openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2604.1.1**
>
> Date: **May 13, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs SSO API
version: 2604.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
csrfToken: []
tags:
- description: 'Org SSO, or Single Sign-On, is a method of authentication that allows users to securely log in to multiple applications and websites with a single set of login credentials.
It involves integrating the Org portal with an Identity Provider (IdP) using the Security Assertion Markup Language (SAML) framework.
This enables users to authenticate themselves through their corporate IdP, eliminating the need to remember separate passwords or enter credentials each time they access the Org portal.'
name: Orgs SSO
paths:
/api/v1/orgs/{org_id}/ssos:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Get List of Org SSO Configuration
operationId: listOrgSsos
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/SsosArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgSsos
tags:
- Orgs SSO
post:
description: Create Org SSO Configuration
operationId: createOrgSso
requestBody:
content:
application/json:
examples:
Example:
value:
custom_logout_url: string
idp_cert: string
idp_sign_algo: sha256
idp_sso_url: string
ignore_unmatched_roles: true
issuer: string
name: string
nameid_format: email
schema:
$ref: '#/components/schemas/sso'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Sso'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgSso
tags:
- Orgs SSO
/api/v1/orgs/{org_id}/ssos/{sso_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/sso_id'
delete:
description: Delete Org SSO Configuration
operationId: deleteOrgSso
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgSso
tags:
- Orgs SSO
get:
description: Get Org SSO Configuration Details
operationId: getOrgSso
responses:
'200':
$ref: '#/components/responses/Sso'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgSso
tags:
- Orgs SSO
put:
description: Update Org SSO Configuration
operationId: updateOrgSso
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/sso'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Sso'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgSso
tags:
- Orgs SSO
/api/v1/orgs/{org_id}/ssos/{sso_id}/delete_admins:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/sso_id'
post:
description: Delete SSO Admin users by email. This removes SSO-linked admin accounts from the organization.
operationId: deleteOrgSsoAdmins
requestBody:
content:
application/json:
examples:
Example:
value:
emails:
- john@abc.com
- may@abc.com
schema:
$ref: '#/components/schemas/sso_delete_admins'
description: Request Body
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/sso_delete_admins_response'
description: OK
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgSsoAdmins
tags:
- Orgs SSO
/api/v1/orgs/{org_id}/ssos/{sso_id}/failures:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/sso_id'
get:
description: Get List of Org SSO Latest Failures
operationId: listOrgSsoLatestFailures
parameters:
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/SsoLatestFailures'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgSsoLatestFailures
tags:
- Orgs SSO
/api/v1/orgs/{org_id}/ssos/{sso_id}/metadata:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/sso_id'
get:
description: Get Org SAML Metadata
operationId: getOrgSamlMetadata
responses:
'200':
$ref: '#/components/responses/SamlMetadata'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgSamlMetadata
tags:
- Orgs SSO
/api/v1/orgs/{org_id}/ssos/{sso_id}/metadata.xml:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/sso_id'
get:
description: "Download Org SAML Metadata\n\nExample of metadata.xml:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" validUntil=\"2027-10-12T21:59:01Z\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n <md:SPSSODescriptor AuthnRequestsSigned=\"false\" WantAssertionsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n <md:SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/logout\" />\n <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n <md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" index=\"0\" isDefault=\"true\"/>\n <md:AttributeConsumingService index=\"0\">\n <md:ServiceName xml:lang=\"en-US\">Mist</md:ServiceName>\n <md:RequestedAttribute Name=\"Role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"true\"/>\n <md:RequestedAttribute Name=\"FirstName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n <md:RequestedAttribute Name=\"LastName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n </md:AttributeConsumingService>\n </md:SPSSODescriptor>\n</md:EntityDescriptor>\n```"
operationId: downloadOrgSamlMetadata
responses:
'200':
$ref: '#/components/responses/File'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: downloadOrgSamlMetadata
tags:
- Orgs SSO
components:
schemas:
sso_oauth_type:
default: azure
description: 'if `idp_type`==`oauth`. enum: `azure`, `azure-gov`, `okta`, `ping_identity`'
enum:
- azure
- azure-gov
- okta
- ping_identity
type: string
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
sso_mxedge_proxy_auth_server:
additionalProperties: false
properties:
host:
examples:
- 1.2.3.4
type: string
port:
default: 1812
type: integer
require_message_authenticator:
default: false
description: Whether to require Message-Authenticator in requests
type: boolean
retry:
default: 2
description: Authentication request retry
type: integer
secret:
examples:
- testing123
format: password
type: string
timeout:
default: 5
description: Authentication request timeout, in seconds
type: integer
type: object
response_sso_failure_search:
additionalProperties: false
properties:
results:
$ref: '#/components/schemas/response_sso_failure_search_results'
required:
- results
type: object
sso_mxedge_proxy_ssids:
description: SSIDs that support eduroam
examples:
- - eduroam_test, eduroam_main
items:
default: eduroam
type: string
type: array
response_http403:
additionalProperties: false
properties:
detail:
examples:
- You do not have permission to perform this action.
type: string
type: object
sso_ldap_type:
default: azure
description: 'if `idp_type`==`ldap`. enum: `azure`, `custom`, `google`, `okta`, `ping_identity`'
enum:
- azure
- custom
- google
- okta
type: string
sso_openroaming:
additionalProperties: false
description: if `idp_type`==`openroaming`
properties:
ssids:
$ref: '#/components/schemas/sso_openroaming_ssids'
wba_cert:
description: Optional WBA-issued certificate. If not provided, the default WBA-issued certificate for Juniper will be used.
examples:
- '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
type: string
required:
- ssids
type: object
oauth_provider_domain:
default: okta.com
description: 'If `oauth_type`==`okta`, specifies the region-specific OAuth provider domain. enum: `okta.com`, `oktapreview.com`, `okta-emea.com`, `okta-gov.com`, `okta.mil`, `mtls.okta.com`'
enum:
- okta.com
- oktapreview.com
- okta-emea.com
- okta-gov.com
- okta.mil
- mtls.okta.com
examples:
- okta.com
type: string
sso_mxedge_proxy_acct_servers:
items:
$ref: '#/components/schemas/sso_mxedge_proxy_acct_server'
type: array
sso_idp_type:
default: saml
description: "SSO IDP Type:\n * For Admin SSO, enum: `saml`\n * For NAC SSO, enum: `ldap`, `mxedge_proxy`, `oauth`, `openroaming`"
enum:
- ldap
- mxedge_proxy
- oauth
- saml
- openroaming
type: string
saml_metadata:
additionalProperties: false
properties:
acs_url:
description: If `idp_type`==`saml`
examples:
- https://api.mist.com/api/v1/saml/llDfa13f/login
readOnly: true
type: string
entity_id:
description: If `idp_type`==`saml`
examples:
- https://api.mist.com/api/v1/saml/llDfa13f/login
readOnly: true
type: string
logout_url:
description: If `idp_type`==`saml`
examples:
- https://api.mist.com/api/v1/saml/llDfa13f/logout
readOnly: true
type: string
metadata:
description: If `idp_type`==`saml`
examples:
- <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://api.mist.com/api/v1/saml/llDfa13f/login" validUntil="2027-10-12T21:59:01Z" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://api.mist.com/api/v1/saml/llDfa13f/login" index="0" isDefault="true"/></md:SPSSODescriptor></md:EntityDescriptor>
readOnly: true
type: string
scim_base_url:
description: If `idp_type`==`oauth` and `scim_enabled`==`true`
examples:
- https://scim.nac-staging.mistsys.com/S_41b2525a-e8b8-4809-8168-f1d8dcbe9735/azure/4d72b1dc-7503-4717-81ea-80d0125b886e
type: string
type: object
oauth_ping_identity_region:
default: us
description: 'enum: `us` (United States, default), `ca` (Canada), `eu` (Europe), `asia` (Asia), `au` (Australia)'
enum:
- asia
- au
- ca
- eu
- us
type: string
response_sso_failure_search_results:
items:
$ref: '#/components/schemas/response_sso_failure_search_item'
type: array
uniqueItems: true
site_id:
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
sso_idp_sign_algo:
description: 'Required if `idp_type`==`saml`, Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`'
enum:
- sha1
- sha256
- sha384
- sha512
type: string
response_http404:
additionalProperties: false
properties:
id:
type: string
type: object
sso_delete_admins_response:
additionalProperties: false
properties:
deleted:
description: List of email addresses that were successfully deleted
items:
type: string
type: array
errors:
description: List of error messages for emails that could not be deleted
items:
type: string
type: array
type: object
timestamp:
description: Epoch (seconds)
format: double
readOnly: true
type: number
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
response_sso_failure_search_item:
additionalProperties: false
properties:
detail:
type: string
saml_assertion_xml:
type: string
timestamp:
$ref: '#/components/schemas/timestamp'
required:
- timestamp
- detail
- saml_assertion_xml
type: object
sso:
description: SSO
properties:
created_time:
$ref: '#/components/schemas/created_time'
custom_logout_url:
description: If `idp_type`==`saml`, a URL we will redirect the user after user logout from Mist (for some IdP which supports a custom logout URL that is different from SP-initiated SLO process)
type: string
default_role:
description: If `idp_type`==`saml`, default role to assign if there’s no match. By default, an assertion is treated as invalid when there’s no role matched
type: string
domain:
description: "Random string generated during the SSO creation and used to generate the SAML URLs:\n * ACS URL = `/api/v1/saml/{domain}/login` (e.g. `https://api.mist.com/api/v1/saml/s4t5vwv8/login`)\n * Single Logout URL = `/api/v1/saml/{domain}/logout` (e.g. `https://api.mist.com/api/v1/saml/s4t5vwv8/logout`)"
readOnly: true
type: string
group_filter:
description: Required if `ldap_type`==`custom`, LDAP filter that will identify the type of group
type: string
id:
$ref: '#/components/schemas/id'
idp_cert:
description: If `idp_type`==`saml`. IDP Cert (used to verify the signed response)
type: string
idp_sign_algo:
$ref: '#/components/schemas/sso_idp_sign_algo'
idp_sso_url:
description: Required if `idp_type`==`saml`, IDP Single-Sign-On URL
type: string
idp_type:
$ref: '#/components/schemas/sso_idp_type'
ignore_unmatched_roles:
description: If `idp_type`==`saml`, ignore any unmatched roles provided in assertion. By default, an assertion is treated as invalid for any unmatched role
type: boolean
issuer:
description: If `idp_type`==`saml`. IDP issuer URL
type: string
ldap_base_dn:
description: Required if `idp_type`==`ldap`, whole domain or a specific organization unit (container) in Search base to specify where users and groups are found in the LDAP tree
examples:
- DC=abc,DC=com
type: string
ldap_bind_dn:
description: Required if `idp_type`==`ldap`, the account used to authenticate against the LDAP
examples:
- CN=nas,CN=users,DC=abc,DC=com
type: string
ldap_bind_password:
description: Required if `idp_type`==`ldap`, the password used to authenticate against the LDAP
examples:
- secret
type: string
ldap_cacerts:
$ref: '#/components/schemas/sso_ldap_ca_certs'
ldap_client_cert:
description: If `idp_type`==`ldap`, LDAPS Client certificate
examples:
- '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
type: string
ldap_client_key:
description: If `idp_type`==`ldap`, Key for the `ldap_client_cert`
examples:
- '-----BEGIN PRI...'
type: string
ldap_group_attr:
default: memberOf
description: If `ldap_type`==`custom`
type: string
ldap_group_dn:
default: base_dn
description: If `ldap_type`==`custom`
type: string
ldap_resolve_groups:
default: false
description: If `idp_type`==`ldap`, whether to recursively resolve LDAP groups
type: boolean
ldap_server_hosts:
$ref: '#/components/schemas/sso_ldap_server_hosts'
ldap_type:
$ref: '#/components/schemas/sso_ldap_type'
ldap_user_filter:
description: Required if `ldap_type`==`custom`, LDAP filter that will identify the type of user
examples:
- (mail=%s)
type: string
member_filter:
description: Required if `ldap_type`==`custom`,LDAP filter that will identify the type of member
examples:
- (CN=%s)
type: string
modified_time:
$ref: '#/components/schemas/modified_time'
msp_id:
$ref: '#/components/schemas/msp_id'
mxedge_proxy:
$ref: '#/components/schemas/sso_mxedge_proxy'
name:
description: Name
type: string
nameid_format:
$ref: '#/components/schemas/sso_nameid_format'
oauth_cc_client_id:
description: Required if `idp_type`==`oauth`, Client Credentials
examples:
- e60da615-7def-4c5a-8196-43675f45e174
type: string
oauth_cc_client_secret:
description: Required if `idp_type`==`oauth`, oauth_cc_client_secret is RSA private key, of the form "-----BEGIN RSA PRIVATE KEY--...."
examples:
- REDACTED_EXAMPLE_OAUTH_CLIENT_SECRET
format: password
type: string
oauth_discovery_url:
description: If `idp_type`==`oauth`
type: string
oauth_ping_identity_region:
$ref: '#/components/schemas/oauth_ping_identity_region'
oauth_provider_domain:
$ref: '#/components/schemas/oauth_provider_domain'
oauth_ropc_client_id:
description: If `idp_type`==`oauth`, ropc = Resource Owner Password Credentials
examples:
- 9ce04c97-b5b1-4ec8-af17-f5ed42d2daf7
type: string
oauth_ropc_client_secret:
description: If `oauth_type`==`azure` or `oauth_type`==`azure-gov`. oauth_ropc_client_secret can be empty
examples:
- blM9R~6kWFMVFYl4TFZ3fi~8cMdyDONi6cj01dqI
format: password
type: string
oauth_tenant_id:
description: Required if `idp_type`==`oauth`, oauth_tenant_id
examples:
- dev-88336535
type: string
oauth_type:
$ref: '#/components/schemas/sso_oauth_type'
openroaming:
$ref: '#/components/schemas/sso_openroaming'
org_id:
$ref: '#/components/schemas/org_id'
role_attr_extraction:
description: If `idp_type`==`saml`, custom role attribute parsing scheme. Supported Role Parsing Schemes <table><tr><th>Name</th><th>Scheme</th></tr><tr><td>`cn`</td><td><ul><li>The expected role attribute format in SAML Assertion is "CN=cn,OU=ou1,OU=ou2,…"</li><li>CN (the key) is case-insensitive and exactly 1 CN is expected (or the entire entry will be ignored)</li></ul>E.g. if role attribute is "CN=cn,OU=ou1,OU=ou2" then parsed role value is "cn"</td></tr></table>
type: string
role_attr_from:
default: Role
description: If `idp_type`==`saml`, name of the attribute in SAML Assertion to extract role from
type: string
scim_enabled:
default: false
description: If `idp_type`==`oauth`, indicates if SCIM provisioning is enabled for the OAuth IDP
type: boolean
scim_secret_token:
default: ''
description: If `idp_type`==`oauth`, scim_secret_token (auto-generated when not provided by caller and `scim_enabled`==`true`, empty string when `scim_enabled`==`false`) is used as the Bearer token in the Authorization header of SCIM provisioning requests by the IDP
examples:
- FBitbKPE1aecSloPGBuqqPxDUrFeZyZk
format: password
type: string
site_id:
$ref: '#/components/schemas/site_id'
required:
- name
type: object
sso_openroaming_ssids:
description: SSIDs that support OpenRoaming
examples:
- - ssid_name1
- ssid_name2
items:
type: string
type: array
response_http400:
additionalProperties: false
properties:
detail:
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
ssos:
items:
$ref: '#/components/schemas/sso'
type: array
sso_mxedge_proxy_proxy_hosts:
description: Public hostname/IPs
examples:
- - mxedge1.corp.com
- 63.1.3.5
items:
type: string
type: array
sso_mxedge_proxy_acct_server:
additionalProperties: false
properties:
host:
examples:
- 1.2.3.4
type: string
port:
default: 1813
type: integer
secret:
examples:
- testing123
format: password
type: string
type: object
sso_nameid_format:
default: email
description: 'if `idp_type`==`saml`. enum: `email`, `unspecified`'
enum:
- email
- unspecified
type: string
response_http429:
additionalProperties: false
properties:
detail:
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
sso_mxedge_proxy:
additionalProperties: false
description: If `idp_type`==`mxedge_proxy`, this requires `mist_nac` to be enabled on the mxcluster
properties:
acct_servers:
$ref: '#/components/schemas/sso_mxedge_proxy_acct_servers'
auth_servers:
$ref: '#/components/schemas/sso_mxedge_proxy_auth_servers'
mxcluster_id:
examples:
- 572586b7-f97b-a22b-526c-8b97a3f609c4
format: uuid
type: string
operator_name:
description: Operator name as Radius attribute while proxying
type: string
proxy_hosts:
$ref: '#/components/schemas/sso_mxedge_proxy_proxy_hosts'
ssids:
$ref: '#/components/schemas/sso_mxedge_proxy_ssids'
type: object
msp_id:
examples:
- b9d42c2e-88ee-41f8-b798-f009ce7fe909
format: uuid
readOnly: true
type: string
sso_delete_admins:
additionalProperties: false
properties:
emails:
description: List of admin email addresses to delete
items:
type: string
type: array
required:
- emails
type: object
sso_ldap_ca_certs:
description: Required if `idp_type`==`ldap`, list of CA certificates to validate the LDAP certificate
examples:
- - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
- '-----BEGIN CERTIFICATE-----\nBhMCRVMxFDASBgNVBAoMC1N0YXJ0Q29tIENBMSwwKgYDVn-----END CERTIFICATE-----'
items:
type: string
type: array
response_http401:
additionalProperties: false
properties:
detail:
examples:
- Authentication credentials were not provided.
type: string
type: object
org_id:
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
sso_mxedge_proxy_auth_servers:
items:
$ref: '#/components/schemas/sso_mxedge_proxy_auth_server'
type: array
sso_ldap_server_hosts:
description: If `idp_type`==`ldap`, list of LDAP/LDAPS server IP Addresses or Hostnames
examples:
- - hostname
- 63.1.3.5
items:
type: string
type: array
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
parameters:
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
start:
description: Start time (epoch timestamp in seconds, or relative string like "-1d", "-1w")
in: query
name: start
schema:
type: string
duration:
description: Duration like 7d, 2w
in: query
name: duration
schema:
default: 1d
examples:
- 10m
type: string
page:
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
end:
description: End time (epoch timestamp in seconds, or relative string like "-1d", "-2h", "now")
in: query
name: end
schema:
type: string
sso_id:
in: path
name: sso_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
responses:
Sso:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/SsoExample'
schema:
$ref: '#/components/schemas/sso'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/SsoExample'
schema:
$ref: '#/components/schemas/sso'
description: OK
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
# --- truncated at 32 KB (39 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist-ai/refs/heads/main/openapi/mist-ai-orgs-sso-api-openapi.yml