openapi: 3.2.0
info:
title: Intelligent Capture (ICAP) Provisioning Preview Deploy API
description: "APIs to manage Catalyst Center Assurance Intelligent Capture (ICAP) configurations. Catalyst Center ICAP is a suite of features for troubleshooting client onboarding issues by capturing client Wi-Fi packets and statistics for offline analysis.\n\n**Configurations supported include**\n\n|Configuration Type | Description |\n| --- | --- |\n| `ANOMALY` | This proactively monitors client onboarding issues. When an issue occurs, the AP device sends a client anomaly event, including a set of client Wi-Fi packets from the time of the event. |\n| `FULL` | This is to capture all Wi-Fi packets to and from a specific client MAC address. |\n| `ONBOARDING` | This captures client onboarding packets and client RF statistics with a 5-second granularity. |\n| `OTA` | This captures all Wi-Fi packets on a specific Wi-Fi band and channel. This feature can be used on up to two neighboring AP devices of an AP experiencing client-serving band or channel issues. |\n| `RFSTATS` | This captures both client and AP radio RF statistics with a 30-second granularity. |\n| `SPECTRUM` | This captures Wi-Fi Layer 2 signal strength and sources of interference across all supported Wi-Fi bands and channels. |\n\n**ICAP Configuration limitations**\n* The minimum duration for FULL packet capture is 30 minutes, and the maximum is 8 hours.\n* The duration for OTA packet capture is 15 minutes\n* ONBOARDING packet capture supports 16 unique client MAC addresses with up to 3 WLCs for each client MAC address. The duration of capture can be set between 30 minutes and 8 hours.\n* SPECTRUM settings can be enabled on a maximum of 10 APs. The duration of SPECTRUM data is 10 minutes.\n* RFSTATS settings \n * At AP level, the feature can be enabled on a maximum of 1000 APs\n * At WLC level, the feature can be enabled only if Catalyst Center does not have more than 1,000 managed APs.\n * Mixture of AP and WLC level configuration is not supported.\n* OTA settings\n * Can have up to 2 APs with both support radio role sniffer, but 1 AP which supports AP mode sniffer. Consult AP hardware/software documetation about packet sniffing limitations. Minimum required AP software is IOSxe 17.11. AP running AireOS is not supported. AP must be in client-serving mode prior to enabling OTA on the AP. Changing an AP from client-serving to AP mode sniffer is not supported when the AP supports radio role sniffer. Most AP platforms support radio role sniffer at radio slot 0. The radio must be admin/oper UP and in client-serving mode prior to using ICAP OTA on the AP radio. Changing 2 or more radios of 1 AP from client-serving mode to radio role sniffer is not supported. Enabling OTA is to change AP from client-serving to sniffer, which will force all clients at the radio to roam to neighboring APs. Client network service experiences will be impacted.\n \n **WARNING:** Enalbing OTA will reset AP radio (or the AP device if OTA mode is \"AP\"). This will force all clients who are associating with the AP radio to roam to other AP devices. Clients WIFI network experiences will be impacted.\n* ANOMALY Settings\n * Must be applied at the WLC level, although AP-level ANOMALY is also supported. Applying ANOMALY at the AP level is intended for troubleshooting a specific client at a specific AP. Catalyst Center does not allow applying ANOMALY at both the WLC and AP levels simultaneously. The feature can be disabled on demand.\n * Mixture of AP and WLC level configuration is not supported.\n* Applying ICAP configurations at the WLC level is to apply the configurations to all AP profiles known to the Catalyst Center. Wireless controller devices must be managed and in good health prior to use ICAP features for troubleshooting client WIFI issues.\n"
termsOfService: https://www.cisco.com/c/en/us/about/legal/cloud-and-software/end_user_license_agreement.html
contact:
name: Cisco TAC World Wide
url: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
email: tac@cisco.com
license:
name: Cisco Catalyst Center License
url: https://www.cisco.com/c/en/us/products/collateral/software/dna-software-ebook-cte.html
version: 1.0.0
x-provenance:
method: harvested
authored_by: Cisco Catalyst Center
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: developer.cisco.com
note: 27 Cisco-published OpenAPI 3.0 Assurance documents (185 operations). Ownership confirmed from the tac@cisco.com contact, the Cisco EULA terms-of-service URL and the Cisco Catalyst Center license block carried in each document.
x-evidence:
- type: source
url: https://developer.cisco.com/docs/catalyst-center/
- type: source
url: https://developer.cisco.com/dnacenter/
servers:
- url: https://developer.cisco.com
tags:
- name: preview-deploy
description: APIs to preview, approve, and cancel (discard) ICAP provisioning intents.
paths:
/dna/intent/api/v1/icapSettings/configurationModels:
post:
tags:
- preview-deploy
summary: Creates an ICAP configuration intent for preview-approve.
description: 'This creates an ICAP configuration intent for preview approval. The intent is not deployed to the device until further preview-approve APIs are applied. This API is the first step in the preview-approve workflow, which consists of several APIs. Skipping any API in the process is not recommended for a complete preview-approve use case.
**POST Body**: See **/dna/intent/api/v1/icapSettings/deploy** description
**The general guidline for preview-approve workflow is below**
**Step 1**: Use this API to POST the intent request. The intent is not deployed to the device yet. The TaskResponse body has the taskId UUID. This taskId value is the previewAcitivityId in all subsequent APIs. After this POST API, **DELETE /dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}** API could be used at any step to discard/cancel the intent. A discarded intent complete the prevew-approve workflow, and so ICAP intent is not applied to the device. The API response body includes a URL which should be used to GET the status of the task. The task must be successfully complete before proceeding to the next step. Otherwise, subsequent API in the preview-approve process may not be functioning well due to internal task timing. A failed task at any step completes the preview-approve workflow process.
**Step 2**: Use **GET /dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}/networkDeviceStatusDetails** to check potential conficts.
**Step 3**: Use **POST /dna/intent/api/v1/icapSettings/{previewActivityId}/networkDevices/{networkDeviceId}/config** to generate device CLIs for preview-approve. The response body of this POST has a task ID and a URL for checking the task status. Task must be successfully complete before using the GET API to view CLIs. A failed task at this step completes the preview-approve workflow. This POST API requires the networkDeviceId, which is the value of the property wlcId in the **POST /dna/intent/api/icapSettings/configurationModels**. Multiple POST requests, each with different wlcId value of the same previewActivityId, could be applied to generate CLIs for the device. Each POST returns a task and must be checked before proceeding to the next step. It is not recommended to proceed when there is one ore more task failure in this step. When there is any task failure at this step, use **DELETE /dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}** to discard activity.
**Step 4**: Use **GET /dna/intent/api/v1/icapSettings/configurationModels/{previewAcitivityId}/networkDevices/{networkDeviceId}/config** to view the CLIs that will be applied to the device.
**Step 5**: Use **POST /dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}/deploy** to push the intent to device. This complete the preview/approve workflow. This POST returns a task, which should be checked for task status.
**NOTE: ONBOARDING, FULL, OTA, and SPECTRUM** have duration. A "disable" task is scheduled to remove the ICAP intent at the duration expiring time. Use **GET /dna/intent/api/v1/icap** API to retrieve the "disable" task ID. This task ID could be used to preview the CLIs of the "disable" task. However, steps of preview-approve workflow are not available after the duration has expired.
'
operationId: postConfigurationModel
parameters:
- name: previewDescription
in: query
description: The ICAP intent's preview-deploy description string
required: false
style: form
explode: true
schema:
type: string
example: FULL for client AA:AA:AA:AA:AA:01 on WLC
requestBody:
description: Request payload to prepare for preview ICAP configuration.
content:
application/json:
schema:
$ref: '#/components/schemas/PacketCaptureDeployInfoList'
examples:
FULL:
$ref: '#/components/examples/FULL'
ONBOARDING:
$ref: '#/components/examples/ONBOARDING'
RFSTATS on WLC:
$ref: '#/components/examples/RFSTATS_WLC'
RFSTATS on AP:
$ref: '#/components/examples/RFSTATS_AP'
ANOMALY on WLC:
$ref: '#/components/examples/ANOMALY_WLC'
ANOMALY on AP:
$ref: '#/components/examples/ANOMALY_AP'
SPECTRUM:
$ref: '#/components/examples/SPECTRUM'
OTA:
$ref: '#/components/examples/OTA'
OTA AP Mode Sniffer:
$ref: '#/components/examples/OTA_AP_Mode'
OTA Radio Mode Sniffer:
$ref: '#/components/examples/OTA_Radio_Role'
responses:
'202':
description: Accepted
content:
application/json:
schema:
$ref: '#/components/schemas/inline_response_202'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
/dna/intent/api/v1/icapSettings/configurationModels/{id}/deleteDeploy:
post:
tags:
- preview-deploy
summary: Creates a ICAP configuration workflow for ICAP intent to remove the ICAP configuration on the device.
description: "Creates a ICAP configuration intent to remove the ICAP RFSTATS or ANOMALY configuration from the device. The task has not been applied to the device yet. Subsequent preview-approve workflow APIs must be used to complete the preview-approve process. The path parameter 'id' can be retrieved from **GET /dna/intent/api/v1/icapSettings** API.\n\nThe response body has the taskId value for preview-approve. The same workflow API steps (2 thru 5) as documented in the **POST /dna/intent/api/icapSettings/configurationModesl** apply after this POST API.\n\n**Note:** ICAP configuration types (captureType) FULL, ONBOADING, OTA, and SPECTRUM have duration 'durationInMins'. A \"disable\" task has been deployed to be triggered at 'durantionInMins' time for removing the ICAP configuration on the device. Use Direct-Deploy **POST /dna/intent/api/v1/icapSettings/deploy/{id}/deleteDeploy** to remove the configuration from the device if a shorter capture duration is desired. Although the disabled task is pre-scheduled for deployment, the CLIs are not yet available for preview. To preview the CLIs that will be applied to the device for the disabled task, use the same information in **Step 3** and **Step 4** of the **POST /dna/intent/api/v1/icapSettings/configurationModels/deploy**. The disable task's activity ID value can be obtained from **GET /dna/intent/api/icapSettings**\n\nThe API does not need a request body. If your API utility needs request body to run the API send an empty array [] in the body as a workaround. \n"
operationId: deleteIcapConfigurationModel
parameters:
- name: id
in: path
description: A unique ID of the deployed ICAP object, which can be obtained from **GET /dna/intent/api/v1/icapSettings**
required: true
style: simple
explode: false
schema:
type: string
format: uuid
example: 7f422eeb-effe-4938-9371-ccf6dc2fe15e
responses:
'202':
description: Accepted
content:
application/json:
schema:
$ref: '#/components/schemas/TaskResponse'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
/dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}/networkDeviceStatusDetails:
get:
tags:
- preview-deploy
summary: Get ICAP configuration status per network device.
description: Get ICAP configuration status per network device using the activity ID, which was returned in property "taskId" of the TaskResponse of the POST.
operationId: getConfigurationModelNetworkDeviceStatusDetails
parameters:
- name: previewActivityId
in: path
description: activity from the POST /deviceConfigugrationModels task response
required: true
style: simple
explode: false
schema:
type: string
format: uuid
example: 7f422eeb-effe-4938-9371-ccf6dc2fe15e
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PreviewDeviceStatusDetailsListResponse'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
/dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}/networkDevices/{networkDeviceId}/config:
get:
tags:
- preview-deploy
summary: Retrieves the device's CLIs of the ICAP intent.
description: Returns the device's CLIs of the ICAP intent.
operationId: getDeviceConfigurationModelNetworkDeviceConfig
parameters:
- name: previewActivityId
in: path
description: activity from the POST /deviceConfigugrationModels task response
required: true
style: simple
explode: false
schema:
type: string
format: uuid
example: 7f422eeb-effe-4938-9371-ccf6dc2fe15e
- name: networkDeviceId
in: path
description: device id from intent/api/v1/network-device
required: true
style: simple
explode: false
schema:
$ref: '#/components/schemas/NetworkDeviceId'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PreviewListResponse'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
post:
tags:
- preview-deploy
summary: Generates the device's CLIs of the ICAP configuration intent.
description: Generates the device's CLIs of the ICAP intent for preview and approve prior to deploying the ICAP configuration intent to the device. After deploying the configuration intent, generating intent CLIs will not be available for preview.
operationId: postConfigurationModelNetworkDeviceConfig
parameters:
- name: previewActivityId
in: path
description: activity from the POST /deviceConfigugrationModels task response
required: true
style: simple
explode: false
schema:
type: string
format: uuid
example: 7f422eeb-effe-4938-9371-ccf6dc2fe15e
- name: networkDeviceId
in: path
description: device id from intent/api/v1/network-device
required: true
style: simple
explode: false
schema:
$ref: '#/components/schemas/NetworkDeviceId'
responses:
'202':
description: Accepted
content:
application/json:
schema:
$ref: '#/components/schemas/TaskResponse'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
/dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}:
delete:
tags:
- preview-deploy
summary: Discards the ICAP configuration intent by activity ID.
description: 'Discard the ICAP configuration intent by activity ID, which was returned in TaskResponse''s property "taskId" at the beginning of the preview-approve workflow. Discarding the intent can only be applied to intent activities that have not been deployed.
Note that ICAP type FULL, ONBOARDING, OTA, and SPECTRUM for the scheduled-disabled task cannot be discarded or cancelled because they have already deployed. The feature can only be disabled by sending in a direct-deploy DELETE with API /dna/intent/api/v1/icapSettings/deploy/deployedId/{icapDeployedId}
'
operationId: deleteConfigurationModel
parameters:
- name: previewActivityId
in: path
description: activity from the POST /deviceConfigugrationModels task response
required: true
style: simple
explode: false
schema:
type: string
format: uuid
example: 7f422eeb-effe-4938-9371-ccf6dc2fe15e
responses:
'202':
description: Accepted
content:
application/json:
schema:
$ref: '#/components/schemas/TaskResponse'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
/dna/intent/api/v1/icapSettings/configurationModels/{previewActivityId}/deploy:
post:
tags:
- preview-deploy
summary: Deploys the ICAP configuration intent by activity ID.
description: 'Deploys the ICAP configuration intent by activity ID, which was returned in property "taskId" of the TaskResponse of the POST. POST''ing the intent prior to generating the intent CLI for preview-approve has the same effect as direct-deploy''ing the intent to the device.
Generating of device''s CLIs for preview-approve is not available for this activity ID after using this POST API.
'
operationId: postConfigurationModelDeploy
parameters:
- name: previewActivityId
in: path
description: activity from the POST /deviceConfigugrationModels task response
required: true
style: simple
explode: false
schema:
type: string
format: uuid
example: 7f422eeb-effe-4938-9371-ccf6dc2fe15e
responses:
'202':
description: Accepted
content:
application/json:
schema:
$ref: '#/components/schemas/inline_response_202_1'
'204':
description: The request was successful, however no content was returned.
'206':
description: The GET request included a Range Header, and the server responded with the partial content matching the range.
'400':
description: The client made a request that the server could not understand (for example, the request syntax is incorrect).
'401':
description: The client's authentication credentials included with the request are missing or invalid.
'403':
description: The server recognizes the authentication credentials, but the client is not authorized to perform this request.
'404':
description: The client made a request for a resource that does not exist.
'409':
description: The target resource is in a conflicted state (for example, an edit conflict where a resource is being edited by multiple users). Retrying the request later might succeed.
'415':
description: The client sent a request body in a format that the server does not support (for example, XML to a server that only accepts JSON).
'500':
description: The server could not fulfill the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'501':
description: The server has not implemented the functionality required to fulfill the request.
'503':
description: The server is (temporarily) unavailable.
'504':
description: The server did not respond inside time restrictions and timed-out.
components:
schemas:
EpochMilliseconds:
minimum: 0
type: integer
description: A date and time represented as ***milliseconds*** since the Unix epoch.
format: int64
example: 1524880285900
externalDocs:
description: Unix time - Wikipedia
url: https://en.wikipedia.org/wiki/Unix_time
inline_response_202_1:
allOf:
- $ref: '#/components/schemas/TaskResponse'
- description: The task when complete will have the activity url in the resultLocation field. The progress of this deploy operation can be tracked using the activity.
PreviewDeviceStatusDetail:
type: object
properties:
networkDeviceId:
type: string
description: Id of the device
format: uuid
example: efab65ed-dcbe-4857-999e-af3e477aed1a
status:
$ref: '#/components/schemas/PreviewGenerationStatus'
description: status for device configuration preview
PreviewItem:
type: object
properties:
configPreview:
type: string
description: the actual preview item. this is what will be configured on the device if the user decides to go ahead with the provisioning.
example: interface FortyGigabitEthernet1/1/2 device-tracking attach-policy IPDT_POLICY
configType:
type: string
description: "Preview item type:\n * 'CLI' - preview item is of type CLI (Command Line Interface)\n * 'YANG' - preview item is of type Yang (data modeling language)\n"
enum:
- CLI
- YANG
errorMessages:
type: array
items:
type: string
description: error messages during preview generation
name:
type: string
description: user friendly description of the preview item
example: Telemetry & Other Catalyst Center Settings
TaskResponse:
title: Task Response
type: object
properties:
response:
$ref: '#/components/schemas/TaskResponse_response'
version:
type: string
description: The version of the response
example: '1.0'
description: Contains information about a task to track the status of an asynchronous operation.
externalDocs:
description: Asynchronous operations - Cisco DevNet
url: https://developer.cisco.com/docs/dna-center/#!asynchronous-apis/asynchronous-operati
# --- truncated at 32 KB (44 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-catalyst-center/refs/heads/main/openapi/cisco-catalyst-center-preview-deploy-api-openapi.yml