wlan_ap_ids:
      description: List of device ids
      items:
        format: uuid
        type: string
      type:
      - array
      - 'null'
    wlan_auth_type:
      default: open
      description: 'enum: `eap`, `eap192`, `open`, `psk`, `psk-tkip`, `psk-wpa2-tkip`, `wep`'
      enum:
      - eap
      - eap192
      - open
      - psk
      - psk-tkip
      - psk-wpa2-tkip
      - wep
      examples:
      - psk
      type: string
    wlan_portal_idp_sign_algo:
      default: sha1
      description: 'Optional if `wlan_portal_auth`==`sso`, Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`'
      enum:
      - sha1
      - sha256
      - sha384
      - sha512
      type: string
    secpolicy:
      description: Security Policy is designed to audit / catch discrepancies between "what’s intended to be running" versus "what’s actually running" in a network. Many big organizations have separated Security and IT team (for good reasons). Each site can be assigned a security policy. Whenever an AP is provisioned, the configuration will be checked against the security policy. Any violations will be flagged in Device Config History where you can search for the when and where the violation occurs.
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
        id:
          $ref: '#/components/schemas/id'
        modified_time:
          $ref: '#/components/schemas/modified_time'
        name:
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
        site_id:
          $ref: '#/components/schemas/site_id'
        wlans:
          $ref: '#/components/schemas/secpolicy_wlans'
      type: object
    radsec_servers:
      description: List of RadSec Servers. Only if not Mist Edge.
      items:
        $ref: '#/components/schemas/radsec_server'
      type: array
      uniqueItems: true
    wlan_hotspot20_domain_name:
      examples:
      - - mist.com
      items:
        type: string
      type: array
    wlan_hotspot_20:
      additionalProperties: false
      description: Hostspot 2.0 wlan settings
      properties:
        domain_name:
          $ref: '#/components/schemas/wlan_hotspot20_domain_name'
        enabled:
          description: Whether to enable hotspot 2.0 config
          type: boolean
        nai_realms:
          $ref: '#/components/schemas/strings'
        operators:
          $ref: '#/components/schemas/wlan_hotspot20_operators'
        rcoi:
          $ref: '#/components/schemas/wlan_hotspot20_rcoi'
        venue_name:
          description: Venue name, default is site name
          examples:
          - some_name
          type: string
      type: object
    coa_servers:
      description: List of COA (change of authorization) servers, optional
      items:
        $ref: '#/components/schemas/coa_server'
      type: array
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    wlan_rateset:
      additionalProperties:
        $ref: '#/components/schemas/wlan_datarates'
      description: 'Property key is the RF band. enum: `24`, `5`, `6`'
      type: object
    wlan_portal_microsoft_email_domains:
      default: []
      description: Optional if `microsoft_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.
      items:
        type: string
      type: array
    wlan_vlan_id_with_variable:
      oneOf:
      - type: string
      - maximum: 4094
        minimum: 1
        type: integer
      - type: 'null'
    dynamic_psk_source:
      default: radius
      description: 'enum: `cloud_psks`, `radius`'
      enum:
      - cloud_psks
      - radius
      examples:
      - cloud_psks
      type: string
    radius_acct_server:
      additionalProperties: false
      properties:
        host:
          description: IP/ hostname of RADIUS server
          examples:
          - 1.2.3.4
          type: string
        keywrap_enabled:
          type: boolean
        keywrap_format:
          $ref: '#/components/schemas/radius_keywrap_format'
        keywrap_kek:
          examples:
          - '1122334455'
          type: string
        keywrap_mack:
          examples:
          - '1122334455'
          type: string
        port:
          $ref: '#/components/schemas/radius_acct_port'
        secret:
          description: Secret of RADIUS server
          examples:
          - testing123
          format: password
          type: string
      required:
      - host
      - secret
      type: object
    radius_auth_port:
      anyOf:
      - maximum: 65545
        minimum: 1
        type: integer
      - type: string
      description: Radius Auth Port, value from 1 to 65535, default is 1812
    wlan_portal_sso_nameid_format:
      default: email
      description: 'Optional if `wlan_portal_auth`==`sso`. enum: `email`, `unspecified`'
      enum:
      - email
      - unspecified
      type: string
    radsec_proxy_hosts:
      description: Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `use_site_mxedge`
      items:
        examples:
        - mxedge1.local
        type: string
      type: array
    wlan_vlan_ids_string:
      description: If `vlan_enabled`==`true` and `vlan_pooling`==`true`. List of VLAN IDs to be used in the VLAN Pool
      examples:
      - 1,2
      type: string
    wlan_qos_class:
      default: best_effort
      description: 'enum: `background`, `best_effort`, `video`, `voice`'
      enum:
      - background
      - best_effort
      - video
      - voice
      examples:
      - best_effort
      type: string
    wlan_wxtag_ids:
      description: List of wxtag_ids
      items:
        format: uuid
        type: string
      type:
      - array
      - 'null'
    radius_auth_server:
      additionalProperties: false
      description: Authentication Server
      properties:
        host:
          description: IP/ hostname of RADIUS server
          examples:
          - 1.2.3.4
          type: string
        keywrap_enabled:
          type: boolean
        keywrap_format:
          $ref: '#/components/schemas/radius_keywrap_format'
        keywrap_kek:
          examples:
          - '1122334455'
          type: string
        keywrap_mack:
          examples:
          - '1122334455'
          type: string
        port:
          $ref: '#/components/schemas/radius_auth_port'
        require_message_authenticator:
          default: false
          description: Whether to require Message-Authenticator in requests
          type: boolean
        secret:
          description: Secret of RADIUS server
          examples:
          - testing123
          format: password
          type: string
      required:
      - host
      - secret
      type: object
    wlan_cisco_cwa_allowed_subnets:
      description: List of CIDRs
      items:
        examples:
        - 63.5.3.0/24
        type: string
      type: array
    wlan_hotspot20_operators_item:
      description: 'enum: `ameriband`, `att`, `boingo`, `charter`, `eduroam`, `global_reach`, `google`, `hughes_systique`, `openroaming_legacy`, `openroaming_settled`, `openroaming_settlement_free`, `single_digits`, `tmobile`, `verizon`'
      enum:
      - ameriband
      - att
      - boingo
      - charter
      - eduroam
      - global_reach
      - google
      - hughes_systique
      - openroaming_legacy
      - openroaming_settled
      - openroaming_settlement_free
      - single_digits
      - tmobile
      - verizon
      type: string
    vlan_id_with_variable:
      oneOf:
      - type: string
      - maximum: 4094
        minimum: 1
        type: integer
    wlan_dynamic_vlan_default_vlan_id:
      description: VLAN ID, VLAN range or variable to use when there’s no match from RADIUS
      oneOf:
      - type: string
      - default: 999
        maximum: 4094
        minimum: 1
        type: integer
    additional_vlan_ids_array:
      items:
        $ref: '#/components/schemas/vlan_id_with_variable'
      type: array
    wlan_auth_server_selection:
      default: ordered
      description: 'When ordered, AP will prefer and go back to the first server if possible. enum: `ordered`, `unordered`'
      enum:
      - ordered
      - unordered
      examples:
      - ordered
      type: string
    wlan_hotspot20_operators:
      description: List of operators to support
      examples:
      - - google
        - att
      items:
        $ref: '#/components/schemas/wlan_hotspot20_operators_item'
      type: array
    msp_id:
      examples:
      - b9d42c2e-88ee-41f8-b798-f009ce7fe909
      format: uuid
      readOnly: true
      type: string
    wlan_portal_auth:
      default: none
      description: 'authentication scheme. enum: `amazon`, `azure`, `email`, `external`, `facebook`, `google`, `microsoft`, `multi`, `none`, `password`, `sms`, `sponsor`, `sso`'
      enum:
      - amazon
      - azure
      - email
      - external
      - facebook
      - google
      - microsoft
      - multi
      - none
      - password
      - sms
      - sponsor
      - sso
      examples:
      - none
      type: string
    wlan_datarates_legacy:
      description: If `template`==`custom`. List of supported rates (IE=1) and extended supported rates (IE=50) for custom template, append ‘b’ at the end to indicate a rate being basic/mandatory. If `template`==`custom` is configured and legacy does not define at least one basic rate, it will use `no-legacy` default values
      examples:
      - - '6'
        - '9'
        - '12'
        - '18'
        - 24b
        - '36'
        - '48'
        - '54'
      items:
        $ref: '#/components/schemas/wlan_datarates_legacy_item'
      type: array
    wlan_apply_to:
      description: 'enum: `aps`, `site`, `wxtags`'
      enum:
      - aps
      - site
      - wxtags
      type: string
    wlan_dynamic_vlan_local_vlan_ids:
      description: VLAN_ids to be locally bridged
      items:
        $ref: '#/components/schemas/vlan_id_with_variable'
      type: array
    wlan_portal_google_email_domains:
      default: []
      description: Optional if `google_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.
      examples:
      - - mydomain.edu
        - mydomain.org
      items:
        type: string
      type: array
    wlan_mxtunnel_name:
      description: When `interface`=`site_mxedge`, name of the mxtunnel that in mxtunnels under Site Setting
      items:
        default: default
        examples:
        - default
        type: string
      type: array
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
    wlan_roam_mode:
      default: NONE
      description: 'enum: `11r`, `OKC`, `NONE`'
      enum:
      - 11r
      - NONE
      - OKC
      examples:
      - NONE
      type: string
    wlan:
      description: '**Note**: portal_template will be forked out of wlan objects soon. To fetch portal_template, please query portal_template_url. To update portal_template, use Wlan Portal Template.'
      properties:
        acct_immediate_update:
          default: false
          description: Enable coa-immediate-update and address-change-immediate-update on the access profile.
          type: boolean
        acct_interim_interval:
          default: 0
          description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled
          examples:
          - 0
          maximum: 65535
          minimum: 0
          type: integer
        acct_servers:
          $ref: '#/components/schemas/wlan_acct_servers'
        airwatch:
          $ref: '#/components/schemas/wlan_airwatch'
        allow_ipv6_ndp:
          default: true
          description: Only applicable when `limit_bcast`==`true`, which allows or disallows ipv6 Neighbor Discovery packets to go through
          type: boolean
        allow_mdns:
          default: false
          description: Only applicable when `limit_bcast`==`true`, which allows mDNS / Bonjour packets to go through
          type: boolean
        allow_ssdp:
          default: false
          description: Only applicable when `limit_bcast`==`true`, which allows SSDP
          type: boolean
        ap_ids:
          $ref: '#/components/schemas/wlan_ap_ids'
        app_limit:
          $ref: '#/components/schemas/wlan_app_limit'
        app_qos:
          $ref: '#/components/schemas/wlan_app_qos'
        apply_to:
          $ref: '#/components/schemas/wlan_apply_to'
        arp_filter:
          default: false
          description: Whether to enable smart arp filter
          type: boolean
        auth:
          $ref: '#/components/schemas/wlan_auth'
        auth_server_selection:
          $ref: '#/components/schemas/wlan_auth_server_selection'
        auth_servers:
          $ref: '#/components/schemas/wlan_auth_servers'
        auth_servers_nas_id:
          description: Optional, up to 48 bytes, will be dynamically generated if not provided. used only for authentication servers
          examples:
          - 5c5b350e0101-nas
          type:
          - string
          - 'null'
        auth_servers_nas_ip:
          description: Optional, NAS-IP-ADDRESS to use
          examples:
          - 15.3.1.5
          type:
          - string
          - 'null'
        auth_servers_retries:
          default: 2
          description: Radius auth session retries. Following fast timers are set if "fast_dot1x_timers" knob is enabled. ‘retries’ are set to value of auth_servers_retries. ‘max-requests’ is also set when setting auth_servers_retries and is set to default value to 3.
          examples:
          - 5
          type: integer
        auth_servers_timeout:
          default: 5
          description: Radius auth session timeout. Following fast timers are set if "fast_dot1x_timers" knob is enabled. ‘quite-period’  and ‘transmit-period’ are set to half the value of auth_servers_timeout. ‘supplicant-timeout’ is also set when setting auth_servers_timeout and is set to default value of 10.
          type: integer
        band:
          deprecated: true
          description: '`band` is deprecated and kept for backward compatibility. Use bands instead'
          type: string
        band_steer:
          default: false
          description: Whether to enable band_steering, this works only when band==both
          type: boolean
        band_steer_force_band5:
          default: false
          description: Force dual_band capable client to connect to 5G
          type: boolean
        bands:
          $ref: '#/components/schemas/wlan_bands'
        block_blacklist_clients:
          default: false
          description: Whether to block the clients in the blacklist (up to first 256 macs)
          type: boolean
        bonjour:
          $ref: '#/components/schemas/wlan_bonjour'
        cisco_cwa:
          $ref: '#/components/schemas/wlan_cisco_cwa'
        client_limit_down:
          $ref: '#/components/schemas/wlan_limit'
        client_limit_down_enabled:
          default: false
          description: If downlink limiting per-client is enabled
          type: boolean
        client_limit_up:
          $ref: '#/components/schemas/wlan_limit'
        client_limit_up_enabled:
          default: false
          description: If uplink limiting per-client is enabled
          type: boolean
        coa_servers:
          $ref: '#/components/schemas/coa_servers'
        created_time:
          $ref: '#/components/schemas/created_time'
        disable_11ax:
          default: false
          description: Some old WLAN drivers may not be compatible
          type: boolean
        disable_11be:
          default: false
          description: To disable Wi-Fi 7 EHT IEs
          type: boolean
        disable_ht_vht_rates:
          default: false
          description: To disable ht or vht rates
          type: boolean
        disable_message_authenticator_check:
          default: false
          description: whether to disable Message-Authenticator Check, which is used to verify the integrity of RADIUS messages, default is false (i.e. for better security)
          type: boolean
        disable_uapsd:
          default: false
          description: Whether to disable U-APSD
          type: boolean
        disable_v1_roam_notify:
          default: false
          description: Disable sending v2 roam notification messages
          type: boolean
        disable_v2_roam_notify:
          default: false
          description: Disable sending v2 roam notification messages
          type: boolean
        disable_when_gateway_unreachable:
          default: false
          description: "When any of the following is true, this WLAN will be disabled\n   * cannot get IP\n   * cannot obtain default gateway\n   * cannot reach default gateway"
          type: boolean
        disable_when_mxtunnel_down:
          default: false
          type: boolean
        disable_wmm:
          default: false
          description: Whether to disable WMM
          type: boolean
        dns_server_rewrite:
          $ref: '#/components/schemas/wlan_dns_server_rewrite'
        dtim:
          default: 2
          type: integer
        dynamic_psk:
          $ref: '#/components/schemas/wlan_dynamic_psk'
        dynamic_vlan:
          $ref: '#/components/schemas/wlan_dynamic_vlan'
        enable_local_keycaching:
          default: false
          description: Enable AP-AP keycaching via multicast
          type: boolean
        enable_wireless_bridging:
          default: false
          description: By default, we'd inspect all DHCP packets and drop those unrelated to the wireless client itself in the case where client is a wireless bridge (DHCP packets for other MACs will need to be forwarded), wireless_bridging can be enabled
          type: boolean
        enable_wireless_bridging_dhcp_tracking:
          default: false
          description: If the client bridge is doing DHCP on behalf of other devices (L2-NAT), enable dhcp_tracking will cut down DHCP response packets to be forwarded to wireless
          type: boolean
        enabled:
          default: true
          description: If this wlan is enabled
          type: boolean
        fast_dot1x_timers:
          default: false
          description: If set to true, sets default fast-timers with values calculated from ‘auth_servers_timeout’ and ‘auth_server_retries’ .
          type: boolean
        for_site:
          readOnly: true
          type: boolean
        hide_ssid:
          default: false
          description: Whether to hide SSID in beacon
          type: boolean
        hostname_ie:
          default: false
          description: Include hostname inside IE in AP beacons / probe responses
          type: boolean
        hotspot20:
          $ref: '#/components/schemas/wlan_hotspot_20'
        id:
          $ref: '#/components/schemas/id'
        inject_dhcp_option_82:
          $ref: '#/components/schemas/wlan_inject_dhcp_option_82'
        interface:
          $ref: '#/components/schemas/wlan_interface'
        isolation:
          default: false
          description: Whether to stop clients to talk to each other
          type: boolean
        l2_isolation:
          default: false
          description: If isolation is enabled, whether to deny clients to talk to L2 on the LAN
          type: boolean
        legacy_overds:
          default: false
          description: Legacy devices requires the Over-DS (for Fast BSS Transition) bit set (while our chip doesn’t support it). Warning! Enabling this will cause problem for iOS devices.
          type: boolean
        limit_bcast:
          default: false
          description: Whether to limit broadcast packets going to wireless (i.e. only allow certain bcast packets to go through)
          type: boolean
        limit_probe_response:
          default: false
          description: Limit probe response base on some heuristic rules
          type: boolean
        max_idletime:
          default: 1800
          description: Max idle time in seconds
          examples:
          - 1800
          maximum: 86400
          minimum: 60
          type: integer
        max_num_clients:
          default: 0
          description: Maximum number of client connected to the SSID. `0` means unlimited
          maximum: 128
          minimum: 0
          type: integer
        mist_nac:
          $ref: '#/components/schemas/wlan_mist_nac'
        modified_time:
          $ref: '#/components/schemas/modified_time'
        msp_id:
          $ref: '#/components/schemas/msp_id'
        mxtunnel_id:
          deprecated: true
          description: (deprecated, use mxtunnel_ids instead) when `interface`==`mxtunnel`, id of the Mist Tunnel
          format: uuid
          type: string
        mxtunnel_ids:
          $ref: '#/components/schemas/wlan_mxtunnel_ids'
        mxtunnel_name:
          $ref: '#/components/schemas/wlan_mxtunnel_name'
        no_static_dns:
          default: false
          description: Whether to only allow client to use DNS that we’ve learned from DHCP response
          type: boolean
        no_static_ip:
          default: false
          description: Whether to only allow client that we’ve learned from DHCP exchange to talk
          type: boolean
        org_id:
          $ref: '#/components/schemas/org_id'
        portal:
          $ref: '#/components/schemas/wlan_portal'
        portal_allowed_hostnames:
          $ref: '#/components/schemas/wlan_portal_allowed_hostnames'
        portal_allowed_subnets:
          $ref: '#/components/schemas/wlan_portal_allowed_subnets'
        portal_api_secret:
          default: ''
          description: API secret (auto-generated) that can be used to sign guest authorization requests, only generated when auth is set to `external`
          examples:
          - EIfPMOykI3lMlDdNPub2WcbqT6dNOtWwmYHAd6bY
          type:
          - string
          - 'null'
        portal_denied_hostnames:
          $ref: '#/components/schemas/wlan_portal_denied_hostnames'
        portal_image:
          default: ''
          description: Url of portal background image
          examples:
          - https://url/to/image.png
          format: uri
          readOnly: true
          type:
          - string
          - 'null'
        portal_sso_url:
          description: URL used in the SSO process, auto-generated when auth is set to `sso`
          readOnly: true
          type:
          - string
          - 'null'
        portal_template_url:
          default: ''
          description: N.B portal_template will be forked out of wlan objects soon. To fetch portal_template, please query portal_template_url. To update portal_template, use Wlan Portal Template.
          readOnly: true
          type:
          - string
          - 'null'
        qos:
          $ref: '#/components/schemas/wlan_qos'
        radsec:
          $ref: '#/components/schemas/radsec'
        rateset:
          $ref: '#/components/schemas/wlan_rateset'
        reconnect_clients_when_roaming_mxcluster:
          default: false
          description: When different mxcluster is on different subnet, we'd want to disconnect clients (so they'll reconnect and get new IPs)
          type: boolean
        roam_mode:
          $ref: '#/components/schemas/wlan_roam_mode'
        schedule:
          $ref: '#/components/schemas/wlan_schedule'
        site_id:
          $ref: '#/components/schemas/site_id'
        sle_excluded:
          default: false
          description: Whether to exclude this WLAN from SLE metrics
          type: boolean
        ssid:
          description: Name of the SSID
          examples:
          - corporate
          type: string
        template_id:
          default: ''
          format: uuid
          type:
          - string
          - 'null'
        thumbnail:
          default: ''
          description: Url of portal background image thumbnail
          format: uri
          readOnly: true
          type:
          - string
          - 'null'
        use_eapol_v1:
          default: false
          description: If `auth.type`==`eap` or `auth.type`==`psk`, should only be set for legacy client, such as pre-2004, 802.11b devices
          type: boolean
        vlan_enabled:
          default: false
          description: If vlan tagging is enabled
          type: boolean
        vlan_id:
          $ref: '#/components/schemas/wlan_vlan_id_with_variable'
        vlan_ids:
          $ref: '#/components/schemas/wlan_vlan_ids'
        vlan_pooling:
          default: false
          description: Requires `vlan_enabled`==`true` to be set to `true`. Vlan pooling allows AP to place client on different VLAN using a deterministic algorithm
          type: boolean
        wlan_limit_down:
          $ref: '#/components/schemas/wlan_limit'
        wlan_limit_down_enabled:
          default: false
          description: If downlink limiting for whole wlan is enabled
          type: boolean
        wlan_limit_up:
          $ref: '#/components/schemas/wlan_limit'
        wlan_limit_up_enabled:
          default: false
          description: If uplink limiting for whole wlan is enabled
          type: boolean
        wxtag_ids:
          $ref: '#/components/schemas/wlan_wxtag_ids'
        wxtunnel_id:
          default: ''
          description: When `interface`=`wxtunnel`, id of the WXLAN Tunnel
          type:
          - string
          - 'null'
        wxtunnel_remote_id:
          default: ''
          description: When `interface`=`wxtunnel`, remote tunnel identifier
          type:
          - string
          - 'null'
      required:
      - ssid
      type: object
    sponsor_link_validity_duration:
      anyOf:
      - default: 60
        maximum: 60
        minimum: 5
        type: integer
      - type: string
      description: Optional if `sponsor_enabled`==`true`. How long to remain valid sponsored guest request approve/deny link received in email, in minutes. Value is between 5 and 60.
    wlan_airwatch:
      additionalProperties: false
      description: Airwatch wlan settings
      properties:
        api_key:
          default: ''
          description: API Key
          examples:
          - aHhlbGxvYXNkZmFzZGZhc2Rmc2RmCg=="
          type: string
        console_url:
          default: ''
          description: Console URL
          examples:
          - https://hs1.airwatchportals.com
          type: string
        enabled:
          default: false
          type: boolean
        password:
          default: ''
          description: Password
          examples:
          - user1
          format: password
          type: string
        username:
          default: ''
          description: Username
          examples:
          - test123
          type: string
      type: object
    wlan_portal_facebook_email_domains:
      default: []
      description: Optional if `facebook_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.
      items:
        type: string
      type: array
    wlan_vlan_ids:
      oneOf:
      - $ref: '#/components/schemas/wlan_vlan_ids_string'
      - $ref: '#/components/schemas/wlan_vlan_ids_list'
    additional_vlan_ids:
      anyOf:
      - type: string
      - $ref: '#/components/schemas/additional_vlan_ids_array'
      description: List or Comma separated list of additional VLAN IDs (on the LAN side or from other WLANs) should we be forwarding bonjour queries/responses
    wlan_portal_sponsors_object:
      additionalProperties:
        type: string
      examples:
      - sponsor1@company.com: FirstName1 LastName1
        sponsor2@company.com: FirstName2 LastName2
      type: object
    wlan_qos:
      additionalProperties: false
      properties:
        class:
          $ref: '#/components/schemas/wlan_qos_class'
        overwrite:
          default: false
          description: Whether to overwrite QoS
          type: boolean
      type: object
    radius_keywrap_format:
      description: 'enum: `ascii`, `hex`'
      enum:
      - ascii
      - hex
      type: string
    wlan_portal_sponsors_list:
      items:
        type: string
      type: array
    wlan_hotspot20_rcoi:
      examples:
      - - 5A03BA0000
      items:
        type: string
      type: array
    wlan_dns_server_rewrite:
      additionalProperties: false
      description: For radius_group-based DNS server (rewrite DNS request depending on the Group RADIUS server returns)
      properties:
        enabled:
          default: false
          type: boolean
        radius_groups:
          additionalProperties:
            type: string
          description: Map between radius_group and the desired DNS server (IPv4 only). Property key is the RADIUS group, property value is the desired DNS Server
          examples:
          - contractor: 172.1.1.1
            guest: 8.8.8.8
          type: object
      type:
      - object
      - 'null'
    wlan_cisco_cwa_blocked_subnets:
      description: List of blocked CIDRs
      items:
        examples:
        - 192.168.0.0/16
        type: string
      type: array
    wlan_auth_keys:
      default: []
      description: When type=wep, four 10-character or 26-character hex string, null can be used. All keys, if provided, have to be in the same length
      items:
        type:
        - string
        - 'null'
      type: array
    wlan_mist_nac:
      additionalProperties: false
      properties:
        acct_interim_interval:
          default: 0
          description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.
          examples:
          - 60
          maximum: 65535
          minimum: 0
          type: integer
        auth_servers_retries:
          default: 2
          description: Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3.
          examples:
          - 3
          maximum: 10
          minimum: 1
          type: integer
        auth_servers_timeout:
          default: 5
          description: Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10.
          examples:
          - 5
          maximum: 30
          minimum: 1
          type: integer
        coa_enabled:
          default: false
          description: Allows a RADIUS server to dynamically modify the authorization status of a user session.
          type: boolean
        coa_port:
          description: the communication port used for “Change of Authorization” (CoA) messages
          examples:
          - 3799
          maximum: 65535
          minimum: 1
          type: integer
        enabled:
          default: false
          description: "When enabled:\n  * `auth_servers` is ignored\n  * `acct_servers` is ignored\n  * `auth_servers_*` are ignored\n  * `coa_servers` is ignored\n  * `radsec` is ignored\n  * `coa_enabled` is assumed"
          type: boolean
        fast_dot1x_timers:
          default: false
          description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`.
          type: boolean
        network:
          description: Which network the mist nac server resides in
          examples:
          - default
          type:
          - string
          - 'null'
        source_ip:
          description: In case there is a static IP for this network, we can specify it using source ip
          examples:
          - 1.2.3.4
          type:
          - string
          - 'null'
      type: object
    wlan_auth_pairwise_item:
      description: 'enum: `wpa1-ccmp`, `wpa1-tkip`, `wpa2-ccmp`, `wpa2-tkip`, `wpa3`'
      enum:
      - wpa1-ccmp
      - wpa1-tkip
      - wpa2-ccmp
      - wpa2-tkip
      - wpa3
      examples:
      - wpa3
      type:
      - string
      - 'null'
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    hours:
      additionalProperties: false
      description: Days/Hours of operation filter, the available days (mon, tue, wed, thu, fri, sat, sun)
      properties:
        fri:
          $ref: '#/components/schemas/hour'
        mon:
          $ref: '#/components/schemas/hour'
        sat:
          $ref: '#/components/schemas/hour'
        sun:
          $ref: '#/components/schemas/hour'
        thu:
          $ref: '#/components/schemas/hour'
        tue:
          $ref: '#/components/schemas/hour'
        wed:
          $ref: '#/components/schemas/hour'
      type: object
    wlan_limit:
      anyOf:
      - maximum: 999000
        minimum: 1
        type: integer
      - type: string
      description: In kbps, value from 1 to 999000
    wlan_dynamic_vlan:
      additionalProperties: false
      description: For 802.1x
      properties:
        default_vlan_id:
          $ref: '#/components/schemas/wlan_dynamic_vlan_default_vlan_id_deprecated'
        default_vlan_ids:
          $ref: '#/components/schemas/wlan_dynamic_vlan_default_vlan_ids'
        enabled:
          default: false
          description: Requires `vlan_enabled`==`true` to be set to `true`. Whether to enable dynamic vlan
          type: boolean
        local_vlan_ids:
          $ref: '#/components/schemas/wlan_dynamic_vlan_local_vlan_ids'
        type:
          $ref: '#/components/schemas/wlan_dynamic_vlan_type'
        vlans:
          additionalProperties:
            type: string
          description: "Map between vlan_id (as string) to airespace interface names (comma-separated) or null for standard mapping\n  * if `dynamic_vlan.type`==`standard`, property key is the Vlan ID and property value is \\\"\\\"\n  * if `dynamic_vlan.type`==`airespace-interface-name`, property key is the Vlan ID and property value is the Airespace Interface Name"
          examples:
          - '131': default
            '322': fast,video
          type: object
      type:
      - object
      - 'null'
    wlan_bonjour_service_properties_radius_groups:
      description: Optional, if the service is further restricted for certain RADIUS groups
      items:
        type: string
      type: array
    wlan_dynamic_psk:
      additionalProperties: false
      description: "For dynamic PSK where we get per_user PSK from Radius. dynamic_psk allows PSK to be selected at runtime depending on context (wlan/site/user/...) thus following configurations are assumed (currently)\n  * PSK will come from RADIUS server\n  * AP sends client MAC as username and password (i.e. `enable_mac_auth` is assumed)\n  * AP sends BSSID:SSID as Caller-Station-ID\n  * `auth_servers` is required\n  * PSK will come from cloud WLC if source is cloud_psks\n  * default_psk will be used if cloud WLC is not available\n  * `multi_psk_only` and `psk` is ignored\n  * `pairwise` can only be wpa2-ccmp (for now, wpa3 support on the roadmap)"
      properties:
        default_psk:
          description: Default PSK to use if cloud WLC is not available, 8-63 characters
          examples:
          - foryoureyesonly
          maxLength: 63
          minLength: 8
          type: string
        default_vlan_id:
          $ref: '#/components/schemas/vlan_id_with_variable'
        enabled:
          default: false
          type: boolean
        force_lookup:
          default: false
          description: When 11r is enabled, we'll try to use the cached PMK, this can be disabled. `false` means auto
          type: boolean
        source:
          $ref: '#/components/schemas/dynamic_psk_source'
      type:
      - object
      - 'null'
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    wlan_app_qos_others:
      items:
        $ref: '#/components/schemas/wlan_app_qos_others_item'
      type: array
      uniqueItems: true
    wlan_portal_sponsor_email_domains:
      description: List of domain allowed for sponsor email. Required if `sponsor_enabled` is `true` and `sponsors` is empty.
      examples:
      - - reserved.net
        - reserved.org
      items:
        type: string
      type: array
    wlan_portal_denied_hostnames:
      default: []
      description: List of hostnames without http(s):// (matched by substring), this takes precedence over portal_allowed_hostnames
      examples:
      - - msg.snapchat.com
      items:
        type: string
      type: array
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    radsec_mxcluster_ids:
      description: To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids
      items:
        examples:
        - 572586b7-f97b-a22b-526c-8b97a3f609c4
        format: uuid
        type: string
      type: array
    wlan_dynamic_vlan_default_vlan_id_deprecated:
      deprecated: true
      description: vlan_id to use when there’s no match from RADIUS
      oneOf:
      - type: string
      - default: 999
        maximum: 4094
        minimum: 1
        type: integer
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    wlan_dynamic_vlan_type:
      default: standard
      description: 'standard (using Tunnel-Private-Group-ID, widely supported), airespace-interface-name (Airespace/Cisco). enum: `airespace-interface-name`, `standard`'
      enum:
      - airespace-interface-name
      - standard
      examples:
      - airespace-interface-name
      type: string
    radsec:
      additionalProperties: false
      description: RadSec settings
      properties:
        coa_enabled:
          default: false
          type: boolean
        enabled:
          type: boolean
        idle_timeout:
          $ref: '#/components/schemas/radsec_idle_timeout'
        mxcluster_ids:
          $ref: '#/components/schemas/radsec_mxcluster_ids'
        proxy_hosts:
          $ref: '#/components/schemas/radsec_proxy_hosts'
        server_name:
          description: Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.
          examples:
          - radsec.abc.com
          type: string
        servers:
          $ref: '#/components/schemas/radsec_servers'
        use_mxedge:
          description: use mxedge(s) as RadSec Proxy
          type: boolean
        use_site_mxedge:
          default: false
          description: To use Site mxedges when this WLAN does not use mxtunnel
          type: boolean
      type: object
    secpolicy_wlans:
      items:
        $ref: '#/components/schemas/wlan'
      type: array
      uniqueItems: true
    wlan_app_qos:
      additionalProperties: false
      description: APP qos wlan settings
      properties:
        apps:
          additionalProperties:
            $ref: '#/components/schemas/wlan_app_qos_apps_properties'
          default: {}
          examples:
          - skype-business-video:
              dscp: 32
              dst_subnet: 10.2.0.0/16
              src_subnet: 10.2.0.0/16
          type: object
        enabled:
          default: false
          type: boolean
        others:
          $ref: '#/components/schemas/wlan_app_qos_others'
      type: object
    wlan_bands:
      default:
      - '24'
      - '5'
      - '6'
      description: 'List of radios that the wlan should apply to. enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`'
      items:
        $ref: '#/components/schemas/dot11_band'
      type: array
    wlan_auth:
      additionalProperties: false
      description: Authentication wlan settings
      properties:
        anticlog_threshold:
          default: 16
          description: SAE anti-clogging token threshold
          examples:
          - 16
          maximum: 32
          minimum: 16
          type: integer
        eap_reauth:
          default: false
          description: Whether to trigger EAP reauth when the session ends
          type: boolean
        enable_beacon_protection:
          default: false
          description: Enable Beacon Protection; default is false for better compatibility
          type: boolean
        enable_gcmp256:
          default: false
          description: Enable GCMP-256 encryption suite; default is false for better compatibility
          type: boolean
        enable_mac_auth:
          default: false
          description: Whether to enable MAC Auth, uses the same auth_servers
          type: boolean
        key_idx:
          default: 1
          description: When `type`==`wep`
          maximum: 4
          minimum: 1
          type: integer
        keys:
          $ref: '#/components/schemas/wlan_auth_keys'
        multi_psk_only:
          default: false
          description: When `type`==`psk`, whether to only use multi_psk
          type: boolean
        owe:
          $ref: '#/components/schemas/wlan_auth_owe'
        pairwise:
          $ref: '#/components/schemas/wlan_auth_pairwise'
        private_wlan:
          default: false
          description: When `multi_psk_only`==`true`, whether private wlan is enabled
          type: boolean
        psk:
          default: ''
          description: When `type`==`psk`, 8-64 characters, or 64 hex characters
          examples:
          - foryoureyesonly
          maxLength: 64
          minLength: 8
          type:
          - string
          - 'null'
        type:
          $ref: '#/components/schemas/wlan_auth_type'
        wep_as_secondary_auth:
          default: false
          description: Enable WEP as secondary auth
          type: boolean
      required:
      - type
      type: object
    radsec_server:
      additionalProperties: false
      properties:
        host:
          examples:
          - 1.1.1.1
          type: string
        port:
          examples:
          - 1812
          maximum: 65535
          minimum: 1
          type: integer
      type: object
    wlan_datarates:
      additionalProperties: false
      description: Data rates wlan settings
      properties:
        eht:
          description: If `template`==`custom`. EHT MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit)
          examples:
          - 3fff0fff0fff03ff
          type:
          - string
          - 'null'
        he:
          description: If `template`==`custom`. HE MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit
          examples:
          - 0fff0fff0fff0fff
          type:
          - string
          - 'null'
        ht:
          description: If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 00ff 00f0 001f limits HT rates to MCS 0-7 for 1 stream, MCS 4-7 for 2 stream (i.e. MCS 12-15), MCS 1-5 for 3 stream (i.e. MCS 16-20)
          examples:
          - 00ff00ff00ff
          type:
          - string
          - 'null'
        legacy:
          $ref: '#/components/schemas/wlan_datarates_legacy'
        min_rssi:
          default: 0
          description: Minimum RSSI for client to connect, 0 means not enforcing
          examples:
          - -70
          type: integer
        template:
          $ref: '#/components/schemas/wlan_datarates_template'
        vht:
          description: If `template`==`custom`. MCS bitmasks for 4 streams (16-bit for each stream, MCS0 is least significant bit), e.g. 03ff 01ff 00ff limits VHT rates to MCS 0-9 for 1 stream, MCS 0-8 for 2 streams, and MCS 0-7 for 3 streams.
          examples:
          - 03ff03ff03ff01ff
          type:
          - string
          - 'null'
      type: object
    site_id:
      examples:
      - 441a1214-6928-442a-8e92-e1d34b8ec6a6
      format: uuid
      readOnly: true
      type: string
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    wlan_datarates_template:
      default: compatible
      description: "Data Rates template to apply. enum: \n  * `no-legacy`: no 11b\n  * `compatible`: all, like before, default setting that Broadcom/Atheros used\n  * `legacy-only`: disable 802.11n and 802.11ac\n  * `high-density`: no 11b, no low rates\n  * `custom`: user defined"
      enum:
      - compatible
      - legacy-only
      - custom
      - no-legacy
      - high-density
      type:
      - string
      - 'null'
    wlan_portal_amazon_email_domains:
      default: []
      description: Optional if `amazon_enabled`==`true`. Matches authenticated user email against provided domains. If null or [], all authenticated emails will be allowed.
      items:
        type: string
      type: array
    wlan_vlan_ids_list:
      description: If `vlan_enabled`==`true` and `vlan_pooling`==`true`. List of VLAN IDs (comma separated) to be used in the VLAN Pool
      examples:
      - - 3
        - 4
        - 5
      items:
        $ref: '#/components/schemas/vlan_id_with_variable'
      type: array
    wlan_datarates_legacy_item:
      description: 'enum: `1`, `11`, `11b`, `12`, `12b`, `18`, `18b`, `1b`, `2`, `24`, `24b`, `2b`, `36`, `36b`, `48`, `48b`, `5.5`, `5.5b`, `54`, `54b`, `6`, `6b`, `9`, `9b`'
      enum:
      - '1'
      - '11'
      - 11b
      - '12'
      - 12b
      - '18'
      - 18b
      - 1b
      - '2'
      - '24'
      - 24b
      - 2b
      - '36'
      - 36b
      - '48'
      - 48b
      - '5.5'
      - 5.5b
      - '54'
      - 54b
      - '6'
      - 6b
      - '9'
      - 9b
      type: string
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    wlan_auth_owe:
      default: disabled
      description: 'if `type`==`open`. enum: `disabled`, `enabled` (means transition mode), `required`'
      enum:
      - disabled
      - enabled
      - required
      type: string
    wlan_acct_servers:
      description: List of RADIUS accounting servers, optional, order matters where the first one is treated as primary
      items:
        $ref: '#/components/schemas/radius_acct_server'
      type: array
    wlan_app_qos_others_item:
      additionalProperties: false
      properties:
        dscp:
          $ref: '#/components/schemas/dscp'
        dst_subnet:
          examples:
          - 10.2.0.0/16
          type: string
        port_ranges:
          examples:
          - 80,1024-6553
          type: string
        protocol:
          examples:
          - udp
          type: string
        src_subnet:
          examples:
          - 10.2.0.0/16
          type: string
      type: object
    dscp:
      anyOf:
      - type: string
      - maximum: 63
        minimum: 0
        type: integer
      description: DSCP value range between 0 and 63
    dot11_band:
      description: 'enum: `24`, `5`, `5-dedicated`, `5-selectable`, `6`, `6-dedicated`, `6-selectable`'
      enum:
      - '24'
      - '5'
      - 5-dedicated
      - 5-selectable
      - '6'
      - 6-dedicated
      - 6-selectable
      type: string
    wlan_cisco_cwa:
      additionalProperties: false
      description: 'Cisco CWA (central web authentication) required RADIUS with COA in order to work. See CWA: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html'
      properties:
        allowed_hostnames:
          $ref: '#/components/schemas/wlan_cisco_cwa_allowed_hostnames'
        allowed_subnets:
          $ref: '#/components/schemas/wlan_cisco_cwa_allowed_subnets'
        blocked_subnets:
          $ref: '#/components/schemas/wlan_cisco_cwa_blocked_subnets'
        enabled:
          default: false
          type: boolean
      type: object
    wlan_app_qos_apps_properties:
      additionalProperties: false
      properties:
        dscp:
          $ref: '#/components/schemas/dscp'
        dst_subnet:
          description: Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)
          type: string
        src_subnet:
          description: Subnet filter is not required but helps AP to only inspect certain traffic (thus reducing AP load)
          type: string
      type: object
    wlan_inject_dhcp_option_82:
      additionalProperties: false
      properties:
        circuit_id:
          description: "Information to set in the `circuit_id` field of the DHCP Option 82. It is possible to use static string or the following variables (e.g. `{{SSID}}:{{AP_MAC}}`):\n  * {{AP_MAC}}\n  * {{AP_MAC_DASHED}}\n  * {{AP_MODEL}}\n  * {{AP_NAME}}\n  * {{SITE_NAME}}\n  * {{SSID}}"
          examples:
          - '{{SSID}}:{{AP_MAC}}'
          type: string
        enabled:
          default: false
          description: Whether to inject option 82 when forwarding DHCP packets
          type: boolean
      type: object
    wlan_interface:
      default: all
      description: 'where this WLAN will be connected to. enum: `all`, `eth0`, `eth1`, `eth2`, `eth3`, `mxtunnel`, `site_mxedge`, `wxtunnel`'
      enum:
      - all
      - eth0
      - eth1
      - eth2
      - eth3
      - mxtunnel
      - site_mxedge
      - wxtunnel
      examples:
      - all
      type: string
    wlan_portal_sms_provider:
      default: manual
      description: 'Optional if `sms_enabled`==`true`. enum: `broadnet`, `clickatell`, `gupshup`, `manual`, `puzzel`, `smsglobal`, `telstra`, `twilio`'
      enum:
      - broadnet
      - clickatell
      - gupshup
      - manual
      - puzzel
      - telstra
      - twilio
      - smsglobal
      examples:
      - twilio
      type: string
    wlan_portal_allowed_hostnames:
      default: []
      description: List of hostnames without http(s):// (matched by substring)
      examples:
      - - snapchat.com
        - ibm.com
      items:
        type: string
      type: array
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    wlan_app_limit:
      additionalProperties: false
      description: Bandwidth limiting for apps (applies to up/down)
      properties:
        apps:
          additionalProperties:
            type: integer
          default: {}
          description: "Map from app key to bandwidth in kbps. \nProperty key is the app key, defined in Get Application List"
          examples:
          - dropbox: 300
            netflix: 60
          type: object
        enabled:
          default: false
          type: boolean
        wxtag_ids:
          additionalProperties:
            type: integer
          default: {}
          description: Map from wxtag_id of Hostname Wxlan Tags to bandwidth in kbps. Property key is the `wxtag_id`
          examples:
          - f99862d9-2726-931f-7559-3dfdf5d070d3: 30
          type: object
      type: object
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
    secpolicy_id:
      in: path
      name: secpolicy_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
  examples:
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    SecpolicyExample:
      value:
        name: corporate only
        wlans:
        - auth:
            pairwise:
            - wpa1-tkip
            - wpa2-tkip
            type: psk
          band: both
          ssid: office
        - auth:
            type: open
          band: '5'
          ssid: office-guest
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    SecpoliciesArrayExample:
      value:
      - name: corporate only
        wlans:
        - auth:
            pairwise:
            - wpa1-tkip
            - wpa2-tkip
            type: psk
          band: both
          ssid: office
        - auth:
            type: open
          band: '5'
          ssid: office-guest
  responses:
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    OK:
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
    SecpoliciesArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SecpoliciesArrayExample'
          schema:
            $ref: '#/components/schemas/secpolicy_list'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SecpoliciesArrayExample'
          schema:
            $ref: '#/components/schemas/secpolicy_list'
      description: OK
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    Secpolicy:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SecpolicyExample'
          schema:
            $ref: '#/components/schemas/secpolicy'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SecpolicyExample'
          schema:
            $ref: '#/components/schemas/secpolicy'
      description: OK
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey