openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs SSO Roles API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: 'SSO roles refer to the different functions assigned to users within a Single Sign-On (SSO) system.


    These roles determine the tasks and actions that users can perform within the SSO system. There are typically predefined roles and custom roles in an SSO system.


    Roles in SSO provide a well-defined separation of responsibility and visibility, allowing for granular-level access control on SSO objects.'
  name: Orgs SSO Roles
paths:
  /api/v1/orgs/{org_id}/ssoroles:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get List of Org SSO Roles
      operationId: listOrgSsoRoles
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/SsoRolesOrgArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgSsoRoles
      tags:
      - Orgs SSO Roles
    post:
      description: Create Org SSO Role
      operationId: createOrgSsoRole
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  name: string
                  privileges:
                  - org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                    role: admin
                    scope: org
                  - role: read
                    scope: site
                    site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                  - org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                    role: read
                    scope: sitegroup
                    sitegroup_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
            schema:
              $ref: '#/components/schemas/sso_role_org'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/SsoRoleOrg'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgSsoRole
      tags:
      - Orgs SSO Roles
  /api/v1/orgs/{org_id}/ssoroles/{ssorole_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/ssorole_id'
    delete:
      description: Delete Org SSO Role
      operationId: deleteOrgSsoRole
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgSsoRole
      tags:
      - Orgs SSO Roles
    get:
      description: Get Org SSO Role Details
      operationId: getOrgSsoRole
      responses:
        '200':
          $ref: '#/components/responses/SsoRoleOrg'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSsoRole
      tags:
      - Orgs SSO Roles
    put:
      description: Update Org SSO Role
      operationId: updateOrgSsoRole
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  name: string
                  privileges:
                  - org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                    role: admin
                    scope: org
                  - role: read
                    scope: site
                    site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                  - org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                    role: read
                    scope: sitegroup
                    sitegroup_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
            schema:
              $ref: '#/components/schemas/sso_role_org'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/SsoRoleOrg'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgSsoRole
      tags:
      - Orgs SSO Roles
components:
  examples:
    SsoRoleOrgExample:
      value:
        created_time: 0
        id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        modified_time: 0
        msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        name: string
        org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        privileges:
        - role: admin
          scope: sitegroup
          sitegroup_id: 6f4bf402-45f9-2a56-6c8b-7f83d3bc98e9
        site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    sso_role_org:
      description: SSO Role response
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
        for_site:
          readOnly: true
          type: boolean
        id:
          $ref: '#/components/schemas/id'
        modified_time:
          $ref: '#/components/schemas/modified_time'
        msp_id:
          $ref: '#/components/schemas/msp_id'
        name:
          type: string
        org_id:
          examples:
          - 60f6bfdb-2f45-4022-8e2a-e00d977953fe
          format: uuid
          type: string
        privileges:
          $ref: '#/components/schemas/sso_role_org_privileges'
      required:
      - name
      - privileges
      type: object
    admin_privilege_views:
      description: "Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users.  \nYou can define custom roles by adding the `views` attribute along with `role` when assigning privileges.  \nBelow are the list of supported UI views. Note that this is UI only feature.  \n\n  | UI View | Required Role | Description |\n  | --- | --- | --- |\n  | `reporting` | `read` | full access to all analytics tools |\n  | `marketing` | `read` | can view analytics and location maps |\n  | `super_observer` | `read` | can view all the organization except the subscription page |\n  | `location` | `write` | can view and manage location maps, can view analytics |\n  | `security` | `write` | can view and manage site labels, policies and security |\n  | `switch_admin` | `helpdesk` | can view and manage Switch ports, can view wired clients |\n  | `mxedge_admin` | `admin` | can view and manage Mist edges and Mist tunnels |\n  | `lobby_admin` | `admin` | full access to Org and Site Pre-shared keys |"
      items:
        $ref: '#/components/schemas/admin_privilege_view'
      type: array
    privilege_org_role:
      description: 'access permissions. enum: `admin`, `helpdesk`, `installer`, `read`, `write`'
      enum:
      - admin
      - helpdesk
      - installer
      - read
      - write
      type: string
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    sso_roles_org:
      items:
        $ref: '#/components/schemas/sso_role_org'
      type: array
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    privilege_org_scope:
      description: 'enum: `org`, `site`, `sitegroup`, `orgsites`'
      enum:
      - org
      - site
      - sitegroup
      - orgsites
      type: string
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    msp_id:
      examples:
      - b9d42c2e-88ee-41f8-b798-f009ce7fe909
      format: uuid
      readOnly: true
      type: string
    admin_privilege_view:
      enum:
      - lobby_admin
      - location
      - marketing
      - mxedge_admin
      - reporting
      - security
      - super_observer
      - switch_admin
      type: string
    sso_role_org_privileges:
      items:
        $ref: '#/components/schemas/privilege_org'
      minItems: 1
      type: array
      uniqueItems: true
    privilege_org:
      additionalProperties: false
      description: Privileges settings
      properties:
        org_id:
          description: If `scope`==`org`
          format: uuid
          readOnly: true
          type: string
        role:
          $ref: '#/components/schemas/privilege_org_role'
        scope:
          $ref: '#/components/schemas/privilege_org_scope'
        site_id:
          description: If `scope`==`site`
          format: uuid
          type: string
        sitegroup_id:
          description: If `scope`==`sitegroup`
          format: uuid
          type: string
        view:
          deprecated: true
          description: Used for backward compatibility. Use `views` instead.
          type: string
        views:
          $ref: '#/components/schemas/admin_privilege_views'
      required:
      - role
      - scope
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    ssorole_id:
      in: path
      name: ssorole_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  responses:
    SsoRolesOrgArray:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/sso_roles_org'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/sso_roles_org'
      description: Example response
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    OK:
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
    SsoRoleOrg:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SsoRoleOrgExample'
          schema:
            $ref: '#/components/schemas/sso_role_org'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SsoRoleOrgExample'
          schema:
            $ref: '#/components/schemas/sso_role_org'
      description: OK
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey