openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Sites Clients - NAC API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: NAC Clients are devices connected to the network and authenticated by Juniper Mist Access Assurance.
  name: Sites Clients - NAC
paths:
  /api/v1/sites/{site_id}/nac_clients/count:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Count by Distinct Attributes of NAC Clients
      operationId: countSiteNacClients
      parameters:
      - description: NAC Policy Rule ID, if matched
        in: query
        name: distinct
        schema:
          $ref: '#/components/schemas/site_nac_clients_count_distinct'
      - description: NAC Policy Rule ID, if matched
        in: query
        name: last_nacrule_id
        schema:
          type: string
      - description: NAC Policy Rule Matched
        in: query
        name: nacrule_matched
        schema:
          type: boolean
      - description: Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"
        in: query
        name: auth_type
        schema:
          type: string
      - description: Vlan ID
        in: query
        name: last_vlan_id
        schema:
          type: string
      - description: Vendor of NAS device
        in: query
        name: last_nas_vendor
        schema:
          type: string
      - description: SSO ID, if present and used
        in: query
        name: idp_id
        schema:
          type: string
      - description: SSID
        in: query
        name: last_ssid
        schema:
          type: string
      - description: Username presented by the client
        in: query
        name: last_username
        schema:
          type: string
      - description: Start time, in epoch
        in: query
        name: timestamp
        schema:
          type: number
      - description: AP MAC connected to by client
        in: query
        name: last_ap
        schema:
          type: string
      - description: MAC address
        in: query
        name: mac
        schema:
          type: string
      - description: Connection status of client i.e "permitted", "denied, "session_ended"
        in: query
        name: last_status
        schema:
          type: string
      - description: Client type i.e. "wireless", "wired" etc.
        in: query
        name: type
        schema:
          type: string
      - description: MDM compliance of client i.e "compliant", "not compliant"
        in: query
        name: mdm_compliance_status
        schema:
          type: string
      - description: MDM provider of client’s organisation eg "intune", "jamf"
        in: query
        name: mdm_provider
        schema:
          type: string
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      responses:
        '200':
          $ref: '#/components/responses/Count'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: countSiteNacClients
      tags:
      - Sites Clients - NAC
  /api/v1/sites/{site_id}/nac_clients/events/count:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Count by Distinct Attributes of NAC Client-Events
      operationId: countSiteNacClientEvents
      parameters:
      - in: query
        name: distinct
        schema:
          $ref: '#/components/schemas/site_nac_client_events_count_distinct'
      - $ref: '#/components/parameters/nac_event_type'
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      responses:
        '200':
          $ref: '#/components/responses/Count'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: countSiteNacClientEvents
      tags:
      - Sites Clients - NAC
  /api/v1/sites/{site_id}/nac_clients/events/search:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Search NAC Client Events
      operationId: searchSiteNacClientEvents
      parameters:
      - $ref: '#/components/parameters/nac_event_type'
      - description: NAC Policy Rule ID, if matched
        in: query
        name: nacrule_id
        schema:
          format: uuid
          type: string
      - description: NAC Policy Rule Matched
        in: query
        name: nacrule_matched
        schema:
          type: boolean
      - description: NAC Policy Dry Run Rule ID, if present and matched
        in: query
        name: dryrun_nacrule_id
        schema:
          type: string
      - description: True - if dryrun rule present and matched with priority, False - if not matched or not present
        in: query
        name: dryrun_nacrule_matched
        schema:
          type: boolean
      - description: Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"
        in: query
        name: auth_type
        schema:
          type: string
      - description: Vlan ID
        in: query
        name: vlan
        schema:
          type: integer
      - description: Vendor of NAS device
        in: query
        name: nas_vendor
        schema:
          type: string
      - description: BSSID
        in: query
        name: bssid
        schema:
          type: string
      - description: SSO ID, if present and used
        in: query
        name: idp_id
        schema:
          format: uuid
          type: string
      - description: IDP returned roles/groups for the user
        in: query
        name: idp_role
        schema:
          type: string
      - description: Username presented to the Identity Provider
        in: query
        name: idp_username
        schema:
          type: string
      - description: Radius attributes returned by NAC to NAS Devive
        in: query
        name: resp_attrs
        schema:
          $ref: '#/components/schemas/resp_attrs'
      - description: SSID
        in: query
        name: ssid
        schema:
          type: string
      - description: Username presented by the client
        in: query
        name: username
        schema:
          type: string
      - description: AP MAC
        in: query
        name: ap
        schema:
          type: string
      - description: AP random macMAC
        in: query
        name: random_mac
        schema:
          type: boolean
      - description: MAC address
        in: query
        name: mac
        schema:
          type: string
      - description: Time, in epoch
        in: query
        name: timestamp
        schema:
          type: number
      - description: Labels derived from usermac entry
        in: query
        name: usermac_label
        schema:
          type: string
      - description: Partial / full MAC address, username, device_mac or ap. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported
        in: query
        name: text
        schema:
          type: string
      - description: IP address of NAS device
        in: query
        name: nas_ip
        schema:
          type: string
      - description: Vendor specific Vlan ID in radius requests
        in: query
        name: ingress_vlan
        schema:
          type: string
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/sort_wcid'
      - $ref: '#/components/parameters/search_after'
      responses:
        '200':
          $ref: '#/components/responses/EventsNacClientSearch'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: searchSiteNacClientEvents
      tags:
      - Sites Clients - NAC
  /api/v1/sites/{site_id}/nac_clients/search:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Search Site NAC Clients
      operationId: searchSiteNacClients
      parameters:
      - description: MAC Address of the AP the client is/was connected to
        in: query
        name: ap
        schema:
          type: string
      - description: Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"
        in: query
        name: auth_type
        schema:
          type: string
      - description: Filter by certificate expiry within a specific duration from now (e.g., "7d" for 7 days, "1m" for 1 month)
        in: query
        name: cert_expiry_duration
        schema:
          examples:
          - 7d
          - 1m
          type: string
      - description: Filters NAC clients that are integrated with EDR providers
        in: query
        name: edr_managed
        schema:
          type: boolean
      - description: EDR provider of client's organization
        in: query
        name: edr_provider
        schema:
          $ref: '#/components/schemas/edr_provider'
      - description: EDR Status of the NAC client
        in: query
        name: edr_status
        schema:
          $ref: '#/components/schemas/edr_status'
      - $ref: '#/components/parameters/partial_filter_family_client'
      - $ref: '#/components/parameters/partial_filter_hostname_client'
      - description: SSO ID, if present and used
        in: query
        name: idp_id
        schema:
          type: string
      - $ref: '#/components/parameters/partial_filter_mac_client'
      - description: MDM compliance of client i.e "compliant", "not compliant"
        in: query
        name: mdm_compliance
        schema:
          type: string
      - description: MDM provider of client’s organization eg "intune", "jamf"
        in: query
        name: mdm_provider
        schema:
          type: string
      - description: Filters NAC clients that are managed by MDM providers
        in: query
        name: mdm_managed
        schema:
          type: boolean
      - $ref: '#/components/parameters/partial_filter_mfg_client'
      - description: Client model, e.g. "iPhone 12", "MX100"
        in: query
        name: model
        schema:
          type: string
      - description: NAC Policy Rule Name matched
        in: query
        name: nacrule_name
        schema:
          type: string
      - description: NAC Policy Rule ID, if matched
        in: query
        name: nacrule_id
        schema:
          type: string
      - description: NAC Policy Rule Matched
        in: query
        name: nacrule_matched
        schema:
          type: boolean
      - description: Vendor of NAS device
        in: query
        name: nas_vendor
        schema:
          type: string
      - description: IP address of NAS device
        in: query
        name: nas_ip
        schema:
          type: string
      - description: Vendor specific Vlan ID in radius requests
        in: query
        name: ingress_vlan
        schema:
          type: string
      - description: Client OS, e.g. "iOS 18.1", "Android", "Windows", "Linux"
        in: query
        name: os
        schema:
          type: string
      - description: SSID
        in: query
        name: ssid
        schema:
          type: string
      - description: Connection status of client i.e "permitted", "denied, "session_started", "session_stopped"
        in: query
        name: status
        schema:
          $ref: '#/components/schemas/nac_client_last_status'
      - description: partial / full MAC address, last_username, device_mac, nas_ip. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported.
        in: query
        name: text
        schema:
          type: string
      - description: Start time, in epoch
        in: query
        name: timestamp
        schema:
          type: number
      - description: Client type i.e. "wireless", "wired" etc.
        in: query
        name: type
        schema:
          type: string
      - description: Labels derived from usermac entry
        in: query
        name: usermac_label
        schema:
          $ref: '#/components/schemas/strings'
      - description: Username presented by the client
        in: query
        name: username
        schema:
          type: string
      - description: Vlan name or ID assigned to the client
        in: query
        name: vlan
        schema:
          type: string
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/sort_wcid'
      - $ref: '#/components/parameters/search_after'
      responses:
        '200':
          $ref: '#/components/responses/ClientNacSearch'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: searchSiteNacClients
      tags:
      - Sites Clients - NAC
  /api/v1/sites/{site_id}/nac_clients/{client_mac}/coa:
    parameters:
    - $ref: '#/components/parameters/site_id'
    - $ref: '#/components/parameters/client_mac'
    post:
      description: Sends CoA (Change of Authorization) command to a NAC client.
      operationId: sendSiteNacClientCoA
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_client_coa'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/NacClientCoa'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: sendSiteNacClientCoA
      tags:
      - Sites Clients - NAC
components:
  schemas:
    nac_event_dryrun_nacrule_id:
      description: NAC Policy Dry Run Rule ID, if present and matched
      examples:
      - 32f27e7d-ff26-4a9b-b3d1-ff9bcb264012
      format: uuid
      readOnly: true
      type: string
    strings:
      items:
        type: string
      type: array
      uniqueItems: true
    nac_event_type:
      description: Event type, e.g. NAC_CLIENT_PERMIT. Use the [List NAC Events Definitions](/#operations/listNacEventsDefinitions) endpoint to get the full list of available values.
      examples:
      - NAC_CLIENT_PERMIT
      readOnly: true
      type: string
    last_cert_expiry:
      description: When certificate based authentication is used, the expiration date from the latest certificate used
      examples:
      - 1746711240
      type: number
    last_cert_serial:
      description: When certificate based authentication is used, the Serial from the latest certificate used
      examples:
      - 2c63510123456789
      type: string
    last_cert_subject:
      description: When certificate based authentication is used, the Subject from the latest certificate used
      examples:
      - /C=US/O=MyCorp/CN=john@mycorp.net/emailAddress=john@mycorp.net
      type: string
    nac_cert_cn:
      description: When certificate based authentication is used, the CN from the certificates used for the specified duration
      examples:
      - - john@mycorp.net
      items:
        type: string
      readOnly: true
      type: array
    nac_client_coa:
      additionalProperties: false
      properties:
        coa_type:
          $ref: '#/components/schemas/nac_coa_type'
      type: object
    nac_event_idp_username:
      description: If IDP is used, the username presented to the Identity Provider
      examples:
      - user@deaflyz.net
      readOnly: true
      type: string
    timestamp:
      description: Epoch (seconds)
      format: double
      readOnly: true
      type: number
    last_ssid:
      description: If Wireless authentication, the latest SSID the client was connected to
      examples:
      - MyCorp-NAC
      type: string
    nac_event_nas_vendor:
      description: Vendor name of the NAS
      examples:
      - juniper-mist
      readOnly: true
      type: string
    nac_client_last_status:
      description: 'Latest Authentication status of the client. enum: `denied`, `permitted`, `session_started`, `session_stopped`'
      enum:
      - permitted
      - session_started
      - session_stopped
      - denied
      examples:
      - permitted
      type: string
    nac_event_nacrule_id:
      description: NAC Policy Rule ID, if matched
      examples:
      - 32f27e7d-ff26-4a9b-b3d1-ff9bcb264c62
      format: uuid
      readOnly: true
      type: string
    nac_auth_type:
      description: 'enum: `cert`, `device-auth`, `eap-teap`, `eap-tls`, `eap-ttls`, `idp`, `mab`, `eap-peap`'
      enum:
      - cert
      - device-auth
      - eap-teap
      - eap-tls
      - eap-ttls
      - idp
      - mab
      - eap-peap
      examples:
      - eap-tls
      type: string
    resp_attrs:
      description: List of Radius AVP returned by the Authentication Server
      examples:
      - - Tunnel-Type=VLAN
        - Tunnel-Medium-Type=IEEE-802
        - Tunnel-Private-Group-Id=750
        - User-Name=anonymous
      items:
        type: string
      type: array
      uniqueItems: true
    nac_client_ip:
      description: The known IP Addresses used by the client for the specified duration
      examples:
      - - 10.100.0.157
      items:
        type: string
      readOnly: true
      type: array
    last_nacrule_id:
      description: ID of the latest NAC Rule used to authenticate the client
      examples:
      - 603b62db-d839-4152-9f7f-f2578443de8d
      type: string
    response_events_nac_client_search:
      additionalProperties: false
      properties:
        end:
          examples:
          - 1513176951
          type: integer
        limit:
          examples:
          - 10
          type: integer
        next:
          type: string
        results:
          $ref: '#/components/schemas/nac_client_events'
        start:
          examples:
          - 1512572151
          type: integer
        total:
          examples:
          - 1
          type: integer
      type: object
    device_type:
      description: 'enum: `ap`, `gateway`, `switch`'
      enum:
      - ap
      - gateway
      - switch
      type: string
    last_nacrule_name:
      description: Name of the latest NAC Rule used to authenticate the client
      examples:
      - Wireless Cert Auth
      type: string
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    nac_nas_vendor:
      description: Vendor name of the NAS for the specified duration
      examples:
      - - juniper-mist
      items:
        type: string
      readOnly: true
      type: array
    response_count:
      additionalProperties: false
      properties:
        distinct:
          type: string
        end:
          type: integer
        limit:
          type: integer
        results:
          $ref: '#/components/schemas/count_results'
        start:
          type: integer
        total:
          type: integer
      required:
      - distinct
      - end
      - limit
      - results
      - start
      - total
      type: object
    nac_client_events:
      items:
        $ref: '#/components/schemas/nac_client_event'
      type: array
    response_client_nac_search:
      additionalProperties: false
      properties:
        end:
          examples:
          - 1513362753
          type: integer
        limit:
          examples:
          - 3
          type: integer
        next:
          type: string
        results:
          $ref: '#/components/schemas/response_client_nac_search_results'
        start:
          examples:
          - 1513276353
          type: integer
        total:
          examples:
          - 2
          type: integer
      type: object
    last_username:
      description: If dot1x authentication, the username used during the latest authentication. Otherwise, the MAC address of the client
      examples:
      - john@mycorp.net
      type: string
    nac_client_ap:
      examples:
      - - 5c5b35bf16bb
        - d4dc090041b4
      items:
        type: string
      readOnly: true
      type: array
    nac_nacrule_id:
      description: IDs of the NAC Rules used to authenticate the client for the specified duration
      examples:
      - - 603b62db-d839-4152-9f7f-f2578443de8d
      items:
        type: string
      readOnly: true
      type: array
    nac_device_mac:
      description: MAC Address of the device (AP, Switch) the client is connected to
      examples:
      - 60c78d8c7f6f
      readOnly: true
      type: string
    nac_event_nacrule_matched:
      description: NAC Policy Rule Matched
      readOnly: true
      type: boolean
    nac_client_mac:
      description: Client MAC address
      examples:
      - ac3eb179e535
      readOnly: true
      type: string
    nac_event_username:
      description: username assigned to the client
      readOnly: true
      type: string
    random_mac:
      description: Whether the client is using randomized MAC Address or not
      enum:
      - 'true'
      - 'false'
      type: string
    nac_cert_subject:
      description: When certificate based authentication is used, the Subject from the certificates used for the specified duration
      examples:
      - - /C=US/O=MyCorp/CN=john@mycorp.net/emailAddress=john@mycorp.net
      items:
        type: string
      readOnly: true
      type: array
    edr_status:
      description: 'EDR Status of the NAC client. enum: `sentinelone_healthy`, `sentinelone_infected`, `crowdstrike_low`, `crowdstrike_medium`, `crowdstrike_high`, `crowdstrike_critical`, `crowdstrike_informational`'
      enum:
      - sentinelone_healthy
      - sentinelone_infected
      - crowdstrike_low
      - crowdstrike_medium
      - crowdstrike_high
      - crowdstrike_critical
      - crowdstrike_informational
      type: string
    nac_cert_issuer:
      description: When certificate based authentication is used, the Issuer from the certificates used for the specified duration
      examples:
      - - /C=US/ST=CA/CN=MyCorp
      items:
        type: string
      readOnly: true
      type: array
    edr_provider:
      description: '`enum: `sentinelone`, `crowdstrike`'
      enum:
      - crowdstrike
      - sentinelone
      type: string
    nac_client_vlan:
      description: List of vlans that have been assigned to the client
      items:
        type: string
      readOnly: true
      type: array
    last_client_ip:
      description: The last known IP Address for the client
      examples:
      - 10.100.0.157
      type: string
    response_client_nac_search_results:
      items:
        $ref: '#/components/schemas/client_nac'
      type: array
    nac_client_event_usermac_labels:
      description: Labels derived from usermac entry
      examples:
      - - bldg5
        - printer
      items:
        type: string
      type: array
    last_port_id:
      description: If Wired authentication, the latest Port-id the client was connected to
      examples:
      - ge-0/0/17.0
      type: string
    count_result:
      additionalProperties:
        type: string
      properties:
        count:
          type: integer
      required:
      - count
      type: object
    last_vlan:
      description: Latest VLAN ID assigned to the client
      examples:
      - 10
      type: integer
    nac_event_vlan:
      description: vlan that assigned to the client
      readOnly: true
      type: string
    last_nas_vendor:
      description: Vendor name of the NAS for the latest authentication
      examples:
      - juniper-mist
      type: string
    nac_coa_type:
      default: reauth
      description: 'CoA type to send. enum: `reauth`, `disconnect`'
      enum:
      - reauth
      - disconnect
      type: string
    site_nac_client_events_count_distinct:
      description: 'enum: `ap`, `auth_type`, `dryrun_nacrule_id`, `mac`, `nacrule_id`, `nas_vendor`, `ssid`, `type`, `username`, `vlan`'
      enum:
      - ap
      - auth_type
      - dryrun_nacrule_id
      - mac
      - nacrule_id
      - nas_vendor
      - ssid
      - type
      - username
      - vlan
      type: string
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    nac_event_ssid:
      description: SSIDs the client was connecting to
      examples:
      - MyCorp-NAC
      readOnly: true
      type: string
    client_nac:
      additionalProperties: false
      properties:
        ap:
          $ref: '#/components/schemas/nac_client_ap'
        auth_type:
          $ref: '#/components/schemas/nac_auth_type'
        cert_cn:
          $ref: '#/components/schemas/nac_cert_cn'
        cert_issuer:
          $ref: '#/components/schemas/nac_cert_issuer'
        cert_serial:
          $ref: '#/components/schemas/nac_cert_serial'
        cert_subject:
          $ref: '#/components/schemas/nac_cert_subject'
        client_ip:
          $ref: '#/components/schemas/nac_client_ip'
        device_mac:
          $ref: '#/components/schemas/nac_device_mac'
        edr_managed:
          type: boolean
        edr_provider:
          $ref: '#/components/schemas/edr_provider'
        edr_status:
          $ref: '#/components/schemas/edr_status'
        group:
          type: string
        idp_id:
          type: string
        idp_role:
          $ref: '#/components/schemas/strings'
        last_ap:
          $ref: '#/components/schemas/last_ap'
        last_cert_cn:
          $ref: '#/components/schemas/last_cert_cn'
        last_cert_expiry:
          $ref: '#/components/schemas/last_cert_expiry'
        last_cert_issuer:
          $ref: '#/components/schemas/last_cert_issuer'
        last_cert_serial:
          $ref: '#/components/schemas/last_cert_serial'
        last_cert_subject:
          $ref: '#/components/schemas/last_cert_subject'
        last_client_ip:
          $ref: '#/components/schemas/last_client_ip'
        last_nacrule_id:
          $ref: '#/components/schemas/last_nacrule_id'
        last_nacrule_name:
          $ref: '#/components/schemas/last_nacrule_name'
        last_nas_vendor:
          $ref: '#/components/schemas/last_nas_vendor'
        last_port_id:
          $ref: '#/components/schemas/last_port_id'
        last_ssid:
          $ref: '#/components/schemas/last_ssid'
        last_status:
          $ref: '#/components/schemas/nac_client_last_status'
        last_username:
          $ref: '#/components/schemas/last_username'
        last_vlan:
          $ref: '#/components/schemas/last_vlan'
        mac:
          $ref: '#/components/schemas/nac_client_mac'
        nacrule_id:
          $ref: '#/components/schemas/nac_nacrule_id'
        nacrule_matched:
          type: boolean
        nacrule_name:
          $ref: '#/components/schemas/nac_nacrule_name'
        nas_ip:
          type: string
        nas_vendor:
          $ref: '#/components/schemas/nac_nas_vendor'
        org_id:
          $ref: '#/components/schemas/org_id'
        port_id:
          $ref: '#/components/schemas/nac_port_id'
        random_mac:
          $ref: '#/components/schemas/random_mac'
        resp_attrs:
          $ref: '#/components/schemas/resp_attrs'
        site_id:
          $ref: '#/components/schemas/site_id'
        ssid:
          $ref: '#/components/schemas/nac_ssid'
        timestamp:
          $ref: '#/components/schemas/timestamp'
        type:
          $ref: '#/components/schemas/nac_access_type'
        usermac_label:
          $ref: '#/components/schemas/strings'
        username:
          $ref: '#/components/schemas/nac_client_username'
        vlan:
          $ref: '#/components/schemas/nac_client_vlan'
      type: object
    nac_ssid:
      description: SSIDs the client was connected to for the specified duration
      examples:
      - - MyCorp-NAC
      items:
        type: string
      type: array
    nac_event_dryrun_nacrule_matched:
      description: '`true` if dryrun rule present and matched with priority, `false` if not matched or not present'
      readOnly: true
      type: boolean
    nac_event_port_id:
      description: Port ID where the NAC client event occurred
      examples:
      - ge-0/0/17.0
      readOnly: true
      type: string
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    nac_client_event:
      additionalProperties: false
      properties:
        ap:
          description: AP mac
          examples:
          - 5c5b35513227
          type: string
        auth_type:
          $ref: '#/components/schemas/nac_auth_type'
        bssid:
          description: BSSID
          examples:
          - 5c5b355fafcc
          type: string
        client_type:
          $ref: '#/components/schemas/nac_access_type'
        device_mac:
          $ref: '#/components/schemas/nac_device_mac'
        dryrun_nacrule_id:
          $ref: '#/components/schemas/nac_event_dryrun_nacrule_id'
        dryrun_nacrule_matched:
          $ref: '#/components/schemas/nac_event_dryrun_nacrule_matched'
        idp_id:
          $ref: '#/components/schemas/nac_event_idp_id'
        idp_role:
          $ref: '#/components/schemas/nac_client_event_idp_role'
        idp_username:
          $ref: '#/components/schemas/nac_event_idp_username'
        mac:
          $ref: '#/components/schemas/nac_client_mac'
        mxedge_id:
          description: Mist Edge ID used to connect to cloud
          type: string
        nacrule_id:
          $ref: '#/components/schemas/nac_event_nacrule_id'
        nacrule_matched:
          $ref: '#/components/schemas/nac_event_nacrule_matched'
        nas_vendor:
          $ref: '#/components/schemas/nac_event_nas_vendor'
        org_id:
          $ref: '#/components/schemas/org_id'
        port_id:
          $ref: '#/components/schemas/nac_event_port_id'
        port_type:
          $ref: '#/components/schemas/nac_access_type'
        random_mac:
          $ref: '#/components/schemas/random_mac'
        resp_attrs:
          $ref: '#/components/schemas/resp_attrs'
        site_id:
          $ref: '#/components/schemas/site_id'
        ssid:
          $ref: '#/components/schemas/nac_event_ssid'
        timestamp:
          $ref: '#/components/schemas/timestamp'
        type:
          $ref: '#/components/schemas/nac_event_type'
        usermac_label:
          $ref: '#/components/schemas/nac_client_event_usermac_labels'
        username:
          $ref: '#/components/schemas/nac_event_username'
        vlan:
          $ref: '#/components/schemas/nac_event_vlan'
        vlan_source:
          description: Vlan source, e.g. "nactag", "usermac"
          examples:
          - nactag
          type: string
      type: object
    last_ap:
      description: Latest AP where the client is/was connected to
      examples:
      - a83a79a947ee
      type: string
    nac_client_coa_response:
      additionalProperties: false
      properties:
        device_mac:
          description: MAC address of the target device (AP or switch MAC)
          type: string
        device_type:
          $ref: '#/components/schemas/device_type'
      type: object
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    nac_port_id:
      description: Port-ids the client was connected to for the specified duration
      examples:
      - - ge-0/0/17.0
      items:
        type: string
      readOnly: true
      type: array
    count_results:
      items:
        $ref: '#/components/schemas/count_result'
      type: array
      uniqueItems: true
    site_nac_clients_count_distinct:
      default: type
      description: 'enum: `ap`, `auth_type`, `device_mac`, `edr_managed`, `edr_provider`, `edr_status`, `family`, `hostname`, `idp_id`, `mfg`, `mdm_compliance`, `mdm_managed`, `mdm_provider`, `model`, `mxedge_id`, `nacrule_matched`, `nacrule_name`, `nacrule_id`, `nas_ip`, `nas_vendor`, `os`, `ssid`, `status`, `type`, `usermac_label`, `username`, `vlan`'
      enum:
      - ap
      - auth_type
      - device_mac
      - edr_managed
      - edr_provider
      - edr_status
      - family
      - hostname
      - idp_id
      - mfg
      - mdm_compliance
      - mdm_managed
      - mdm_provider
      - model
      - mxedge_id
      - nacrule_matched
      - nacrule_name
      - nacrule_id
      - nas_ip
      - nas_vendor
      - os
      - ssid
      - status
      - type
      - usermac_label
      - username
      - vlan
      type: string
    site_id:
      examples:
      - 441a1214-6928-442a-8e92-e1d34b8ec6a6
      format: uuid
      readOnly: true
      type: string
    last_cert_issuer:
      description: When certificate based authentication is used, the Issuer from the latest certificate used
      examples:
      - /C=US/ST=CA/CN=MyCorp
      type: string
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    nac_client_event_idp_role:
      examples:
      - - itsuperusers
        - vip
      items:
        type: string
      type: array
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    nac_access_type:
      description: 'Type of network access. enum: `wireless`, `wired`, `vty`'
      enum:
      - wireless
      - wired
      - vty
      examples:
      - wireless
      type: string
    nac_client_username:
      description: List of usernames that have been assigned to the client
      items:
        type: string
      readOnly: true
      type: array
    nac_event_idp_id:
      description: If IDP is used, the id of the IDP configuration used
      examples:
      - 912ef72e-2239-4996-b81e-469e87a27cd6
      format: uuid
      readOnly: true
      type: string
    last_cert_cn:
      description: When certificate based authentication is used, the CN from the latest certificate used
      examples:
      - john@mycorp.net
      type: string
    nac_cert_serial:
      description: When certificate based authentication is used, the Serial from the certificates used for the specified duration
      examples:
      - - 2c63510123456789
      items:
        type: string
      readOnly: true
      type: array
    nac_nacrule_name:
      description: Name of the NAC Rules used to authenticate the client for the specified duration
      examples:
      - - Wireless Cert Auth
      items:
        type: string
      readOnly: true
      type: array
  parameters:
    duration:
      description: Duration like 7d, 2w
      in: query
      name: duration
      schema:
        default: 1d
        examples:
        - 10m
        type: string
    end:
      description: End time (epoch timestamp in seconds, or relative string like "-1d", "-2h", "now")
      in: query
      name: end
      schema:
        type: string
    partial_filter_mac_client:
      description: Partial / full Client MAC Address. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported
      in: query
      name: mac
      schema:
        examples:
        - aabbccddeeff
        - aabbcc*
        - '*bbcc*'
        type: string
    search_after:
      description: Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the `next` URL from the previous response and should not be manually constructed.
      in: query
      name: search_after
      schema:
        type: string
    partial_filter_mfg_client:
      description: Partial / full Client manufacturer (e.g. "apple", "cisco", "juniper"). Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `Raspberry Pi*` and `*Pi*` match `Raspberry Pi Trading Ltd`). Suffix-only wildcards (e.g. `*Ltd`) are not supported
      in: query
      name: mfg
      schema:
        examples:
        - Raspberry Pi Trading Ltd
        - Raspberry Pi*
        - '*Pi*'
        type: string
    site_id:
      in: path
      name: site_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    start:
      description: Start time (epoch timestamp in seconds, or relative string like "-1d", "-1w")
      in: query
      name: start
      schema:
        type: string
    partial_filter_family_client:
      description: Partial / full Client family (e.g. "Phone/Tablet/Wearable", "Access Point"). Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `Surveillance*` and `*urveillance*` match `Surveillance Camera`). Suffix-only wildcards (e.g. `*Camera`) are not supported
      in: query
      name: family
      schema:
        examples:
        - Surveillance Camera
        - Surveillance*
        - '*urveillance*'
        type: string
    partial_filter_hostname_client:
      description: Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported
      in: query
      name: hostname
      schema:
        examples:
        - my-everest-client
        - my-everest*
        - '*everest*'
        type: string
    nac_event_type:
      description: See [List Device Events Definitions](/#operations/listNacEventsDefinitions)
      in: query
      name: type
      schema:
        type: string
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
    client_mac:
      in: path
      name: client_mac
      required: true
      schema:
        examples:
        - 0000000000ab
        pattern: ^[0-9a-fA-F]{12}$
        type: string
    sort_wcid:
      description: On which field the list should be sorted, -prefix represents DESC order.
      in: query
      name: sort
      schema:
        default: wxid
        examples:
        - -site_id
        type: string
  examples:
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    CountExample:
      value:
        distinct: string
        end: 0
        limit: 0
        results:
        - count: 0
          property: string
        start: 0
        total: 0
    ClientNacSearchExample:
      value:
        end: 1513362753
        limit: 3
        results:
        - ap:
          - 5c5b35bf16bb
          - d4dc090041b4
          auth_type: eap-tls
          cert_cn:
          - john@mycorp.net
          cert_issuer:
          - /C=US/ST=CA/CN=MyCorp
          client_ip:
          - 10.7.51.74
          edr_managed: true
          edr_provider: sentinelone
          edr_status: sentinelone_healthy
          idp_id: string
          idp_role:
          - string
          last_ap: string
          last_cert_cn: john@mycorp.net
          last_cert_expiry: 1746711240
          last_cert_issuer: /C=US/ST=CA/CN=MyCorp
          last_cert_serial: 2c63510123456789
          last_cert_subject: /C=US/O=MyCorp/CN=john@mycorp.net/emailAddress=john@mycorp.net
          last_client_ip: 10.7.51.74
          last_nacrule_id: 603b62db-d839-4152-9f7f-f2578443de8d
          last_nacrule_name: Wireless Cert Auth
          last_nas_vendor: juniper-mist
          last_ssid: string
          last_status: permitted
          mac: string
          nacrule_id:
          - 603b62db-d839-4152-9f7f-f2578443de8d
          nacrule_matched: true
          nacrule_name:
          - Wireless Cert Auth
          nas_vendor:
          - juniper-mist
          org_id: 31f27122-68a9-47a4-b526-8fb8a62a8acb
          random_mac: 'true'
          site_id: 832b1d74-9531-409b-ae37-4d7f3edbde92
          ssid:
          - string
          timestamp: 1694689718.612
          type: wireless
          usermac_label:
          - non-compliant
          - building26
          - floor52
        start: 1513276353
        total: 2
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    EventsNacClientSearchNACclientevents:
      value:
        end: 1513176951
        limit: 10
        results:
        - ap: 5c5b35513227
          auth_type: eap-ttls
          bssid: 5c5b355fafcc
          dryrun_nacrule_id: 32f27e7d-ff26-4a9b-b3d1-ff9bcb264012
          dryrun_nacrule_matched: true
          idp_id: 912ef72e-2239-4996-b81e-469e87a27cd6
          idp_role:
          - itsuperusers
          - vip
          mac: ac3eb179e535
          nacrule_id: 32f27e7d-ff26-4a9b-b3d1-ff9bcb264c62
          nacrule_matched: true
          nas_vendor: juniper-mist
          org_id: 27547ac2-d114-4e04-beb1-f3f1e6e81ec6
          random_mac: 'false'
          resp_attrs:
          - Tunnel-Type=VLAN
          - Tunnel-Medium-Type=IEEE-802
          - Tunnel-Private-Group-Id=750
          - User-Name=anonymous
          site_id: 441a1214-6928-442a-8e92-e1d34b8ec6a6
          ssid: mist_nac
          timestamp: 1691512031.358188
          type: NAC_CLIENT_PERMIT
          username: user@deaflyz.net
          vlan: '750'
        start: 1512572151
        total: 1
  responses:
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    NacClientCoa:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/nac_client_coa_response'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/nac_client_coa_response'
      description: Example response
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    ClientNacSearch:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/ClientNacSearchExample'
          schema:
            $ref: '#/components/schemas/response_client_nac_search'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/ClientNacSearchExample'
          schema:
            $ref: '#/components/schemas/response_client_nac_search'
      description: Example response
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    EventsNacClientSearch:
      content:
        application/json:
          examples:
            NAC-client_events:
              $ref: '#/components/examples/EventsNacClientSearchNACclientevents'
          schema:
            $ref: '#/components/schemas/response_events_nac_client_search'
        application/vnd.api+json:
          examples:
            NAC-client_events:
              $ref: '#/components/examples/EventsNacClientSearchNACclientevents'
          schema:
            $ref: '#/components/schemas/response_events_nac_client_search'
      description: NAC Client Events
    Count:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/CountExample'
          schema:
            $ref: '#/components/schemas/response_count'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/CountExample'
          schema:
            $ref: '#/components/schemas/response_count'
      description: Result of Count
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey