SSO roles refer to the different functions assigned to users within a Single Sign-On (SSO) system. These roles determine the tasks and actions that users can perform within the SSO system. There are typically predefined roles and custom roles in an SSO system. Roles in SSO provide a well-defined separation of responsibility and visibility, allowing for granular-level access control on SSO objects.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2604.1.1**
>
> Date: **May 13, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs SSO Roles API
version: 2604.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
csrfToken: []
tags:
- description: 'SSO roles refer to the different functions assigned to users within a Single Sign-On (SSO) system.
These roles determine the tasks and actions that users can perform within the SSO system. There are typically predefined roles and custom roles in an SSO system.
Roles in SSO provide a well-defined separation of responsibility and visibility, allowing for granular-level access control on SSO objects.'
name: Orgs SSO Roles
paths:
/api/v1/orgs/{org_id}/ssoroles:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Get List of Org SSO Roles
operationId: listOrgSsoRoles
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/SsoRolesOrgArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgSsoRoles
tags:
- Orgs SSO Roles
post:
description: Create Org SSO Role
operationId: createOrgSsoRole
requestBody:
content:
application/json:
examples:
Example:
value:
name: string
privileges:
- org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
- role: read
scope: site
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
- org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: read
scope: sitegroup
sitegroup_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
schema:
$ref: '#/components/schemas/sso_role_org'
description: Request Body
responses:
'200':
$ref: '#/components/responses/SsoRoleOrg'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgSsoRole
tags:
- Orgs SSO Roles
/api/v1/orgs/{org_id}/ssoroles/{ssorole_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/ssorole_id'
delete:
description: Delete Org SSO Role
operationId: deleteOrgSsoRole
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgSsoRole
tags:
- Orgs SSO Roles
get:
description: Get Org SSO Role Details
operationId: getOrgSsoRole
responses:
'200':
$ref: '#/components/responses/SsoRoleOrg'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgSsoRole
tags:
- Orgs SSO Roles
put:
description: Update Org SSO Role
operationId: updateOrgSsoRole
requestBody:
content:
application/json:
examples:
Example:
value:
name: string
privileges:
- org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
- role: read
scope: site
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
- org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: read
scope: sitegroup
sitegroup_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
schema:
$ref: '#/components/schemas/sso_role_org'
description: Request Body
responses:
'200':
$ref: '#/components/responses/SsoRoleOrg'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgSsoRole
tags:
- Orgs SSO Roles
components:
examples:
SsoRoleOrgExample:
value:
created_time: 0
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
modified_time: 0
msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
privileges:
- role: admin
scope: sitegroup
sitegroup_id: 6f4bf402-45f9-2a56-6c8b-7f83d3bc98e9
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401Example:
value:
detail: Authentication credentials were not provided.
schemas:
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
sso_role_org:
description: SSO Role response
properties:
created_time:
$ref: '#/components/schemas/created_time'
for_site:
readOnly: true
type: boolean
id:
$ref: '#/components/schemas/id'
modified_time:
$ref: '#/components/schemas/modified_time'
msp_id:
$ref: '#/components/schemas/msp_id'
name:
type: string
org_id:
examples:
- 60f6bfdb-2f45-4022-8e2a-e00d977953fe
format: uuid
type: string
privileges:
$ref: '#/components/schemas/sso_role_org_privileges'
required:
- name
- privileges
type: object
admin_privilege_views:
description: "Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. \nYou can define custom roles by adding the `views` attribute along with `role` when assigning privileges. \nBelow are the list of supported UI views. Note that this is UI only feature. \n\n | UI View | Required Role | Description |\n | --- | --- | --- |\n | `reporting` | `read` | full access to all analytics tools |\n | `marketing` | `read` | can view analytics and location maps |\n | `super_observer` | `read` | can view all the organization except the subscription page |\n | `location` | `write` | can view and manage location maps, can view analytics |\n | `security` | `write` | can view and manage site labels, policies and security |\n | `switch_admin` | `helpdesk` | can view and manage Switch ports, can view wired clients |\n | `mxedge_admin` | `admin` | can view and manage Mist edges and Mist tunnels |\n | `lobby_admin` | `admin` | full access to Org and Site Pre-shared keys |"
items:
$ref: '#/components/schemas/admin_privilege_view'
type: array
privilege_org_role:
description: 'access permissions. enum: `admin`, `helpdesk`, `installer`, `read`, `write`'
enum:
- admin
- helpdesk
- installer
- read
- write
type: string
response_http403:
additionalProperties: false
properties:
detail:
examples:
- You do not have permission to perform this action.
type: string
type: object
sso_roles_org:
items:
$ref: '#/components/schemas/sso_role_org'
type: array
response_http404:
additionalProperties: false
properties:
id:
type: string
type: object
privilege_org_scope:
description: 'enum: `org`, `site`, `sitegroup`, `orgsites`'
enum:
- org
- site
- sitegroup
- orgsites
type: string
response_http400:
additionalProperties: false
properties:
detail:
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
response_http429:
additionalProperties: false
properties:
detail:
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
msp_id:
examples:
- b9d42c2e-88ee-41f8-b798-f009ce7fe909
format: uuid
readOnly: true
type: string
admin_privilege_view:
enum:
- lobby_admin
- location
- marketing
- mxedge_admin
- reporting
- security
- super_observer
- switch_admin
type: string
sso_role_org_privileges:
items:
$ref: '#/components/schemas/privilege_org'
minItems: 1
type: array
uniqueItems: true
privilege_org:
additionalProperties: false
description: Privileges settings
properties:
org_id:
description: If `scope`==`org`
format: uuid
readOnly: true
type: string
role:
$ref: '#/components/schemas/privilege_org_role'
scope:
$ref: '#/components/schemas/privilege_org_scope'
site_id:
description: If `scope`==`site`
format: uuid
type: string
sitegroup_id:
description: If `scope`==`sitegroup`
format: uuid
type: string
view:
deprecated: true
description: Used for backward compatibility. Use `views` instead.
type: string
views:
$ref: '#/components/schemas/admin_privilege_views'
required:
- role
- scope
type: object
response_http401:
additionalProperties: false
properties:
detail:
examples:
- Authentication credentials were not provided.
type: string
type: object
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
parameters:
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
page:
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
ssorole_id:
in: path
name: ssorole_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
responses:
SsoRolesOrgArray:
content:
application/json:
schema:
$ref: '#/components/schemas/sso_roles_org'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/sso_roles_org'
description: Example response
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
OK:
description: OK
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
SsoRoleOrg:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/SsoRoleOrgExample'
schema:
$ref: '#/components/schemas/sso_role_org'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/SsoRoleOrgExample'
schema:
$ref: '#/components/schemas/sso_role_org'
description: OK
securitySchemes:
apiToken:
description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
in: header
name: Authorization
type: apiKey
basicAuth:
description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
scheme: basic
type: http
csrfToken:
description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
in: header
name: X-CSRFToken
type: apiKey