openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Sites Service Policies API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: The API Endpoints for the Service Policies at the site level can be used to get the site derived configuration, meaning the merge between the site level configuration and the org level configuration.
  name: Sites Service Policies
paths:
  /api/v1/sites/{site_id}/servicepolicies/derived:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: Get the list of derived Service Policies for a Site
      operationId: listSiteServicePoliciesDerived
      parameters:
      - description: Whether resolve the site variables
        in: query
        name: resolve
        schema:
          default: false
          type: boolean
      responses:
        '200':
          $ref: '#/components/responses/ServicePoliciesArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listSiteServicePoliciesDerived
      tags:
      - Sites Service Policies
components:
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    service_policy_ewf:
      items:
        $ref: '#/components/schemas/service_policy_ewf_rule'
      type: array
    service_policy_aamw_profile:
      default: standard
      description: 'enum: `docsonly`, `executables`, `standard`'
      enum:
      - docsonly
      - executables
      - standard
      type: string
    idp_config:
      additionalProperties: false
      properties:
        alert_only:
          type: boolean
        enabled:
          default: false
          type: boolean
        idpprofile_id:
          description: org_level IDP Profile can be used, this takes precedence over `profile`
          examples:
          - 89b9d208-84a4-fa8f-af57-78f92c639cf2
          format: uuid
          type: string
        profile:
          default: strict
          description: 'enum: `Custom`, `strict` (default), `standard` or keys from idp_profiles'
          type: string
      type: object
    service_policy_ewf_rule_profile:
      default: strict
      description: 'enum: `critical`, `standard`, `strict`'
      enum:
      - critical
      - standard
      - strict
      type: string
    strings:
      items:
        type: string
      type: array
      uniqueItems: true
    org_service_policy:
      properties:
        aamw:
          $ref: '#/components/schemas/service_policy_aamw'
        action:
          $ref: '#/components/schemas/allow_deny'
        antivirus:
          $ref: '#/components/schemas/service_policy_antivirus'
        appqoe:
          $ref: '#/components/schemas/service_policy_appqoe'
        created_time:
          $ref: '#/components/schemas/created_time'
        ewf:
          $ref: '#/components/schemas/service_policy_ewf'
        id:
          $ref: '#/components/schemas/id'
        idp:
          $ref: '#/components/schemas/idp_config'
        local_routing:
          description: access within the same VRF
          type: boolean
        modified_time:
          $ref: '#/components/schemas/modified_time'
        name:
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
        path_preference:
          description: By default, we derive all paths available and use them, optionally, you can customize by using `path_preference`
          type: string
        secintel:
          $ref: '#/components/schemas/service_policy_secintel'
        services:
          $ref: '#/components/schemas/strings'
        ssl_proxy:
          $ref: '#/components/schemas/service_policy_ssl_proxy'
        tenants:
          $ref: '#/components/schemas/strings'
      type: object
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    service_policy_ewf_rule:
      additionalProperties: false
      properties:
        alert_only:
          type: boolean
        block_message:
          examples:
          - Access to this URL Category has been blocked
          type: string
        enabled:
          default: false
          type: boolean
        profile:
          $ref: '#/components/schemas/service_policy_ewf_rule_profile'
      type: object
    service_policy_secintel_profile:
      default: default
      description: 'enum: `default`, `standard`, `strict`'
      enum:
      - default
      - standard
      - strict
      type: string
    service_policy_aamw:
      additionalProperties: false
      description: SRX only
      properties:
        aamwprofile_id:
          description: org-level Advanced Advance Anti Malware Profile (SkyAtp) Profile can be used, this takes precedence over 'profile'
          format: uuid
          type: string
        enabled:
          default: false
          type: boolean
        profile:
          $ref: '#/components/schemas/service_policy_aamw_profile'
      type: object
    org_service_policies:
      items:
        $ref: '#/components/schemas/org_service_policy'
      type: array
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    service_policy_ssl_proxy:
      additionalProperties: false
      description: For SRX-only
      properties:
        ciphers_category:
          $ref: '#/components/schemas/ssl_proxy_ciphers_category'
        enabled:
          default: false
          type: boolean
      type: object
    allow_deny:
      description: 'enum: `allow`, `deny`'
      enum:
      - allow
      - deny
      type: string
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    ssl_proxy_ciphers_category:
      default: strong
      description: 'enum: `medium`, `strong`, `weak`'
      enum:
      - medium
      - strong
      - weak
      type: string
    service_policy_antivirus:
      additionalProperties: false
      description: For SRX-only
      properties:
        avprofile_id:
          description: org-level AV Profile can be used, this takes precedence over 'profile'
          format: uuid
          type: string
        enabled:
          default: false
          type: boolean
        profile:
          description: Default / noftp / httponly / or keys from av_profiles
          type: string
      type: object
    service_policy_secintel:
      additionalProperties: false
      description: SRX only
      properties:
        enabled:
          default: false
          type: boolean
        profile:
          $ref: '#/components/schemas/service_policy_secintel_profile'
        secintelprofile_id:
          description: org-level secintel Profile can be used, this takes precedence over 'profile'
          type: string
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    service_policy_appqoe:
      additionalProperties: false
      description: SRX only
      properties:
        enabled:
          default: false
          type: boolean
      type: object
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
  responses:
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    ServicePoliciesArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/ServicePoliciesArrayExample'
          schema:
            $ref: '#/components/schemas/org_service_policies'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/ServicePoliciesArrayExample'
          schema:
            $ref: '#/components/schemas/org_service_policies'
      description: Example response
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    ServicePoliciesArrayExample:
      value:
      - action: allow
        created_time: 0
        id: string
        modified_time: 0
        name: string
        org_id: string
        services:
        - string
        tenants:
        - string
  parameters:
    site_id:
      in: path
      name: site_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey