openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs WxTunnels API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: 'A WxLan Tunnel (WxTunnel) are used to create a secure connection between Juniper Mist Access Points and third-party VPN concentrators using protocols such as L2TPv3 or dmvpn.


    These tunnels allow for the aggregation of ethernet interfaces on access points, support dynamic or static tunnels, and provide options for IPSec encryption.'
  name: Orgs WxTunnels
paths:
  /api/v1/orgs/{org_id}/wxtunnels:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get List of Org WxLAN Tunnels
      operationId: listOrgWxTunnels
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/WxtunnelArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgWxTunnels
      tags:
      - Orgs WxTunnels
    post:
      description: Create Org WxAN Tunnel
      operationId: createOrgWxTunnel
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/wxlan_tunnel'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/Wxtunnel'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgWxTunnel
      tags:
      - Orgs WxTunnels
  /api/v1/orgs/{org_id}/wxtunnels/{wxtunnel_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/wxtunnel_id'
    delete:
      description: Delete Org WxLAN Tunnel
      operationId: deleteOrgWxTunnel
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgWxTunnel
      tags:
      - Orgs WxTunnels
    get:
      description: Get Org WxLAN Tunnel Details
      operationId: getOrgWxTunnel
      responses:
        '200':
          $ref: '#/components/responses/Wxtunnel'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgWxTunnel
      tags:
      - Orgs WxTunnels
    put:
      description: Update Org WxLAN Tunnel
      operationId: updateOrgWxTunnel
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/wxlan_tunnel'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/Wxtunnel'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgWxTunnel
      tags:
      - Orgs WxTunnels
components:
  parameters:
    wxtunnel_id:
      in: path
      name: wxtunnel_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    wxlan_tunnel_ipsec:
      additionalProperties: false
      description: IPSec-related configurations; requires DMVPN be enabled
      properties:
        enabled:
          default: false
          description: Whether ipsec is enabled, requires DMVPN be enabled
          type: boolean
        psk:
          description: IPSec pre-shared key
          type: string
      required:
      - psk
      type: object
    wxlan_tunnel_dmvpn_host_routes:
      description: Optional; list of IPv4 DMVPN peer host ip-addresses to which traffic is forwarded
      items:
        type: string
      type: array
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    site_id:
      examples:
      - 441a1214-6928-442a-8e92-e1d34b8ec6a6
      format: uuid
      readOnly: true
      type: string
    wxlan_tunnel:
      description: WxLAn Tunnel
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
        dmvpn:
          $ref: '#/components/schemas/wxlan_tunnel_dmvpn'
        for_mgmt:
          default: false
          description: Determined during creation time and cannot be toggled. A management tunnel cannot be used by wxlan rule or by wlan
          type: boolean
        for_site:
          readOnly: true
          type: boolean
        hello_interval:
          default: 60
          description: In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by hello_retries.
          maximum: 300
          minimum: 1
          type: integer
        hello_retries:
          default: 7
          maximum: 30
          minimum: 2
          type: integer
        hostname:
          description: "Optional, overwrite the hostname in SCCRQ control message, default is or null, %H and %M can be used, which will be replace with corresponding values:\n  * %H: name of the ap if provided (and will be stripped so it can be used for hostname) and fallbacks to MAC\n  * %M: MAC (e.g. 5c5b350e0060)"
          type: string
        id:
          $ref: '#/components/schemas/id'
        ipsec:
          $ref: '#/components/schemas/wxlan_tunnel_ipsec'
        is_static:
          default: false
          description: Whether it’s static/unmanaged (i.e. no control session). As the session configurations are not compatible, cannot be toggled.
          type: boolean
        modified_time:
          $ref: '#/components/schemas/modified_time'
        mtu:
          default: 0
          description: 0 to enable PMTU, 552-1500 to start PMTU with a lower MTU
          maximum: 1500
          minimum: 0
          type: integer
        name:
          description: The name of the tunnel
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
        peers:
          $ref: '#/components/schemas/wxlan_tunnel_peers'
        router_id:
          description: Optional, overwrite the router-id in SCCRQ control message, default is "" or null, can also be an IPv4 address
          type: string
        secret:
          description: Secret, ‘’ if no auth is used
          type: string
        sessions:
          $ref: '#/components/schemas/wxlan_tunnel_sessions'
        site_id:
          $ref: '#/components/schemas/site_id'
        udp_port:
          description: UDP port if `use_udp`==`true`
          type: integer
        use_udp:
          default: false
          description: Whether to use UDP instead of IP (proto=115, which is default of L2TPv3)
          type: boolean
      required:
      - name
      type: object
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    wxlan_tunnel_dmvpn:
      additionalProperties: false
      description: Dynamic Multipoint VPN configurations
      properties:
        enabled:
          default: false
          description: Whether DMVPN is enabled
          type: boolean
        holding_time:
          description: Optional; the holding time for NHRP ‘registration requests’  and ‘resolution replies’ sent from the Mist AP (in seconds); default 600
          type: integer
        host_routes:
          $ref: '#/components/schemas/wxlan_tunnel_dmvpn_host_routes'
      type: object
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    wxlan_tunnel_sessions:
      description: Sessions to be established with the tunnel. Has to be >= 1 in order for this tunnel to be useful. For management tunnel, it can only have 1
      items:
        $ref: '#/components/schemas/wxlan_tunnel_session'
      type: array
      uniqueItems: true
    wxlan_tunnel_session:
      additionalProperties: false
      properties:
        ap_as_session_id:
          description: If `use_ap_as_session_ids`==`true`, only apmac is supported right now. This is the name WLAN should use for wxtunnel_remote_id
          type: string
        comment:
          description: Optional, user-specified string for display purpose
          type: string
        enable_cookie:
          type: boolean
        ethertype:
          $ref: '#/components/schemas/wxlan_tunnel_session_ethertype'
        local_session_id:
          description: 1-2147483647
          maximum: 2147483647
          minimum: 1
          type: integer
        pseudo_802.1ad_enabled:
          default: false
          description: Optional. Enables the pseudo 802.1ad QinQ mode where the AP device drops the outer vlan tag (QinQ). This mode is useful when tunneling Mist AP’s to some aggregation routers.
          type: boolean
        remote_id:
          description: Remote-id of the session, has to be unique in the same tunnel
          type: string
        remote_session_id:
          description: 1-2147483647
          maximum: 2147483647
          minimum: 1
          type: integer
        use_ap_as_session_ids:
          default: false
          description: Whether to use AP (last 4 bytes of MAC currently) as session ids
          type: boolean
      type: object
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    wxlan_tunnels:
      items:
        $ref: '#/components/schemas/wxlan_tunnel'
      type: array
    wxlan_tunnel_peers:
      description: List of remote peers’ IP or hostname
      items:
        type: string
      type: array
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    wxlan_tunnel_session_ethertype:
      description: 'enum: `ethernet`, `vlan`'
      enum:
      - ethernet
      - vlan
      type: string
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
  examples:
    WxtunnelArrayExample:
      value:
      - created_time: 0
        dmvpn:
          enabled: true
          holding_time: 0
          host_routes:
          - string
        for_mgmt: true
        hello_interval: 1
        hello_retries: 3
        hostname: string
        id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        ipsec:
          enabled: true
          psk: string123
        is_static: true
        modified_time: 0
        mtu: 1500
        name: string
        org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        peers:
        - string
        router_id: string
        secret: string
        sessions:
        - ap_as_session_id: string
          comment: string
          enable_cookie: true
          ethertype: ethernet
          local_session_id: 1
          pseudo_802.1ad_enabled: true
          remote_id: string
          remote_session_id: 1
          use_ap_as_session_ids: true
        site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        udp_port: 0
        use_udp: true
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    WxtunnelExample:
      value:
        created_time: 0
        dmvpn:
          enabled: true
          holding_time: 0
          host_routes:
          - string
        for_mgmt: true
        hello_interval: 1
        hello_retries: 3
        hostname: string
        id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        ipsec:
          enabled: true
          psk: string123
        is_static: true
        modified_time: 0
        mtu: 1500
        name: string
        org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        peers:
        - string
        router_id: string
        secret: string
        sessions:
        - ap_as_session_id: string
          comment: string
          enable_cookie: true
          ethertype: ethernet
          local_session_id: 1
          pseudo_802.1ad_enabled: true
          remote_id: string
          remote_session_id: 1
          use_ap_as_session_ids: true
        site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
        udp_port: 0
        use_udp: true
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  responses:
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    WxtunnelArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/WxtunnelArrayExample'
          schema:
            $ref: '#/components/schemas/wxlan_tunnels'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/WxtunnelArrayExample'
          schema:
            $ref: '#/components/schemas/wxlan_tunnels'
      description: OK
    Wxtunnel:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/WxtunnelExample'
          schema:
            $ref: '#/components/schemas/wxlan_tunnel'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/WxtunnelExample'
          schema:
            $ref: '#/components/schemas/wxlan_tunnel'
      description: OK
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    OK:
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey