openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs SSO API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: 'Org SSO, or Single Sign-On, is a method of authentication that allows users to securely log in to multiple applications and websites with a single set of login credentials.


    It involves integrating the Org portal with an Identity Provider (IdP) using the Security Assertion Markup Language (SAML) framework.


    This enables users to authenticate themselves through their corporate IdP, eliminating the need to remember separate passwords or enter credentials each time they access the Org portal.'
  name: Orgs SSO
paths:
  /api/v1/orgs/{org_id}/ssos:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get List of Org SSO Configuration
      operationId: listOrgSsos
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/SsosArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgSsos
      tags:
      - Orgs SSO
    post:
      description: Create Org SSO Configuration
      operationId: createOrgSso
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  custom_logout_url: string
                  idp_cert: string
                  idp_sign_algo: sha256
                  idp_sso_url: string
                  ignore_unmatched_roles: true
                  issuer: string
                  name: string
                  nameid_format: email
            schema:
              $ref: '#/components/schemas/sso'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/Sso'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgSso
      tags:
      - Orgs SSO
  /api/v1/orgs/{org_id}/ssos/{sso_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/sso_id'
    delete:
      description: Delete Org SSO Configuration
      operationId: deleteOrgSso
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgSso
      tags:
      - Orgs SSO
    get:
      description: Get Org SSO Configuration Details
      operationId: getOrgSso
      responses:
        '200':
          $ref: '#/components/responses/Sso'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSso
      tags:
      - Orgs SSO
    put:
      description: Update Org SSO Configuration
      operationId: updateOrgSso
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/sso'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/Sso'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgSso
      tags:
      - Orgs SSO
  /api/v1/orgs/{org_id}/ssos/{sso_id}/delete_admins:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/sso_id'
    post:
      description: Delete SSO Admin users by email. This removes SSO-linked admin accounts from the organization.
      operationId: deleteOrgSsoAdmins
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  emails:
                  - john@abc.com
                  - may@abc.com
            schema:
              $ref: '#/components/schemas/sso_delete_admins'
        description: Request Body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sso_delete_admins_response'
          description: OK
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgSsoAdmins
      tags:
      - Orgs SSO
  /api/v1/orgs/{org_id}/ssos/{sso_id}/failures:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/sso_id'
    get:
      description: Get List of Org SSO Latest Failures
      operationId: listOrgSsoLatestFailures
      parameters:
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/SsoLatestFailures'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgSsoLatestFailures
      tags:
      - Orgs SSO
  /api/v1/orgs/{org_id}/ssos/{sso_id}/metadata:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/sso_id'
    get:
      description: Get Org SAML Metadata
      operationId: getOrgSamlMetadata
      responses:
        '200':
          $ref: '#/components/responses/SamlMetadata'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSamlMetadata
      tags:
      - Orgs SSO
  /api/v1/orgs/{org_id}/ssos/{sso_id}/metadata.xml:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/sso_id'
    get:
      description: "Download Org SAML Metadata\n\nExample of metadata.xml:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" validUntil=\"2027-10-12T21:59:01Z\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n    <md:SPSSODescriptor AuthnRequestsSigned=\"false\" WantAssertionsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n        <md:SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/logout\" />\n        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n        <md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" index=\"0\" isDefault=\"true\"/>\n        <md:AttributeConsumingService index=\"0\">\n            <md:ServiceName xml:lang=\"en-US\">Mist</md:ServiceName>\n            <md:RequestedAttribute Name=\"Role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"true\"/>\n            <md:RequestedAttribute Name=\"FirstName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n            <md:RequestedAttribute Name=\"LastName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n        </md:AttributeConsumingService>\n    </md:SPSSODescriptor>\n</md:EntityDescriptor>\n```"
      operationId: downloadOrgSamlMetadata
      responses:
        '200':
          $ref: '#/components/responses/File'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: downloadOrgSamlMetadata
      tags:
      - Orgs SSO
components:
  schemas:
    sso_oauth_type:
      default: azure
      description: 'if `idp_type`==`oauth`. enum: `azure`, `azure-gov`, `okta`, `ping_identity`'
      enum:
      - azure
      - azure-gov
      - okta
      - ping_identity
      type: string
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    sso_mxedge_proxy_auth_server:
      additionalProperties: false
      properties:
        host:
          examples:
          - 1.2.3.4
          type: string
        port:
          default: 1812
          type: integer
        require_message_authenticator:
          default: false
          description: Whether to require Message-Authenticator in requests
          type: boolean
        retry:
          default: 2
          description: Authentication request retry
          type: integer
        secret:
          examples:
          - testing123
          format: password
          type: string
        timeout:
          default: 5
          description: Authentication request timeout, in seconds
          type: integer
      type: object
    response_sso_failure_search:
      additionalProperties: false
      properties:
        results:
          $ref: '#/components/schemas/response_sso_failure_search_results'
      required:
      - results
      type: object
    sso_mxedge_proxy_ssids:
      description: SSIDs that support eduroam
      examples:
      - - eduroam_test, eduroam_main
      items:
        default: eduroam
        type: string
      type: array
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    sso_ldap_type:
      default: azure
      description: 'if `idp_type`==`ldap`. enum: `azure`, `custom`, `google`, `okta`, `ping_identity`'
      enum:
      - azure
      - custom
      - google
      - okta
      type: string
    sso_openroaming:
      additionalProperties: false
      description: if `idp_type`==`openroaming`
      properties:
        ssids:
          $ref: '#/components/schemas/sso_openroaming_ssids'
        wba_cert:
          description: Optional WBA-issued certificate. If not provided, the default WBA-issued certificate for Juniper will be used.
          examples:
          - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
          type: string
      required:
      - ssids
      type: object
    oauth_provider_domain:
      default: okta.com
      description: 'If `oauth_type`==`okta`, specifies the region-specific OAuth provider domain. enum: `okta.com`, `oktapreview.com`, `okta-emea.com`, `okta-gov.com`, `okta.mil`, `mtls.okta.com`'
      enum:
      - okta.com
      - oktapreview.com
      - okta-emea.com
      - okta-gov.com
      - okta.mil
      - mtls.okta.com
      examples:
      - okta.com
      type: string
    sso_mxedge_proxy_acct_servers:
      items:
        $ref: '#/components/schemas/sso_mxedge_proxy_acct_server'
      type: array
    sso_idp_type:
      default: saml
      description: "SSO IDP Type:\n  * For Admin SSO, enum: `saml`\n  * For NAC SSO, enum: `ldap`, `mxedge_proxy`, `oauth`, `openroaming`"
      enum:
      - ldap
      - mxedge_proxy
      - oauth
      - saml
      - openroaming
      type: string
    saml_metadata:
      additionalProperties: false
      properties:
        acs_url:
          description: If `idp_type`==`saml`
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/login
          readOnly: true
          type: string
        entity_id:
          description: If `idp_type`==`saml`
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/login
          readOnly: true
          type: string
        logout_url:
          description: If `idp_type`==`saml`
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/logout
          readOnly: true
          type: string
        metadata:
          description: If `idp_type`==`saml`
          examples:
          - <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://api.mist.com/api/v1/saml/llDfa13f/login" validUntil="2027-10-12T21:59:01Z" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://api.mist.com/api/v1/saml/llDfa13f/login" index="0" isDefault="true"/></md:SPSSODescriptor></md:EntityDescriptor>
          readOnly: true
          type: string
        scim_base_url:
          description: If `idp_type`==`oauth` and `scim_enabled`==`true`
          examples:
          - https://scim.nac-staging.mistsys.com/S_41b2525a-e8b8-4809-8168-f1d8dcbe9735/azure/4d72b1dc-7503-4717-81ea-80d0125b886e
          type: string
      type: object
    oauth_ping_identity_region:
      default: us
      description: 'enum: `us` (United States, default), `ca` (Canada), `eu` (Europe), `asia` (Asia), `au` (Australia)'
      enum:
      - asia
      - au
      - ca
      - eu
      - us
      type: string
    response_sso_failure_search_results:
      items:
        $ref: '#/components/schemas/response_sso_failure_search_item'
      type: array
      uniqueItems: true
    site_id:
      examples:
      - 441a1214-6928-442a-8e92-e1d34b8ec6a6
      format: uuid
      readOnly: true
      type: string
    sso_idp_sign_algo:
      description: 'Required if `idp_type`==`saml`, Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`'
      enum:
      - sha1
      - sha256
      - sha384
      - sha512
      type: string
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    sso_delete_admins_response:
      additionalProperties: false
      properties:
        deleted:
          description: List of email addresses that were successfully deleted
          items:
            type: string
          type: array
        errors:
          description: List of error messages for emails that could not be deleted
          items:
            type: string
          type: array
      type: object
    timestamp:
      description: Epoch (seconds)
      format: double
      readOnly: true
      type: number
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    response_sso_failure_search_item:
      additionalProperties: false
      properties:
        detail:
          type: string
        saml_assertion_xml:
          type: string
        timestamp:
          $ref: '#/components/schemas/timestamp'
      required:
      - timestamp
      - detail
      - saml_assertion_xml
      type: object
    sso:
      description: SSO
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
        custom_logout_url:
          description: If `idp_type`==`saml`, a URL we will redirect the user after user logout from Mist (for some IdP which supports a custom logout URL that is different from SP-initiated SLO process)
          type: string
        default_role:
          description: If `idp_type`==`saml`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched
          type: string
        domain:
          description: "Random string generated during the SSO creation and used to generate the SAML URLs:\n  * ACS URL = `/api/v1/saml/{domain}/login` (e.g. `https://api.mist.com/api/v1/saml/s4t5vwv8/login`)\n  * Single Logout URL = `/api/v1/saml/{domain}/logout` (e.g. `https://api.mist.com/api/v1/saml/s4t5vwv8/logout`)"
          readOnly: true
          type: string
        group_filter:
          description: Required if `ldap_type`==`custom`, LDAP filter that will identify the type of group
          type: string
        id:
          $ref: '#/components/schemas/id'
        idp_cert:
          description: If `idp_type`==`saml`. IDP Cert (used to verify the signed response)
          type: string
        idp_sign_algo:
          $ref: '#/components/schemas/sso_idp_sign_algo'
        idp_sso_url:
          description: Required if `idp_type`==`saml`, IDP Single-Sign-On URL
          type: string
        idp_type:
          $ref: '#/components/schemas/sso_idp_type'
        ignore_unmatched_roles:
          description: If `idp_type`==`saml`, ignore any unmatched roles provided in assertion. By default, an assertion is treated as invalid for any unmatched role
          type: boolean
        issuer:
          description: If `idp_type`==`saml`. IDP issuer URL
          type: string
        ldap_base_dn:
          description: Required if `idp_type`==`ldap`, whole domain or a specific organization unit (container) in Search base to specify where users and groups are found in the LDAP tree
          examples:
          - DC=abc,DC=com
          type: string
        ldap_bind_dn:
          description: Required if `idp_type`==`ldap`, the account used to authenticate against the LDAP
          examples:
          - CN=nas,CN=users,DC=abc,DC=com
          type: string
        ldap_bind_password:
          description: Required if `idp_type`==`ldap`, the password used to authenticate against the LDAP
          examples:
          - secret
          type: string
        ldap_cacerts:
          $ref: '#/components/schemas/sso_ldap_ca_certs'
        ldap_client_cert:
          description: If `idp_type`==`ldap`, LDAPS Client certificate
          examples:
          - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
          type: string
        ldap_client_key:
          description: If `idp_type`==`ldap`, Key for the `ldap_client_cert`
          examples:
          - '-----BEGIN PRI...'
          type: string
        ldap_group_attr:
          default: memberOf
          description: If `ldap_type`==`custom`
          type: string
        ldap_group_dn:
          default: base_dn
          description: If `ldap_type`==`custom`
          type: string
        ldap_resolve_groups:
          default: false
          description: If `idp_type`==`ldap`, whether to recursively resolve LDAP groups
          type: boolean
        ldap_server_hosts:
          $ref: '#/components/schemas/sso_ldap_server_hosts'
        ldap_type:
          $ref: '#/components/schemas/sso_ldap_type'
        ldap_user_filter:
          description: Required if `ldap_type`==`custom`, LDAP filter that will identify the type of user
          examples:
          - (mail=%s)
          type: string
        member_filter:
          description: Required if `ldap_type`==`custom`,LDAP filter that will identify the type of member
          examples:
          - (CN=%s)
          type: string
        modified_time:
          $ref: '#/components/schemas/modified_time'
        msp_id:
          $ref: '#/components/schemas/msp_id'
        mxedge_proxy:
          $ref: '#/components/schemas/sso_mxedge_proxy'
        name:
          description: Name
          type: string
        nameid_format:
          $ref: '#/components/schemas/sso_nameid_format'
        oauth_cc_client_id:
          description: Required if `idp_type`==`oauth`, Client Credentials
          examples:
          - e60da615-7def-4c5a-8196-43675f45e174
          type: string
        oauth_cc_client_secret:
          description: Required if `idp_type`==`oauth`, oauth_cc_client_secret is RSA private key, of the form "-----BEGIN RSA PRIVATE KEY--...."
          examples:
          - REDACTED_EXAMPLE_OAUTH_CLIENT_SECRET
          format: password
          type: string
        oauth_discovery_url:
          description: If `idp_type`==`oauth`
          type: string
        oauth_ping_identity_region:
          $ref: '#/components/schemas/oauth_ping_identity_region'
        oauth_provider_domain:
          $ref: '#/components/schemas/oauth_provider_domain'
        oauth_ropc_client_id:
          description: If `idp_type`==`oauth`, ropc = Resource Owner Password Credentials
          examples:
          - 9ce04c97-b5b1-4ec8-af17-f5ed42d2daf7
          type: string
        oauth_ropc_client_secret:
          description: If `oauth_type`==`azure` or `oauth_type`==`azure-gov`. oauth_ropc_client_secret can be empty
          examples:
          - blM9R~6kWFMVFYl4TFZ3fi~8cMdyDONi6cj01dqI
          format: password
          type: string
        oauth_tenant_id:
          description: Required if `idp_type`==`oauth`, oauth_tenant_id
          examples:
          - dev-88336535
          type: string
        oauth_type:
          $ref: '#/components/schemas/sso_oauth_type'
        openroaming:
          $ref: '#/components/schemas/sso_openroaming'
        org_id:
          $ref: '#/components/schemas/org_id'
        role_attr_extraction:
          description: If `idp_type`==`saml`, custom role attribute parsing scheme. Supported Role Parsing Schemes <table><tr><th>Name</th><th>Scheme</th></tr><tr><td>`cn`</td><td><ul><li>The expected role attribute format in SAML Assertion is "CN=cn,OU=ou1,OU=ou2,…"</li><li>CN (the key) is case-insensitive and exactly 1 CN is expected (or the entire entry will be ignored)</li></ul>E.g. if role attribute is "CN=cn,OU=ou1,OU=ou2" then parsed role value is "cn"</td></tr></table>
          type: string
        role_attr_from:
          default: Role
          description: If `idp_type`==`saml`, name of the attribute in SAML Assertion to extract role from
          type: string
        scim_enabled:
          default: false
          description: If `idp_type`==`oauth`, indicates if SCIM provisioning is enabled for the OAuth IDP
          type: boolean
        scim_secret_token:
          default: ''
          description: If `idp_type`==`oauth`, scim_secret_token (auto-generated when not provided by caller and `scim_enabled`==`true`, empty string when `scim_enabled`==`false`) is used as the Bearer token in the Authorization header of SCIM provisioning requests by the IDP
          examples:
          - FBitbKPE1aecSloPGBuqqPxDUrFeZyZk
          format: password
          type: string
        site_id:
          $ref: '#/components/schemas/site_id'
      required:
      - name
      type: object
    sso_openroaming_ssids:
      description: SSIDs that support OpenRoaming
      examples:
      - - ssid_name1
        - ssid_name2
      items:
        type: string
      type: array
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    ssos:
      items:
        $ref: '#/components/schemas/sso'
      type: array
    sso_mxedge_proxy_proxy_hosts:
      description: Public hostname/IPs
      examples:
      - - mxedge1.corp.com
        - 63.1.3.5
      items:
        type: string
      type: array
    sso_mxedge_proxy_acct_server:
      additionalProperties: false
      properties:
        host:
          examples:
          - 1.2.3.4
          type: string
        port:
          default: 1813
          type: integer
        secret:
          examples:
          - testing123
          format: password
          type: string
      type: object
    sso_nameid_format:
      default: email
      description: 'if `idp_type`==`saml`. enum: `email`, `unspecified`'
      enum:
      - email
      - unspecified
      type: string
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    sso_mxedge_proxy:
      additionalProperties: false
      description: If `idp_type`==`mxedge_proxy`, this requires `mist_nac` to be enabled on the mxcluster
      properties:
        acct_servers:
          $ref: '#/components/schemas/sso_mxedge_proxy_acct_servers'
        auth_servers:
          $ref: '#/components/schemas/sso_mxedge_proxy_auth_servers'
        mxcluster_id:
          examples:
          - 572586b7-f97b-a22b-526c-8b97a3f609c4
          format: uuid
          type: string
        operator_name:
          description: Operator name as Radius attribute while proxying
          type: string
        proxy_hosts:
          $ref: '#/components/schemas/sso_mxedge_proxy_proxy_hosts'
        ssids:
          $ref: '#/components/schemas/sso_mxedge_proxy_ssids'
      type: object
    msp_id:
      examples:
      - b9d42c2e-88ee-41f8-b798-f009ce7fe909
      format: uuid
      readOnly: true
      type: string
    sso_delete_admins:
      additionalProperties: false
      properties:
        emails:
          description: List of admin email addresses to delete
          items:
            type: string
          type: array
      required:
      - emails
      type: object
    sso_ldap_ca_certs:
      description: Required if `idp_type`==`ldap`, list of CA certificates to validate the LDAP certificate
      examples:
      - - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
        - '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----'
      items:
        type: string
      type: array
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    sso_mxedge_proxy_auth_servers:
      items:
        $ref: '#/components/schemas/sso_mxedge_proxy_auth_server'
      type: array
    sso_ldap_server_hosts:
      description: If `idp_type`==`ldap`, list of LDAP/LDAPS server IP Addresses or Hostnames
      examples:
      - - hostname
        - 63.1.3.5
      items:
        type: string
      type: array
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    start:
      description: Start time (epoch timestamp in seconds, or relative string like "-1d", "-1w")
      in: query
      name: start
      schema:
        type: string
    duration:
      description: Duration like 7d, 2w
      in: query
      name: duration
      schema:
        default: 1d
        examples:
        - 10m
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    end:
      description: End time (epoch timestamp in seconds, or relative string like "-1d", "-2h", "now")
      in: query
      name: end
      schema:
        type: string
    sso_id:
      in: path
      name: sso_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  responses:
    Sso:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SsoExample'
          schema:
            $ref: '#/components/schemas/sso'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SsoExample'
          schema:
            $ref: '#/components/schemas/sso'
      description: OK
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    File:
      content:
        application/json:
          schema:
            contentMediaType: application/octet-stream
            description: File
            type: string
        application/vnd.api+json:
          schema:
            contentMediaType: application/octet-stream
            description: File
            type: string
      description: OK
    SamlMetadata:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SamlMetadataExample'
          schema:
            $ref: '#/components/schemas/saml_metadata'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SamlMetadataExample'
          schema:
            $ref: '#/components/schemas/saml_metadata'
      description: OK
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    SsosArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SsosArrayExample'
          schema:
            $ref: '#/components/schemas/ssos'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SsosArrayExample'
          schema:
            $ref: '#/components/schemas/ssos'
      description: OK
    OK:
      description: OK
    SsoLatestFailures:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SsoLatestFailuresExample'
          schema:
            $ref: '#/components/schemas/response_sso_failure_search'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SsoLatestFailuresExample'
          schema:
            $ref: '#/components/schemas/response_sso_failure_search'
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    SsoLatestFailuresExample:
      value:
        results:
        - detail: string
          saml_assertion_xml: string
          timestamp: 0
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    SsoExample:
      value:
        created_time: 0
        custom_logout_url: string
        default_role: string
        domain: string
        id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        idp_cert: string
        idp_sign_algo: sha256
        idp_sso_url: string
        ignore_unmatched_roles: true
        issuer: string
        modified_time: 0
        msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        name: string
        nameid_format: email
        org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        type: string
    SamlMetadataExample:
      value:
        acs_url: https://api.mist.com/api/v1/saml/llDfa13f/login
        entity_id: https://api.mist.com/api/v1/saml/llDfa13f/login
        logout_url: https://api.mist.com/api/v1/saml/llDfa13f/logout
        metadata: <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://api.mist.com/api/v1/saml/llDfa13f/login" validUntil="2027-10-12T21:59:01Z" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://api.mist.com/api/v1/saml/llDfa13f/login" index="0" isDefault="true"/></md:SPSSODescriptor></md:EntityDescriptor>
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    SsosArrayExample:
      value:
      - created_time: 0
        custom_logout_url: string
        default_role: string
        domain: string
        id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        idp_cert: string
        idp_sign_algo: sha256
        idp_sso_url: string
        ignore_unmatched_roles: true
        issuer: string
        modified_time: 0
        msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        name: string
        nameid_format: email
        org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        type: string
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey