Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.2.0
info:
title: Administration and Settings Administration - User and Group API
description: "Includes API operations for the following:\n Global parameters for SD-WAN Manager\n User, group and tenant management\n Software maintenance\n Backup and restore\n Container management"
contact:
email: vmanage@cisco.com
license:
name: Commercial License
url: https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/index.html
version: 26.1.0+2026-01-06
x-provenance:
method: harvested
authored_by: Cisco Catalyst SD-WAN
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: pubhub.devnetcloud.com
note: 4,138 operations across 2,841 paths, published by Cisco as self-contained per-operation OpenAPI 3.1.0 fragments on the DevNet CDN and consolidated here into 13 documents. Ownership verified from info.contact vmanage@cisco.com and the Cisco license URL rather than from the fetch host.
x-evidence:
- type: source
url: https://pubhub.devnetcloud.com/media/cisco-catalyst-sd-wan-26-1-api-guide/docs/
- type: source
url: https://developer.cisco.com/docs/sdwan/
servers:
- url: /dataservice
tags:
- name: Administration - User and Group
paths:
/admin/aaa:
get:
tags:
- Administration - User and Group
description: 'Get aaa configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: getAaaConfig
responses:
'200':
description: Ok
content:
application/json:
schema:
type: object
properties:
accounting:
type: boolean
description: Enable accounting to track user sessions and command execution for auditing purposes
adminAuthOrder:
type: boolean
description: Enable separate authentication order for administrative users
auditDisable:
type: boolean
description: Disable audit logging for authentication and authorization events
authFallback:
type: boolean
description: Enable authentication fallback to local user database when external authentication servers are unreachable
authOrder:
maxItems: 3
minItems: 1
type: array
description: Ordered list of authentication methods to be used for user login (e.g., local, radius, tacacs). Minimum 1, maximum 3 authentication methods allowed.
items:
type: string
description: Ordered list of authentication methods to be used for user login (e.g., local, radius, tacacs). Minimum 1, maximum 3 authentication methods allowed.
enum:
- local
- radius
- tacacs
description: AAA configuration
$$ref: '#/components/schemas/Aaa'
examples:
AAA Configuration Response:
description: AAA Configuration Response
value:
authOrder:
- local
- radius
authFallback: true
adminAuthOrder: false
auditDisable: false
accounting: true
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
post:
tags:
- Administration - User and Group
description: 'Create aaa configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: createAaaConfig
requestBody:
description: aaa
content:
application/json:
schema:
type: object
properties:
accounting:
type: boolean
description: Enable accounting to track user sessions and command execution for auditing purposes
adminAuthOrder:
type: boolean
description: Enable separate authentication order for administrative users
auditDisable:
type: boolean
description: Disable audit logging for authentication and authorization events
authFallback:
type: boolean
description: Enable authentication fallback to local user database when external authentication servers are unreachable
authOrder:
maxItems: 3
minItems: 1
type: array
description: Ordered list of authentication methods to be used for user login (e.g., local, radius, tacacs). Minimum 1, maximum 3 authentication methods allowed.
items:
type: string
description: Ordered list of authentication methods to be used for user login (e.g., local, radius, tacacs). Minimum 1, maximum 3 authentication methods allowed.
enum:
- local
- radius
- tacacs
description: AAA configuration
$$ref: '#/components/schemas/Aaa'
examples:
AAA Configuration Create:
description: AAA Configuration Create
value:
authOrder:
- radius
- tacacs
- local
authFallback: true
adminAuthOrder: true
auditDisable: false
accounting: true
required: true
responses:
'200':
description: Success
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
put:
tags:
- Administration - User and Group
description: 'Update aaa configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: updateAaaConfig
requestBody:
description: aaa
content:
application/json:
schema:
type: object
properties:
accounting:
type: boolean
description: Enable accounting to track user sessions and command execution for auditing purposes
adminAuthOrder:
type: boolean
description: Enable separate authentication order for administrative users
auditDisable:
type: boolean
description: Disable audit logging for authentication and authorization events
authFallback:
type: boolean
description: Enable authentication fallback to local user database when external authentication servers are unreachable
authOrder:
maxItems: 3
minItems: 1
type: array
description: Ordered list of authentication methods to be used for user login (e.g., local, radius, tacacs). Minimum 1, maximum 3 authentication methods allowed.
items:
type: string
description: Ordered list of authentication methods to be used for user login (e.g., local, radius, tacacs). Minimum 1, maximum 3 authentication methods allowed.
enum:
- local
- radius
- tacacs
description: AAA configuration
$$ref: '#/components/schemas/Aaa'
examples:
AAA Configuration Update:
description: AAA Configuration Update
value:
authOrder:
- radius
- tacacs
- local
authFallback: true
adminAuthOrder: true
auditDisable: false
accounting: true
required: true
responses:
'200':
description: Success
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
delete:
tags:
- Administration - User and Group
description: 'Delete aaa configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: deleteAaaConfig
responses:
'200':
description: Ok
content:
application/json:
schema:
type: object
examples:
Delete Success Response:
description: Delete Success Response
value:
authOrder:
- local
- radius
authFallback: true
adminAuthOrder: false
auditDisable: false
accounting: true
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
/admin/events/{sseSessionId}:
get:
tags:
- Administration - User and Group
operationId: listenAuthEvents
parameters:
- name: sseSessionId
in: path
description: sse session Id
required: true
schema:
type: string
responses:
default:
description: default response
content:
text/event-stream: {}
/admin/radius:
delete:
tags:
- Administration - User and Group
description: 'Delete radius configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: deleteRadiusConfig
responses:
'200':
description: Ok
content:
application/json:
schema:
type: object
properties:
retransmit:
maximum: 1000
minimum: 1
type: integer
description: Configure how many times to contact each RADIUS server
format: int32
example: 3
default: 3
server:
maxItems: 8
minItems: 0
type: array
description: RADIUS server configuration
items:
required:
- address
- secretKey
type: object
properties:
acctPort:
maximum: 65535
minimum: 0
type: integer
description: Accounting Port
format: int32
example: 1813
default: 1813
address:
pattern: (^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$)|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))
type: string
description: Set IP address of RADIUS server
example: 1.2.2.2
authPort:
maximum: 65535
minimum: 0
type: integer
description: Authentication Port
format: int32
example: 1812
default: 1812
priority:
maximum: 7
minimum: 0
type: integer
description: Priority
format: int32
example: 1
default: 0
secretKey:
pattern: ^(?:\$CRYPT\$.{17}|(?!(?:\$CRYPT\$)).{1,128})$
type: string
description: Secret key
example: password
tag:
maxLength: 16
minLength: 4
pattern: ^[a-zA-Z0-9\-_]*$
type: string
description: Reference tag/name for the server
example: radius-server1
vpn:
type: integer
description: VPN ID
format: int32
example: 0
enum:
- 0
- 512
default: 0
description: Configure the RADIUS server
$$ref: '#/components/schemas/ControlComponentAaaRadiusServer'
timeout:
maximum: 1000
minimum: 1
type: integer
description: Configure how long to wait for replies from the RADIUS server
format: int32
example: 5
default: 5
description: Radius configuration
$$ref: '#/components/schemas/Radius'
examples:
RADIUS Delete Success Response:
description: RADIUS Delete Success Response
value:
timeout: 5
retransmit: 3
server:
- address: 192.168.1.100
authPort: 1812
acctPort: 1813
sourceVpn: 0
vpn: 0
vpnIpSubnet: 192.168.1.0/24
key: radius-key
secretKey: shared-secret
priority: 1
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
post:
tags:
- Administration - User and Group
description: 'Create radius configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: createRadiusConfig
requestBody:
description: radius
content:
application/json:
schema:
type: object
properties:
retransmit:
maximum: 1000
minimum: 1
type: integer
description: Configure how many times to contact each RADIUS server
format: int32
example: 3
default: 3
server:
maxItems: 8
minItems: 0
type: array
description: RADIUS server configuration
items:
required:
- address
- secretKey
type: object
properties:
acctPort:
maximum: 65535
minimum: 0
type: integer
description: Accounting Port
format: int32
example: 1813
default: 1813
address:
pattern: (^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$)|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))
type: string
description: Set IP address of RADIUS server
example: 1.2.2.2
authPort:
maximum: 65535
minimum: 0
type: integer
description: Authentication Port
format: int32
example: 1812
default: 1812
priority:
maximum: 7
minimum: 0
type: integer
description: Priority
format: int32
example: 1
default: 0
secretKey:
pattern: ^(?:\$CRYPT\$.{17}|(?!(?:\$CRYPT\$)).{1,128})$
type: string
description: Secret key
example: password
tag:
maxLength: 16
minLength: 4
pattern: ^[a-zA-Z0-9\-_]*$
type: string
description: Reference tag/name for the server
example: radius-server1
vpn:
type: integer
description: VPN ID
format: int32
example: 0
enum:
- 0
- 512
default: 0
description: Configure the RADIUS server
$$ref: '#/components/schemas/ControlComponentAaaRadiusServer'
timeout:
maximum: 1000
minimum: 1
type: integer
description: Configure how long to wait for replies from the RADIUS server
format: int32
example: 5
default: 5
description: Radius configuration
$$ref: '#/components/schemas/Radius'
examples:
RADIUS Configuration Create:
description: RADIUS Configuration Create
value:
timeout: 10
retransmit: 5
server:
- address: 192.168.1.100
authPort: 1812
acctPort: 1813
sourceVpn: 0
vpn: 0
vpnIpSubnet: 192.168.1.0/24
key: radius-key
secretKey: updated-secret
priority: 1
- address: 192.168.1.101
authPort: 1812
acctPort: 1813
sourceVpn: 0
vpn: 0
vpnIpSubnet: 192.168.2.0/24
key: radius-key-2
secretKey: backup-secret
priority: 2
required: true
responses:
'200':
description: Success
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
put:
tags:
- Administration - User and Group
description: 'Update radius configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: updateRadiusConfig
requestBody:
description: radius
content:
application/json:
schema:
type: object
properties:
retransmit:
maximum: 1000
minimum: 1
type: integer
description: Configure how many times to contact each RADIUS server
format: int32
example: 3
default: 3
server:
maxItems: 8
minItems: 0
type: array
description: RADIUS server configuration
items:
required:
- address
- secretKey
type: object
properties:
acctPort:
maximum: 65535
minimum: 0
type: integer
description: Accounting Port
format: int32
example: 1813
default: 1813
address:
pattern: (^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$)|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))
type: string
description: Set IP address of RADIUS server
example: 1.2.2.2
authPort:
maximum: 65535
minimum: 0
type: integer
description: Authentication Port
format: int32
example: 1812
default: 1812
priority:
maximum: 7
minimum: 0
type: integer
description: Priority
format: int32
example: 1
default: 0
secretKey:
pattern: ^(?:\$CRYPT\$.{17}|(?!(?:\$CRYPT\$)).{1,128})$
type: string
description: Secret key
example: password
tag:
maxLength: 16
minLength: 4
pattern: ^[a-zA-Z0-9\-_]*$
type: string
description: Reference tag/name for the server
example: radius-server1
vpn:
type: integer
description: VPN ID
format: int32
example: 0
enum:
- 0
- 512
default: 0
description: Configure the RADIUS server
$$ref: '#/components/schemas/ControlComponentAaaRadiusServer'
timeout:
maximum: 1000
minimum: 1
type: integer
description: Configure how long to wait for replies from the RADIUS server
format: int32
example: 5
default: 5
description: Radius configuration
$$ref: '#/components/schemas/Radius'
examples:
RADIUS Configuration Update:
description: RADIUS Configuration Update
value:
timeout: 10
retransmit: 5
server:
- address: 192.168.1.100
authPort: 1812
acctPort: 1813
sourceVpn: 0
vpn: 0
vpnIpSubnet: 192.168.1.0/24
key: radius-key
secretKey: updated-secret
priority: 1
- address: 192.168.1.101
authPort: 1812
acctPort: 1813
sourceVpn: 0
vpn: 0
vpnIpSubnet: 192.168.2.0/24
key: radius-key-2
secretKey: backup-secret
priority: 2
required: true
responses:
'200':
description: Success
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
get:
tags:
- Administration - User and Group
description: 'Get radius configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: getRadiusConfig
responses:
'200':
description: Ok
content:
application/json:
schema:
type: object
properties:
retransmit:
maximum: 1000
minimum: 1
type: integer
description: Configure how many times to contact each RADIUS server
format: int32
example: 3
default: 3
server:
maxItems: 8
minItems: 0
type: array
description: RADIUS server configuration
items:
required:
- address
- secretKey
type: object
properties:
acctPort:
maximum: 65535
minimum: 0
type: integer
description: Accounting Port
format: int32
example: 1813
default: 1813
address:
pattern: (^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$)|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))
type: string
description: Set IP address of RADIUS server
example: 1.2.2.2
authPort:
maximum: 65535
minimum: 0
type: integer
description: Authentication Port
format: int32
example: 1812
default: 1812
priority:
maximum: 7
minimum: 0
type: integer
description: Priority
format: int32
example: 1
default: 0
secretKey:
pattern: ^(?:\$CRYPT\$.{17}|(?!(?:\$CRYPT\$)).{1,128})$
type: string
description: Secret key
example: password
tag:
maxLength: 16
minLength: 4
pattern: ^[a-zA-Z0-9\-_]*$
type: string
description: Reference tag/name for the server
example: radius-server1
vpn:
type: integer
description: VPN ID
format: int32
example: 0
enum:
- 0
- 512
default: 0
description: Configure the RADIUS server
$$ref: '#/components/schemas/ControlComponentAaaRadiusServer'
timeout:
maximum: 1000
minimum: 1
type: integer
description: Configure how long to wait for replies from the RADIUS server
format: int32
example: 5
default: 5
description: Radius configuration
$$ref: '#/components/schemas/Radius'
examples:
RADIUS Configuration Response:
description: RADIUS Configuration Response
value:
timeout: 5
retransmit: 3
server:
- address: 192.168.1.100
authPort: 1812
acctPort: 1813
sourceVpn: 0
vpn: 0
vpnIpSubnet: 192.168.1.0/24
key: radius-key
secretKey: shared-secret
priority: 1
'400':
description: Bad Request
'403':
description: Forbidden
'500':
description: Internal Server Error
/admin/tacacs:
delete:
tags:
- Administration - User and Group
description: 'Delete tacacs configuration<br><br><br>Note: In a multitenant vManage system, this API is only available in the Provider and Provider-As-Tenant view.'
operationId: deleteTacacsConfig
responses:
'200':
description: Ok
content:
application/json:
schema:
type: object
properties:
authentication:
type: string
description: TACACS authentication type
enum:
- pap
# --- truncated at 32 KB (73 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-catalyst-sdwan/refs/heads/main/openapi/cisco-catalyst-sdwan-administration-user-and-group-api-openapi.yml