openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs VPNs API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: "VPNs endpoints are used to create the WAN Assurance Overlay configuration between a Hub and one\nor multiple WAN Edge Gateways.\n\n\nWhen configuring the Hub and Spokes from the Mist UI, the UI is automatically creating or updating\nthe VPNs objects based on the configuration. \nWhen the configuration is directly done with the APIs, the VPN object must be manually managed."
  name: Orgs VPNs
paths:
  /api/v1/orgs/{org_id}/vpns:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get List of Org VPNs
      operationId: listOrgVpns
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/VpnsArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgVpns
      tags:
      - Orgs VPNs
    post:
      description: Create Org VPN
      operationId: createOrgVpn
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  name: string
                  paths:
                    property1:
                      bfd_profile: broadband
                      ip: string
                    property2:
                      bfd_profile: lte
                      ip: string
            schema:
              $ref: '#/components/schemas/vpn'
      responses:
        '200':
          $ref: '#/components/responses/Vpn'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgVpn
      tags:
      - Orgs VPNs
  /api/v1/orgs/{org_id}/vpns/{vpn_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/vpn_id'
    delete:
      description: Delete Org Vpn
      operationId: deleteOrgVpn
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgVpn
      tags:
      - Orgs VPNs
    get:
      description: Get Org Vpn
      operationId: getOrgVpn
      responses:
        '200':
          $ref: '#/components/responses/Vpn'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgVpn
      tags:
      - Orgs VPNs
    put:
      description: Update Org Vpn
      operationId: updateOrgVpn
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  name: string
                  paths:
                    property1:
                      bfd_profile: broadband
                      ip: string
                    property2:
                      bfd_profile: broadband
                      ip: string
            schema:
              $ref: '#/components/schemas/vpn'
      responses:
        '200':
          $ref: '#/components/responses/Vpn'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgVpn
      tags:
      - Orgs VPNs
components:
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    vpns:
      items:
        $ref: '#/components/schemas/vpn'
      type: array
    vpn_mode:
      default: hub_spoke
      description: 'enum: `hub_spoke`, `mesh`'
      enum:
      - hub_spoke
      - mesh
      type: string
    vpn_paths:
      additionalProperties:
        $ref: '#/components/schemas/vpn_path'
      description: For `type`==`hub_spoke`, Property key is the VPN name. For `type`==`mesh`, Property key is the Interface name
      type: object
    vpn_path_peer_paths:
      additionalProperties:
        $ref: '#/components/schemas/vpn_path_peer_paths_peer'
      description: If `type`==`mesh`, Property key is the Peer Interface name
      type: object
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    vpn_path_peer_paths_peer:
      additionalProperties: false
      description: Preference indicates which outgoing wan should be preferred
      properties:
        preference:
          type: integer
      type: object
    vpn:
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
        id:
          $ref: '#/components/schemas/id'
        modified_time:
          $ref: '#/components/schemas/modified_time'
        name:
          minLength: 1
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
        path_selection:
          $ref: '#/components/schemas/vpn_path_selection'
        paths:
          $ref: '#/components/schemas/vpn_paths'
        type:
          $ref: '#/components/schemas/vpn_mode'
      required:
      - name
      - paths
      type: object
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    vpn_path_selection_strategy:
      default: disabled
      description: 'enum: `disabled`, `simple`, `manual`'
      enum:
      - disabled
      - simple
      - manual
      type: string
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    vpn_path_traffic_shaping:
      additionalProperties: false
      properties:
        class_percentage:
          $ref: '#/components/schemas/vpn_path_traffic_shaping_class_percentage'
        enabled:
          type: boolean
        max_tx_kbps:
          type:
          - integer
          - 'null'
      type: object
    vpn_path_bfd_profile:
      default: broadband
      description: 'enum: `broadband`, `lte`'
      enum:
      - broadband
      - lte
      type: string
    vpn_path:
      additionalProperties: false
      properties:
        bfd_profile:
          $ref: '#/components/schemas/vpn_path_bfd_profile'
        bfd_use_tunnel_mode:
          default: false
          description: If `type`==`mesh` and for SSR only, whether to use tunnel mode
          type: boolean
        ip:
          description: If different from the wan port
          type: string
        peer_paths:
          $ref: '#/components/schemas/vpn_path_peer_paths'
        pod:
          default: 1
          examples:
          - 2
          maximum: 128
          minimum: 1
          type: integer
        traffic_shaping:
          $ref: '#/components/schemas/vpn_path_traffic_shaping'
      type: object
    vpn_path_selection:
      additionalProperties: false
      description: Only if `type`==`hub_spoke`
      properties:
        strategy:
          $ref: '#/components/schemas/vpn_path_selection_strategy'
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    vpn_path_traffic_shaping_class_percentage:
      default:
      - 80
      - 10
      - 9
      - 1
      description: 'percentages for different class of traffic: high / medium / low / best-effort adding up to 100'
      items:
        type: integer
      maxItems: 4
      minItems: 4
      type: array
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    vpn_id:
      in: path
      name: vpn_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  responses:
    VpnsArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/VpnsArrayExample'
          schema:
            $ref: '#/components/schemas/vpns'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/VpnsArrayExample'
          schema:
            $ref: '#/components/schemas/vpns'
      description: Example response
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    Vpn:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/VpnExample'
          schema:
            $ref: '#/components/schemas/vpn'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/VpnExample'
          schema:
            $ref: '#/components/schemas/vpn'
      description: Example response
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    OK:
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    VpnExample:
      value:
        created_time: 0
        id: 497f6eca-6276-5009-bfeb-53cbbbba6f1b
        modified_time: 0
        name: string
        org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
        paths:
          property1:
            bfd_profile: broadband
            ip: string
          property2:
            bfd_profile: broadband
            ip: string
    VpnsArrayExample:
      value:
      - name: string
        paths:
          property1:
            bfd_profile: broadband
            ip: string
          property2:
            bfd_profile: lte
            ip: string
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey