openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Sites Networks API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: The API Endpoints for the Networks at the site level can be used to get the site derived networks, meaning the org level configuration with the site variables resolved.
  name: Sites Networks
paths:
  /api/v1/sites/{site_id}/networks/derived:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Get the list of derived Networks for a Site
      operationId: listSiteNetworksDerived
      parameters:
      - description: Whether resolve the site variables
        in: query
        name: resolve
        schema:
          default: false
          type: boolean
      responses:
        '200':
          $ref: '#/components/responses/NetworksArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listSiteNetworksDerived
      tags:
      - Sites Networks
components:
  schemas:
    network_vpn_access_destination_nat_property:
      additionalProperties: false
      properties:
        internal_ip:
          description: The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
          examples:
          - 192.168.70.30
          type: string
        name:
          examples:
          - web server
          type: string
        port:
          examples:
          - '443'
          type: string
      type: object
    network_internet_access_destination_nat:
      additionalProperties:
        $ref: '#/components/schemas/network_internet_access_destination_nat_property'
      description: Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internal_ip` or `port` must be defined
      type: object
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    network_source_nat:
      additionalProperties: false
      description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub
      properties:
        external_ip:
          examples:
          - 172.16.0.8/30
          type: string
      type: object
    network_tenant_addresses:
      items:
        description: The user/tenant IP Address (i.e. "192.168.70.30"), an Subnet (i.e. "192.168.70.0/24") or a Variable (i.e. "{{myvar}}")
        examples:
        - 192.168.70.30
        type: string
      type: array
    network_tenant:
      additionalProperties: false
      properties:
        addresses:
          $ref: '#/components/schemas/network_tenant_addresses'
      type: object
    network_multicast_group:
      additionalProperties: false
      properties:
        rp_ip:
          description: RP (rendezvous point) IP Address
          type: string
      type: object
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    network_internal_access:
      additionalProperties: false
      properties:
        enabled:
          type: boolean
      type: object
    network_internet_access:
      additionalProperties: false
      description: Whether this network has direct internet access
      properties:
        create_simple_service_policy:
          default: false
          type: boolean
        destination_nat:
          $ref: '#/components/schemas/network_internet_access_destination_nat'
        enabled:
          type: boolean
        restricted:
          default: false
          description: By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies
          type: boolean
        static_nat:
          $ref: '#/components/schemas/network_internet_access_static_nat'
      type: object
    network_multicast_groups:
      additionalProperties:
        $ref: '#/components/schemas/network_multicast_group'
      description: Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example "225.1.0.3/32")
      type: object
    network_internet_access_static_nat_property:
      additionalProperties: false
      properties:
        internal_ip:
          description: The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          examples:
          - 192.168.70.3
          type: string
        name:
          examples:
          - pos_station-1
          type: string
        wan_name:
          description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
          examples:
          - wan0
          type: string
      type: object
    network_vpn_access_static_nat_property:
      additionalProperties: false
      properties:
        internal_ip:
          description: The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
          examples:
          - 192.168.70.3
          type: string
        name:
          examples:
          - pos_station-1
          type: string
      type: object
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    network_vpn_access_config:
      additionalProperties: false
      properties:
        advertised_subnet:
          description: If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side
          examples:
          - 172.16.0.0/24
          type: string
        allow_ping:
          description: Whether to allow ping from vpn into this routed network
          type: boolean
        destination_nat:
          $ref: '#/components/schemas/network_vpn_access_destination_nat'
        nat_pool:
          description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub
          examples:
          - 172.16.0.0/26
          type: string
        no_readvertise_to_lan_bgp:
          default: false
          description: toward LAN-side BGP peers
          type: boolean
        no_readvertise_to_lan_ospf:
          default: false
          description: toward LAN-side OSPF peers
          type: boolean
        no_readvertise_to_overlay:
          description: toward overlay, how HUB should deal with routes it received from Spokes
          type: boolean
        other_vrfs:
          $ref: '#/components/schemas/network_vpn_access_config_other_vrfs'
        routed:
          description: Whether this network is routable
          type: boolean
        source_nat:
          $ref: '#/components/schemas/network_source_nat'
        static_nat:
          $ref: '#/components/schemas/network_vpn_access_static_nat'
        summarized_subnet:
          description: toward overlay, how HUB should deal with routes it received from Spokes
          examples:
          - 172.16.0.0/16
          type: string
        summarized_subnet_to_lan_bgp:
          description: toward LAN-side BGP peers
          examples:
          - 172.16.0.0/16
          type: string
        summarized_subnet_to_lan_ospf:
          description: toward LAN-side OSPF peers
          examples:
          - 172.16.0.0/16
          type: string
      type: object
    network_vpn_access:
      additionalProperties:
        $ref: '#/components/schemas/network_vpn_access_config'
      description: Property key is the VPN name. Whether this network can be accessed from vpn
      type: object
    network_routed_for_networks:
      description: For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)
      items:
        examples:
        - pos
        type: string
      type: array
    network_vpn_access_destination_nat:
      additionalProperties:
        $ref: '#/components/schemas/network_vpn_access_destination_nat_property'
      description: Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internal_ip` or `port` must be defined
      type: object
    vlan_id_with_variable:
      oneOf:
      - type: string
      - maximum: 4094
        minimum: 1
        type: integer
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    network_internet_access_destination_nat_property:
      additionalProperties: false
      properties:
        internal_ip:
          description: The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
          examples:
          - 192.168.70.30
          type: string
        name:
          examples:
          - web server
          type: string
        port:
          description: The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
          examples:
          - '443'
          type: string
        wan_name:
          description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
          examples:
          - wan0
          type: string
      type: object
    network_vpn_access_static_nat:
      additionalProperties:
        $ref: '#/components/schemas/network_vpn_access_static_nat_property'
      description: Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
      type: object
    networks:
      items:
        $ref: '#/components/schemas/network'
      type: array
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    network_tenants:
      additionalProperties:
        $ref: '#/components/schemas/network_tenant'
      description: Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
      type: object
    network_vpn_access_config_other_vrfs:
      description: By default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
      items:
        examples:
        - iot
        type: string
      type: array
    network:
      description: Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
        disallow_mist_services:
          default: false
          description: Whether to disallow Mist Devices in the network
          type: boolean
        gateway:
          examples:
          - 192.168.70.1
          format: ipv4
          type: string
        gateway6:
          examples:
          - fdad:b0bc:f29e::1
          format: ipv6
          type: string
        id:
          $ref: '#/components/schemas/id'
        internal_access:
          $ref: '#/components/schemas/network_internal_access'
        internet_access:
          $ref: '#/components/schemas/network_internet_access'
        isolation:
          description: Whether to allow clients in the network to talk to each other
          type: boolean
        modified_time:
          $ref: '#/components/schemas/modified_time'
        multicast:
          $ref: '#/components/schemas/network_multicast'
        name:
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
        routed_for_networks:
          $ref: '#/components/schemas/network_routed_for_networks'
        subnet:
          examples:
          - 192.168.70.0/24
          type: string
        subnet6:
          examples:
          - fdad:b0bc:f29e::/32
          type: string
        tenants:
          $ref: '#/components/schemas/network_tenants'
        vlan_id:
          $ref: '#/components/schemas/vlan_id_with_variable'
        vpn_access:
          $ref: '#/components/schemas/network_vpn_access'
      required:
      - name
      type: object
    network_multicast:
      additionalProperties: false
      description: Whether to enable multicast support (only PIM-sparse mode is supported)
      properties:
        disable_igmp:
          default: false
          description: If the network will only be the source of the multicast traffic, IGMP can be disabled
          type: boolean
        enabled:
          default: false
          type: boolean
        groups:
          $ref: '#/components/schemas/network_multicast_groups'
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
    network_internet_access_static_nat:
      additionalProperties:
        $ref: '#/components/schemas/network_internet_access_static_nat_property'
      description: Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
      type: object
  responses:
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    NetworksArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/NetworksArrayExample'
          schema:
            $ref: '#/components/schemas/networks'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/NetworksArrayExample'
          schema:
            $ref: '#/components/schemas/networks'
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    NetworksArrayExample:
      value:
      - created_time: 0
        disallow_mist_services: false
        gateway: 192.168.70.1
        hosts:
          property1:
            external_ips: 172.16.10.32-172.16.10.35
            ips: 192.168.70.32-192.168.70.35
          property2:
            external_ips: 172.16.10.32-172.16.10.35
            ips: 192.168.70.32-192.168.70.35
        id: 497f6eca-6276-4993-bfeb-53cbbbba6f13
        internal_access:
          enabled: true
        internet_access:
          create_simple_service_policy: false
          destination_nat:
            property1:
              internal_ip: 192.168.70.30
              name: web server
              port: '443'
            property2:
              internal_ip: 192.168.70.30
              name: web server
              port: '443'
          enabled: true
          restricted: false
          static_nat:
            property1:
              internal_ip: 192.168.70.3
              name: printer-1
            property2:
              internal_ip: 192.168.70.3
              name: printer-1
        isolation: true
        modified_time: 0
        name: string
        org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
        subnet: 192.168.70.0/24
        tenants:
          property1:
            addresses:
            - 10.10.10.10
          property2:
            addresses:
            - 10.10.10.45
        vlan_id: 10
        vpn_access:
          property1:
            allow_ping: true
            destination_nat:
              property1:
                internal_ip: 192.168.70.5/30
                name: web server
                port: '443'
              property2:
                internal_ip: 192.168.70.5/30
                name: web server
                port: '443'
            nat_pool: 172.16.0.0/26
            routed: true
            source_nat:
              external_ip: 172.16.0.8/30
            static_nat:
              property1:
                internal_ip: 192.168.70.3
                name: pos_station-1
              property2:
                internal_ip: 192.168.70.3
                name: pos_station-1
            summarized_subnet: 172.16.0.0/16
          property2:
            allow_ping: true
            destination_nat:
              property1:
                internal_ip: 192.168.70.5/30
                name: web server
                port: '443'
              property2:
                internal_ip: 192.168.70.5/30
                name: web server
                port: '443'
            nat_pool: 172.16.0.0/26
            routed: true
            source_nat:
              external_ip: 172.16.0.8/30
            static_nat:
              property1:
                internal_ip: 192.168.70.3
                name: pos_station-1
              property2:
                internal_ip: 192.168.70.3
                name: pos_station-1
            summarized_subnet: 172.16.0.0/16
  parameters:
    site_id:
      in: path
      name: site_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey