Juniper Mist AI Orgs NAC Rules API

openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2604.1.1**

    >

    > Date: **May 13, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs NAC Rules API
  version: 2604.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
  csrfToken: []
tags:
- description: 'The NAC Rules (or Auth Policies) are a set of rules that devices and users must fulfill in order to gain access to the network and use network resources.


    Juniper Mist Access Assurance evaluates authentication requests based on the specified policy conditions. If a user or device satisfies the conditions, Mist Access Assurance applies actions that either allow or deny access to the user or device.


    These actions can also apply attributes such as VLAN and role to the allowed users. Mist Access Assurance uses "NAC Tags" (or Auth Policy Labels) as the policy matching criteria and as a policy action for allowed users. NAC Tags can be managed with the [Orgs NAC Tags API Calls]($h/Orgs%20NAC%20Tags/_overview)'
  name: Orgs NAC Rules
paths:
  /api/v1/orgs/{org_id}/nacrules:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Get List of Org NAC Rules
      operationId: listOrgNacRules
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/NacRulesArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacRules
      tags:
      - Orgs NAC Rules
    post:
      description: Create Org NAC Rule
      operationId: createOrgNacRule
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  action: allow
                  apply_tags:
                  - c049dfcd-0c73-5014-1c64-062e9903f1e5"
                  matching:
                    auth_type: eap-tls
                    nactags:
                    - 041d5d36-716c-4cfb-4988-3857c6aa14a2
                    - a809a97f-d599-f812-eb8c-c3f84aabf6ba
                    port_types:
                    - wired
                    site_ids:
                    - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
                    - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
                    sitegroup_ids:
                    - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
                    - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
                  name: name1
                  not_matching: {}
                  order: 1
            schema:
              $ref: '#/components/schemas/nac_rule'
      responses:
        '200':
          $ref: '#/components/responses/NacRule'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgNacRule
      tags:
      - Orgs NAC Rules
  /api/v1/orgs/{org_id}/nacrules/{nacrule_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacrule_id'
    delete:
      description: Delete Org NAC Rule
      operationId: deleteOrgNacRule
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacRule
      tags:
      - Orgs NAC Rules
    get:
      description: Get Org NAC Rule
      operationId: getOrgNacRule
      responses:
        '200':
          $ref: '#/components/responses/NacRule'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacRule
      tags:
      - Orgs NAC Rules
    put:
      description: Update Org NAC Rule
      operationId: updateOrgNacRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_rule'
      responses:
        '200':
          $ref: '#/components/responses/NacRule'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacRule
      tags:
      - Orgs NAC Rules
components:
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    nac_rule_matching:
      additionalProperties: false
      properties:
        auth_type:
          $ref: '#/components/schemas/nac_auth_type'
        family:
          $ref: '#/components/schemas/nac_rule_matching_family'
        mfg:
          $ref: '#/components/schemas/nac_rule_matching_model'
        model:
          $ref: '#/components/schemas/nac_rule_matching_mfg'
        nactags:
          $ref: '#/components/schemas/nac_rule_matching_nactags'
        os_type:
          $ref: '#/components/schemas/nac_rule_matching_os_type'
        port_types:
          $ref: '#/components/schemas/nac_rule_matching_port_types'
        site_ids:
          $ref: '#/components/schemas/nac_rule_matching_site_ids'
        sitegroup_ids:
          $ref: '#/components/schemas/nac_rule_matching_sitegroup_ids'
        vendor:
          $ref: '#/components/schemas/nac_rule_matching_vendor'
      type: object
    response_http403:
      additionalProperties: false
      properties:
        detail:
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    nac_rule_matching_sitegroup_ids:
      description: List of sitegroup ids to match
      examples:
      - - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
        - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
      items:
        format: uuid
        type: string
      type: array
    response_http404:
      additionalProperties: false
      properties:
        id:
          type: string
      type: object
    nac_rule_matching_os_type:
      description: List of client device os types to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed os_type values
      items:
        type: string
      type: array
    nac_rule_action:
      description: 'enum: `allow`, `block`'
      enum:
      - allow
      - block
      examples:
      - allow
      type: string
    response_http400:
      additionalProperties: false
      properties:
        detail:
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    nac_rule_matching_vendor:
      description: List of vendors to match
      items:
        examples:
        - cisc
        type: string
      type: array
    nac_rule_matching_port_type:
      description: 'enum: `wired`, `wireless`'
      enum:
      - wired
      - wireless
      type: string
    nac_rule_matching_nactags:
      examples:
      - - 041d5d36-716c-4cfb-4988-3857c6aa14a2
        - a809a97f-d599-f812-eb8c-c3f84aabf6ba
      items:
        type: string
      type: array
    nac_rules:
      items:
        $ref: '#/components/schemas/nac_rule'
      type: array
    nac_rule_matching_mfg:
      description: List of client device manufacturers to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed mfg values
      items:
        type: string
      type: array
    response_http429:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    nac_rule_matching_port_types:
      examples:
      - - wired
      items:
        $ref: '#/components/schemas/nac_rule_matching_port_type'
      type: array
    nac_rule_matching_site_ids:
      description: List of site ids to match
      examples:
      - - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
        - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
      items:
        format: uuid
        type: string
      type: array
    nac_rule_matching_family:
      description: List of client device families to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed family values
      items:
        type: string
      type: array
    nac_rule_apply_tags:
      description: All optional, this goes into Access-Accept
      examples:
      - - c049dfcd-0c73-5014-1c64-062e9903f1e5
      items:
        type: string
      type: array
    nac_auth_type:
      description: 'enum: `cert`, `device-auth`, `eap-teap`, `eap-tls`, `eap-ttls`, `idp`, `mab`, `eap-peap`'
      enum:
      - cert
      - device-auth
      - eap-teap
      - eap-tls
      - eap-ttls
      - idp
      - mab
      - eap-peap
      examples:
      - eap-tls
      type: string
    nac_rule_guest_auth_state:
      description: 'Guest portal authorization state. enum: `authorized`, `unknown`'
      enum:
      - authorized
      - unknown
      examples:
      - authorized
      type: string
    nac_rule:
      properties:
        action:
          $ref: '#/components/schemas/nac_rule_action'
        apply_tags:
          $ref: '#/components/schemas/nac_rule_apply_tags'
        created_time:
          $ref: '#/components/schemas/created_time'
        enabled:
          default: true
          description: Enabled or not
          type: boolean
        guest_auth_state:
          $ref: '#/components/schemas/nac_rule_guest_auth_state'
        id:
          $ref: '#/components/schemas/id'
        matching:
          $ref: '#/components/schemas/nac_rule_matching'
        modified_time:
          $ref: '#/components/schemas/modified_time'
        name:
          type: string
        not_matching:
          $ref: '#/components/schemas/nac_rule_matching'
        order:
          description: Order of the rule, lower value implies higher priority
          examples:
          - 1
          minimum: 0
          type: integer
        org_id:
          $ref: '#/components/schemas/org_id'
      required:
      - action
      - name
      type: object
    response_http401:
      additionalProperties: false
      properties:
        detail:
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    org_id:
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    nac_rule_matching_model:
      description: List of client device models to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed model values
      items:
        type: string
      type: array
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    nacrule_id:
      in: path
      name: nacrule_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    page:
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    limit:
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  responses:
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    NacRule:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/nac_rule'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/nac_rule'
      description: Example response
    NacRulesArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/NacRulesArrayExample'
          schema:
            $ref: '#/components/schemas/nac_rules'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/NacRulesArrayExample'
          schema:
            $ref: '#/components/schemas/nac_rules'
      description: Example response
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    OK:
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    NacRulesArrayExample:
      value:
      - action: allow
        apply_tags:
        - string
        created_time: 0
        id: 455f6eca-6276-4993-bfeb-53cbbbba6208
        matching:
          auth_type: eap-tls
          nactags:
          - string
          port_types:
          - wireless
          site_ids:
          - 454f6eca-6276-4993-bfeb-53cbbbba6308
          sitegroup_ids:
          - 453f6eca-6276-4993-bfeb-53cbbbba6408
        modified_time: 0
        name: string
        not_matching:
          auth_type: eap-tls
          nactags:
          - string
          port_types:
          - wireless
          site_ids:
          - 452f6eca-6276-4993-bfeb-53cbbbba6508
          sitegroup_ids:
          - 451f6eca-6276-4993-bfeb-53cbbbba6608
        order: 1
        org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
  securitySchemes:
    apiToken:
      description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n  API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
      scheme: basic
      type: http
    csrfToken:
      description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
      in: header
      name: X-CSRFToken
      type: apiKey