openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Sites AP Templates API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: 'AP Templates are defining Wi-Fi and AP settings that can be assigned to Access Points based on different types of rules.


    Site AP Templates are created and managed at the site level and can only be referenced and used within that particular site.'
  name: Sites AP Templates
paths:
  /api/v1/sites/{site_id}/aptemplates/derived:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Get the list of derived AP Templates for a site
      operationId: listSiteApTemplatesDerived
      parameters:
      - description: Whether resolve the site variables
        in: query
        name: resolve
        schema:
          type: boolean
      responses:
        '200':
          $ref: '#/components/responses/AptemplatesArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listSiteApTemplatesDerived
      tags:
      - Sites AP Templates
components:
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    radsec_mxcluster_ids:
      description: To use Org mxedges when this WLAN does not use mxtunnel, specify their mxcluster_ids. Org mxedge(s) identified by mxcluster_ids
      items:
        examples:
        - 572586b7-f97b-a22b-526c-8b97a3f609c4
        format: uuid
        type: string
      type: array
    ap_template:
      properties:
        ap_matching:
          $ref: '#/components/schemas/ap_template_matching'
        created_time:
          $ref: '#/components/schemas/created_time'
        for_site:
          readOnly: true
          type: boolean
        id:
          $ref: '#/components/schemas/id'
        modified_time:
          $ref: '#/components/schemas/modified_time'
        org_id:
          $ref: '#/components/schemas/org_id'
        site_id:
          $ref: '#/components/schemas/site_id'
        wifi:
          $ref: '#/components/schemas/ap_template_wifi'
      required:
      - ap_matching
      type: object
    radsec_proxy_hosts:
      description: Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site mxedges) are used irrespective of `use_site_mxedge`
      items:
        examples:
        - mxedge1.local
        type: string
      type: array
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    radsec:
      additionalProperties: false
      description: RadSec settings
      properties:
        coa_enabled:
          default: false
          type: boolean
        enabled:
          type: boolean
        idle_timeout:
          $ref: '#/components/schemas/radsec_idle_timeout'
        mxcluster_ids:
          $ref: '#/components/schemas/radsec_mxcluster_ids'
        proxy_hosts:
          $ref: '#/components/schemas/radsec_proxy_hosts'
        server_name:
          description: Name of the server to verify (against the cacerts in Org Setting). Only if not Mist Edge.
          examples:
          - radsec.abc.com
          type: string
        servers:
          $ref: '#/components/schemas/radsec_servers'
        use_mxedge:
          description: use mxedge(s) as RadSec Proxy
          type: boolean
        use_site_mxedge:
          default: false
          description: To use Site mxedges when this WLAN does not use mxtunnel
          type: boolean
      type: object
    ap_template_matching_rule:
      additionalProperties: false
      properties:
        match_model:
          minLength: 1
          type: string
        name:
          minLength: 1
          type: string
        port_config:
          additionalProperties:
            $ref: '#/components/schemas/ap_port_config'
          description: Property key is the interface(s) name (e.g. "eth1,eth2")
          type: object
      type: object
    radsec_idle_timeout:
      anyOf:
      - default: 60
        type: integer
      - type: string
      description: Radsec Idle Timeout in seconds. Default is 60
    radius_acct_port:
      anyOf:
      - maximum: 65545
        minimum: 1
        type: integer
      - type: string
      description: Radius Auth Port, value from 1 to 65535, default is 1813
    radsec_server:
      additionalProperties: false
      properties:
        host:
          examples:
          - 1.1.1.1
          type: string
        port:
          examples:
          - 1812
          maximum: 65535
          minimum: 1
          type: integer
      type: object
    radius_auth_server:
      additionalProperties: false
      description: Authentication Server
      properties:
        host:
          description: IP/ hostname of RADIUS server
          examples:
          - 1.2.3.4
          type: string
        keywrap_enabled:
          type: boolean
        keywrap_format:
          $ref: '#/components/schemas/radius_keywrap_format'
        keywrap_kek:
          examples:
          - '1122334455'
          type: string
        keywrap_mack:
          examples:
          - '1122334455'
          type: string
        port:
          $ref: '#/components/schemas/radius_auth_port'
        require_message_authenticator:
          default: false
          description: Whether to require Message-Authenticator in requests
          type: boolean
        secret:
          description: Secret of RADIUS server
          examples:
          - testing123
          format: password
          type: string
      required:
      - host
      - secret
      type: object
    ap_templates:
      items:
        $ref: '#/components/schemas/ap_template'
      type: array
    radius_acct_server:
      additionalProperties: false
      properties:
        host:
          description: IP/ hostname of RADIUS server
          examples:
          - 1.2.3.4
          type: string
        keywrap_enabled:
          type: boolean
        keywrap_format:
          $ref: '#/components/schemas/radius_keywrap_format'
        keywrap_kek:
          examples:
          - '1122334455'
          type: string
        keywrap_mack:
          examples:
          - '1122334455'
          type: string
        port:
          $ref: '#/components/schemas/radius_acct_port'
        secret:
          description: Secret of RADIUS server
          examples:
          - testing123
          format: password
          type: string
      required:
      - host
      - secret
      type: object
    site_id:
      examples:
      - 441a1214-6928-442a-8e92-e1d34b8ec6a6
      format: uuid
      readOnly: true
      type: string
    ap_template_matching:
      additionalProperties: false
      properties:
        enabled:
          type: boolean
        rules:
          $ref: '#/components/schemas/ap_template_matching_rules'
      type: object
    radius_keywrap_format:
      description: 'enum: `ascii`, `hex`'
      enum:
      - ascii
      - hex
      type: string
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    ap_port_config:
      additionalProperties: false
      properties:
        disabled:
          default: false
          type: boolean
        dynamic_vlan:
          $ref: '#/components/schemas/ap_port_config_dynamic_vlan'
        enable_mac_auth:
          default: false
          type: boolean
        forwarding:
          $ref: '#/components/schemas/ap_port_config_forwarding'
        mac_auth_preferred:
          default: false
          description: When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth
          type: boolean
        mac_auth_protocol:
          $ref: '#/components/schemas/ap_port_config_mac_auth_protocol'
        mist_nac:
          $ref: '#/components/schemas/wlan_mist_nac'
        mx_tunnel_id:
          default: ''
          description: If `forwarding`==`mxtunnel`, vlan_ids comes from mxtunnel
          examples:
          - 08cd7499-5841-51c8-e663-fb16b6f3b45e
          format: uuid
          type: string
        mxtunnel_name:
          default: ''
          description: If `forwarding`==`site_mxedge`, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)
          type: string
        port_auth:
          $ref: '#/components/schemas/ap_port_config_port_auth'
        port_vlan_id:
          description: If `forwarding`==`limited`
          examples:
          - 1
          maximum: 4094
          minimum: 1
          type: integer
        radius_config:
          $ref: '#/components/schemas/radius_config'
        radsec:
          $ref: '#/components/schemas/radsec'
        vlan_id:
          description: "Optional to specify the vlan id for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\n  * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\n  * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnels` under site setting)"
          examples:
          - 9
          maximum: 4094
          minimum: 1
          type: integer
        vlan_ids:
          description: If `forwarding`==`limited`, comma separated list of additional vlan ids allowed on this port
          examples:
          - 10,20,30
          type: string
        wxtunnel_id:
          default: ''
          description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
          examples:
          - 7dae216d-7c98-a51b-e068-dd7d477b7216
          format: uuid
          type: string
        wxtunnel_remote_id:
          default: ''
          description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
          examples:
          - wifiguest
          type: string
      type: object
    radius_auth_servers:
      items:
        $ref: '#/components/schemas/radius_auth_server'
      type: array
      uniqueItems: true
    ap_template_wifi:
      additionalProperties: false
      properties:
        cisco_enabled:
          type: boolean
        disable_11k:
          default: false
          type: boolean
        disable_radios_when_power_constrained:
          type: boolean
        enable_arp_spoof:
          type: boolean
        enable_shared_radio_scanning:
          default: false
          type: boolean
        enabled:
          default: true
          type: boolean
        locate_connected:
          default: false
          type: boolean
        locate_unconnected:
          default: false
          type: boolean
        mesh_allow_dfs:
          default: false
          type: boolean
        mesh_enable_crm:
          type: boolean
        mesh_enabled:
          type: boolean
        proxy_arp:
          default: false
          type: boolean
      type: object
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    radius_config:
      additionalProperties: false
      description: Junos Radius config
      properties:
        acct_interim_interval:
          default: 0
          description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from RADIUS Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled
          maximum: 65535
          minimum: 0
          type: integer
        acct_servers:
          $ref: '#/components/schemas/radius_acct_servers'
        auth_servers:
          $ref: '#/components/schemas/radius_auth_servers'
        auth_servers_retries:
          default: 3
          description: radius auth session retries
          type: integer
        auth_servers_timeout:
          default: 5
          description: radius auth session timeout
          type: integer
        coa_enabled:
          default: false
          type: boolean
        coa_port:
          default: 3799
          maximum: 65535
          minimum: 1
          type: integer
        network:
          description: use `network`or `source_ip`, which network the RADIUS server resides, if there's static IP for this network, we'd use it as source-ip
          type: string
        source_ip:
          description: use `network`or `source_ip`
          type: string
      type: object
    wlan_mist_nac:
      additionalProperties: false
      properties:
        acct_interim_interval:
          default: 0
          description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the radius server, 600 and up is recommended when enabled.
          examples:
          - 60
          maximum: 65535
          minimum: 0
          type: integer
        auth_servers_retries:
          default: 2
          description: Radius auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3.
          examples:
          - 3
          maximum: 10
          minimum: 1
          type: integer
        auth_servers_timeout:
          default: 5
          description: Radius auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10.
          examples:
          - 5
          maximum: 30
          minimum: 1
          type: integer
        coa_enabled:
          default: false
          description: Allows a RADIUS server to dynamically modify the authorization status of a user session.
          type: boolean
        coa_port:
          description: the communication port used for “Change of Authorization” (CoA) messages
          examples:
          - 3799
          maximum: 65535
          minimum: 1
          type: integer
        enabled:
          default: false
          description: "When enabled:\n  * `auth_servers` is ignored\n  * `acct_servers` is ignored\n  * `auth_servers_*` are ignored\n  * `coa_servers` is ignored\n  * `radsec` is ignored\n  * `coa_enabled` is assumed"
          type: boolean
        fast_dot1x_timers:
          default: false
          description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`.
          type: boolean
        network:
          description: Which network the mist nac server resides in
          examples:
          - default
          type:
          - string
          - 'null'
        source_ip:
          description: In case there is a static IP for this network, we can specify it using source ip
          examples:
          - 1.2.3.4
          type:
          - string
          - 'null'
      type: object
    radius_acct_servers:
      items:
        $ref: '#/components/schemas/radius_acct_server'
      type: array
      uniqueItems: true
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    ap_port_config_dynamic_vlan:
      additionalProperties: false
      description: Optional dynamic vlan
      properties:
        default_vlan_id:
          examples:
          - 999
          maximum: 4094
          minimum: 1
          type: integer
        enabled:
          type: boolean
        type:
          type: string
        vlans:
          additionalProperties:
            type:
            - string
            - 'null'
          examples:
          - 1-10: null
            user: null
          type: object
      type: object
    ap_port_config_mac_auth_protocol:
      default: pap
      description: 'if `enable_mac_auth`==`true`, allows user to select an authentication protocol. enum: `eap-md5`, `eap-peap`, `pap`'
      enum:
      - eap-md5
      - eap-peap
      - pap
      type: string
    ap_port_config_forwarding:
      default: all
      description: "enum: \n  * `all`: local breakout, All VLANs\n  * `limited`: local breakout, only the VLANs configured in `port_vlan_id` and `vlan_ids`\n  * `mxtunnel`: central breakout to an Org Mist Edge (requires `mxtunnel_id`)\n  * `site_mxedge`: central breakout to a Site Mist Edge (requires `mxtunnel_name`)\n  * `wxtunnel`': central breakout to an Org WxTunnel (requires `wxtunnel_id`)"
      enum:
      - all
      - limited
      - mxtunnel
      - site_mxedge
      - wxtunnel
      examples:
      - all
      type: string
    ap_port_config_port_auth:
      default: none
      description: 'When doing port auth. enum: `dot1x`, `none`'
      enum:
      - dot1x
      - none
      examples:
      - none
      type: string
    radsec_servers:
      description: List of RadSec Servers. Only if not Mist Edge.
      items:
        $ref: '#/components/schemas/radsec_server'
      type: array
      uniqueItems: true
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    ap_template_matching_rules:
      items:
        $ref: '#/components/schemas/ap_template_matching_rule'
      type: array
      uniqueItems: true
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
    radius_auth_port:
      anyOf:
      - maximum: 65545
        minimum: 1
        type: integer
      - type: string
      description: Radius Auth Port, value from 1 to 65535, default is 1812
  responses:
    AptemplatesArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/AptemplatesArrayExample'
          schema:
            $ref: '#/components/schemas/ap_templates'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/AptemplatesArrayExample'
          schema:
            $ref: '#/components/schemas/ap_templates'
      description: Example response
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    AptemplatesArrayExample:
      value:
      - ap_matching:
          enabled: true
          rules:
          - match_model: string
            name: string
            port_config:
              eth1,eth2:
                disabled: true
                dynamic_vlan:
                  default_vlan_id: 999
                  enabled: true
                port_vlan_id: 1
                vlan_id: 9
                vlan_ids: 1, 10, 50
        created_time: 0
        for_site: true
        id: 497f6eca-6276-4993-bfeb-53cbbbba9f08
        modified_time: 0
        org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
        site_id: 72771e6a-6f5e-4de4-a5b9-1266c4197811
        wifi:
          cisco_enabled: true
          disable_11k: false
          disable_radios_when_power_constrained: true
          enable_arp_spoof: true
          enable_shared_radio_scanning: false
          enabled: true
          locate_connected: false
          locate_unconnected: false
          mesh_allow_dfs: false
          mesh_enable_crm: true
          mesh_enabled: true
          proxy_arp: false
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  parameters:
    site_id:
      in: path
      name: site_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey