Juniper Mist AI Orgs Logs API

openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs Logs API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: 'Audit Logs are records of activities initiated by users, providing a history of actions such as accessing, creating, updating, or deleting resources or components at the Org level.


    These logs allow superusers and network administrators to track and maintain a record of user actions, including who performed specific actions and when.


    Audit logs are useful for monitoring user activity, investigating security breaches, ensuring compliance with regulations, and tracing configuration changes in a network.


    They can be filtered and analyzed to view specific information and granular-level details of each event.'
  name: Orgs Logs
paths:
  /api/v1/orgs/{org_id}/logs:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      deprecated: true
      description: Get List of change logs for the current Org
      operationId: listOrgAuditLogsLegacy
      parameters:
      - description: Site id
        in: query
        name: site_id
        schema:
          examples:
          - 4ac1dcf4-9d8b-7211-65c4-057819f0862b
          format: uuid
          type: string
      - description: Admin name or email
        in: query
        name: admin_name
        schema:
          examples:
          - John Doe
          type: string
      - description: Message
        in: query
        name: message
        schema:
          examples:
          - Created a new site
          type: string
      - description: Sort order
        in: query
        name: sort
        schema:
          $ref: '#/components/schemas/list_org_logs_sort'
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/LogsSearch'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgAuditLogsLegacy
      tags:
      - Orgs Logs
  /api/v1/orgs/{org_id}/logs/count:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Count by Distinct Attributes of Audit Logs
      operationId: countOrgAuditLogs
      parameters:
      - in: query
        name: distinct
        schema:
          $ref: '#/components/schemas/org_logs_count_distinct'
      - in: query
        name: admin_id
        schema:
          examples:
          - 4ac1dcf4-9d8b-7211-65c4-057819f0862b
          format: uuid
          type: string
      - in: query
        name: admin_name
        schema:
          examples:
          - John Doe
          type: string
      - in: query
        name: site_id
        schema:
          examples:
          - 4ac1dcf4-9d8b-7211-65c4-057819f0862b
          format: uuid
          type: string
      - in: query
        name: message
        schema:
          examples:
          - Created a new site
          type: string
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      responses:
        '200':
          $ref: '#/components/responses/Count'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: countOrgAuditLogs
      tags:
      - Orgs Logs
  /api/v1/orgs/{org_id}/logs/search:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get a list of change logs for the current Org
      operationId: listOrgAuditLogs
      parameters:
      - description: Site id
        in: query
        name: site_id
        schema:
          examples:
          - 4ac1dcf4-9d8b-7211-65c4-057819f0862b
          format: uuid
          type: string
      - description: Admin name or email
        in: query
        name: admin_name
        schema:
          examples:
          - John Doe
          type: string
      - description: Message
        in: query
        name: message
        schema:
          examples:
          - Created a new site
          type: string
      - description: Sort order
        in: query
        name: sort
        schema:
          $ref: '#/components/schemas/list_org_logs_sort'
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/LogsSearch'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgAuditLogs
      tags:
      - Orgs Logs
components:
  schemas:
    list_org_logs_sort:
      description: 'enum: `-timestamp`, `admin_id`, `site_id`, `timestamp`'
      enum:
      - -timestamp
      - admin_id
      - site_id
      - timestamp
      type: string
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    response_count:
      additionalProperties: false
      properties:
        distinct:
          type: string
        end:
          type: integer
        limit:
          type: integer
        results:
          $ref: '#/components/schemas/count_results'
        start:
          type: integer
        total:
          type: integer
      required:
      - distinct
      - end
      - limit
      - results
      - start
      - total
      type: object
    log_events:
      items:
        $ref: '#/components/schemas/log_event'
      type: array
      uniqueItems: true
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    count_results:
      items:
        $ref: '#/components/schemas/count_result'
      type: array
      uniqueItems: true
    count_result:
      additionalProperties:
        type: string
      properties:
        count:
          type: integer
      required:
      - count
      type: object
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    timestamp:
      description: Epoch (seconds)
      format: double
      readOnly: true
      type: number
    org_logs_count_distinct:
      default: admin_name
      description: 'enum: `admin_id`, `admin_name`, `message`, `site_id`'
      enum:
      - admin_id
      - admin_name
      - message
      - site_id
      type: string
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    response_log_search:
      additionalProperties: false
      properties:
        end:
          type: integer
        limit:
          type: integer
        next:
          type: string
        results:
          $ref: '#/components/schemas/log_events'
        start:
          type: integer
        total:
          type: integer
      required:
      - end
      - limit
      - results
      - start
      - total
      type: object
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    log_event:
      additionalProperties: false
      properties:
        admin_id:
          description: admin id
          format: uuid
          readOnly: true
          type:
          - string
          - 'null'
        admin_name:
          description: Name of the admin that performs the action
          readOnly: true
          type:
          - string
          - 'null'
        after:
          additionalProperties: true
          description: field values after the change
          readOnly: true
          type: object
        before:
          additionalProperties: true
          description: field values prior to the change
          readOnly: true
          type: object
        device_id:
          description: Device id
          format: uuid
          readOnly: true
          type:
          - string
          - 'null'
        for_site:
          readOnly: true
          type: boolean
        id:
          $ref: '#/components/schemas/id'
        message:
          description: log message
          readOnly: true
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
        site_id:
          format: uuid
          readOnly: true
          type:
          - string
          - 'null'
        src_ip:
          description: sender source ip address
          type: string
        timestamp:
          $ref: '#/components/schemas/timestamp'
      required:
      - message
      - org_id
      - timestamp
      type: object
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
  examples:
    LogsSearchExample:
      value:
        end: 1428954000
        limit: 100
        results:
        - admin_id: 72bfa2bd-e58a-4670-9d20-a1468f7a6f58
          admin_name: test@mistsys.com
          id: c6f9347b-b0a4-4a23-b927-fa9249f2ffb2
          message: TEST AUDIT
          org_id: 2818e386-8dec-2562-9ede-5b8a0fbbdc71
          site_id: 4ac1dcf4-9d8b-7211-65c4-057819f0862b
          timestamp: 1431382121
        start: 1428939600
        total: 135
    CountExample:
      value:
        distinct: string
        end: 0
        limit: 0
        results:
        - count: 0
          property: string
        start: 0
        total: 0
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    start:
      description: Start time (epoch timestamp in seconds, or relative string like "-1d", "-1w")
      in: query
      name: start
      schema:
        type: string
    duration:
      description: Duration like 7d, 2w
      in: query
      name: duration
      schema:
        default: 1d
        examples:
        - 10m
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    end:
      description: End time (epoch timestamp in seconds, or relative string like "-1d", "-2h", "now")
      in: query
      name: end
      schema:
        type: string
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  responses:
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    LogsSearch:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/LogsSearchExample'
          schema:
            $ref: '#/components/schemas/response_log_search'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/LogsSearchExample'
          schema:
            $ref: '#/components/schemas/response_log_search'
      description: OK
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
    Count:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/CountExample'
          schema:
            $ref: '#/components/schemas/response_count'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/CountExample'
          schema:
            $ref: '#/components/schemas/response_count'
      description: Result of Count
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey