Juniper Mist AI Sites Networks API
The API Endpoints for the Networks at the site level can be used to get the site derived networks, meaning the org level configuration with the site variables resolved.
OpenAPI Specification
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2604.1.1**
>
> Date: **May 13, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Sites Networks API
version: 2604.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
csrfToken: []
tags:
- description: The API Endpoints for the Networks at the site level can be used to get the site derived networks, meaning the org level configuration with the site variables resolved.
name: Sites Networks
paths:
/api/v1/sites/{site_id}/networks/derived:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Get the list of derived Networks for a Site
operationId: listSiteNetworksDerived
parameters:
- description: Whether resolve the site variables
in: query
name: resolve
schema:
default: false
type: boolean
responses:
'200':
$ref: '#/components/responses/NetworksArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listSiteNetworksDerived
tags:
- Sites Networks
components:
schemas:
network_vpn_access_destination_nat_property:
additionalProperties: false
properties:
internal_ip:
description: The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
examples:
- 192.168.70.30
type: string
name:
examples:
- web server
type: string
port:
examples:
- '443'
type: string
type: object
network_internet_access_destination_nat:
additionalProperties:
$ref: '#/components/schemas/network_internet_access_destination_nat_property'
description: Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internal_ip` or `port` must be defined
type: object
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
network_source_nat:
additionalProperties: false
description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub
properties:
external_ip:
examples:
- 172.16.0.8/30
type: string
type: object
network_tenant_addresses:
items:
description: The user/tenant IP Address (i.e. "192.168.70.30"), an Subnet (i.e. "192.168.70.0/24") or a Variable (i.e. "{{myvar}}")
examples:
- 192.168.70.30
type: string
type: array
network_tenant:
additionalProperties: false
properties:
addresses:
$ref: '#/components/schemas/network_tenant_addresses'
type: object
network_multicast_group:
additionalProperties: false
properties:
rp_ip:
description: RP (rendezvous point) IP Address
type: string
type: object
response_http403:
additionalProperties: false
properties:
detail:
examples:
- You do not have permission to perform this action.
type: string
type: object
network_internal_access:
additionalProperties: false
properties:
enabled:
type: boolean
type: object
network_internet_access:
additionalProperties: false
description: Whether this network has direct internet access
properties:
create_simple_service_policy:
default: false
type: boolean
destination_nat:
$ref: '#/components/schemas/network_internet_access_destination_nat'
enabled:
type: boolean
restricted:
default: false
description: By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies
type: boolean
static_nat:
$ref: '#/components/schemas/network_internet_access_static_nat'
type: object
network_multicast_groups:
additionalProperties:
$ref: '#/components/schemas/network_multicast_group'
description: Group address to RP (rendezvous point) mapping. Property Key is the CIDR (example "225.1.0.3/32")
type: object
network_internet_access_static_nat_property:
additionalProperties: false
properties:
internal_ip:
description: The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
examples:
- 192.168.70.3
type: string
name:
examples:
- pos_station-1
type: string
wan_name:
description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}")
examples:
- wan0
type: string
type: object
network_vpn_access_static_nat_property:
additionalProperties: false
properties:
internal_ip:
description: The Static NAT destination IP Address. Must be an IP Address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}")
examples:
- 192.168.70.3
type: string
name:
examples:
- pos_station-1
type: string
type: object
response_http404:
additionalProperties: false
properties:
id:
type: string
type: object
network_vpn_access_config:
additionalProperties: false
properties:
advertised_subnet:
description: If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side
examples:
- 172.16.0.0/24
type: string
allow_ping:
description: Whether to allow ping from vpn into this routed network
type: boolean
destination_nat:
$ref: '#/components/schemas/network_vpn_access_destination_nat'
nat_pool:
description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub
examples:
- 172.16.0.0/26
type: string
no_readvertise_to_lan_bgp:
default: false
description: toward LAN-side BGP peers
type: boolean
no_readvertise_to_lan_ospf:
default: false
description: toward LAN-side OSPF peers
type: boolean
no_readvertise_to_overlay:
description: toward overlay, how HUB should deal with routes it received from Spokes
type: boolean
other_vrfs:
$ref: '#/components/schemas/network_vpn_access_config_other_vrfs'
routed:
description: Whether this network is routable
type: boolean
source_nat:
$ref: '#/components/schemas/network_source_nat'
static_nat:
$ref: '#/components/schemas/network_vpn_access_static_nat'
summarized_subnet:
description: toward overlay, how HUB should deal with routes it received from Spokes
examples:
- 172.16.0.0/16
type: string
summarized_subnet_to_lan_bgp:
description: toward LAN-side BGP peers
examples:
- 172.16.0.0/16
type: string
summarized_subnet_to_lan_ospf:
description: toward LAN-side OSPF peers
examples:
- 172.16.0.0/16
type: string
type: object
network_vpn_access:
additionalProperties:
$ref: '#/components/schemas/network_vpn_access_config'
description: Property key is the VPN name. Whether this network can be accessed from vpn
type: object
network_routed_for_networks:
description: For a Network (usually LAN), it can be routable to other networks (e.g. OSPF)
items:
examples:
- pos
type: string
type: array
network_vpn_access_destination_nat:
additionalProperties:
$ref: '#/components/schemas/network_vpn_access_destination_nat_property'
description: Property key can be an External IP (i.e. "63.16.0.3"), an External IP:Port (i.e. "63.16.0.3:443"), an External Port (i.e. ":443"), an External CIDR (i.e. "63.16.0.0/30"), an External CIDR:Port (i.e. "63.16.0.0/30:443") or a Variable (i.e. "{{myvar}}"). At least one of the `internal_ip` or `port` must be defined
type: object
vlan_id_with_variable:
oneOf:
- type: string
- maximum: 4094
minimum: 1
type: integer
response_http400:
additionalProperties: false
properties:
detail:
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
network_internet_access_destination_nat_property:
additionalProperties: false
properties:
internal_ip:
description: The Destination NAT destination IP Address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}")
examples:
- 192.168.70.30
type: string
name:
examples:
- web server
type: string
port:
description: The Destination NAT destination IP Address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}")
examples:
- '443'
type: string
wan_name:
description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity
examples:
- wan0
type: string
type: object
network_vpn_access_static_nat:
additionalProperties:
$ref: '#/components/schemas/network_vpn_access_static_nat_property'
description: Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
type: object
networks:
items:
$ref: '#/components/schemas/network'
type: array
response_http429:
additionalProperties: false
properties:
detail:
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
network_tenants:
additionalProperties:
$ref: '#/components/schemas/network_tenant'
description: Property key must be the user/tenant name (i.e. "printer-1") or a Variable (i.e. "{{myvar}}")
type: object
network_vpn_access_config_other_vrfs:
description: By default, the routes are only readvertised toward the same vrf on spoke. To allow it to be leaked to other vrfs
items:
examples:
- iot
type: string
type: array
network:
description: Networks are usually subnets that have cross-site significance. `networks`in Org Settings will got merged into `networks`in Site Setting. For gateways, they can be used to define Service Routes.
properties:
created_time:
$ref: '#/components/schemas/created_time'
disallow_mist_services:
default: false
description: Whether to disallow Mist Devices in the network
type: boolean
gateway:
examples:
- 192.168.70.1
format: ipv4
type: string
gateway6:
examples:
- fdad:b0bc:f29e::1
format: ipv6
type: string
id:
$ref: '#/components/schemas/id'
internal_access:
$ref: '#/components/schemas/network_internal_access'
internet_access:
$ref: '#/components/schemas/network_internet_access'
isolation:
description: Whether to allow clients in the network to talk to each other
type: boolean
modified_time:
$ref: '#/components/schemas/modified_time'
multicast:
$ref: '#/components/schemas/network_multicast'
name:
type: string
org_id:
$ref: '#/components/schemas/org_id'
routed_for_networks:
$ref: '#/components/schemas/network_routed_for_networks'
subnet:
examples:
- 192.168.70.0/24
type: string
subnet6:
examples:
- fdad:b0bc:f29e::/32
type: string
tenants:
$ref: '#/components/schemas/network_tenants'
vlan_id:
$ref: '#/components/schemas/vlan_id_with_variable'
vpn_access:
$ref: '#/components/schemas/network_vpn_access'
required:
- name
type: object
network_multicast:
additionalProperties: false
description: Whether to enable multicast support (only PIM-sparse mode is supported)
properties:
disable_igmp:
default: false
description: If the network will only be the source of the multicast traffic, IGMP can be disabled
type: boolean
enabled:
default: false
type: boolean
groups:
$ref: '#/components/schemas/network_multicast_groups'
type: object
response_http401:
additionalProperties: false
properties:
detail:
examples:
- Authentication credentials were not provided.
type: string
type: object
org_id:
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
network_internet_access_static_nat:
additionalProperties:
$ref: '#/components/schemas/network_internet_access_static_nat_property'
description: Property key may be an External IP Address (i.e. "63.16.0.3"), a CIDR (i.e. "63.16.0.12/20") or a Variable (i.e. "{{myvar}}")
type: object
responses:
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
NetworksArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/NetworksArrayExample'
schema:
$ref: '#/components/schemas/networks'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/NetworksArrayExample'
schema:
$ref: '#/components/schemas/networks'
description: OK
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
examples:
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401Example:
value:
detail: Authentication credentials were not provided.
NetworksArrayExample:
value:
- created_time: 0
disallow_mist_services: false
gateway: 192.168.70.1
hosts:
property1:
external_ips: 172.16.10.32-172.16.10.35
ips: 192.168.70.32-192.168.70.35
property2:
external_ips: 172.16.10.32-172.16.10.35
ips: 192.168.70.32-192.168.70.35
id: 497f6eca-6276-4993-bfeb-53cbbbba6f13
internal_access:
enabled: true
internet_access:
create_simple_service_policy: false
destination_nat:
property1:
internal_ip: 192.168.70.30
name: web server
port: '443'
property2:
internal_ip: 192.168.70.30
name: web server
port: '443'
enabled: true
restricted: false
static_nat:
property1:
internal_ip: 192.168.70.3
name: printer-1
property2:
internal_ip: 192.168.70.3
name: printer-1
isolation: true
modified_time: 0
name: string
org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
subnet: 192.168.70.0/24
tenants:
property1:
addresses:
- 10.10.10.10
property2:
addresses:
- 10.10.10.45
vlan_id: 10
vpn_access:
property1:
allow_ping: true
destination_nat:
property1:
internal_ip: 192.168.70.5/30
name: web server
port: '443'
property2:
internal_ip: 192.168.70.5/30
name: web server
port: '443'
nat_pool: 172.16.0.0/26
routed: true
source_nat:
external_ip: 172.16.0.8/30
static_nat:
property1:
internal_ip: 192.168.70.3
name: pos_station-1
property2:
internal_ip: 192.168.70.3
name: pos_station-1
summarized_subnet: 172.16.0.0/16
property2:
allow_ping: true
destination_nat:
property1:
internal_ip: 192.168.70.5/30
name: web server
port: '443'
property2:
internal_ip: 192.168.70.5/30
name: web server
port: '443'
nat_pool: 172.16.0.0/26
routed: true
source_nat:
external_ip: 172.16.0.8/30
static_nat:
property1:
internal_ip: 192.168.70.3
name: pos_station-1
property2:
internal_ip: 192.168.70.3
name: pos_station-1
summarized_subnet: 172.16.0.0/16
parameters:
site_id:
in: path
name: site_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
securitySchemes:
apiToken:
description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
in: header
name: Authorization
type: apiKey
basicAuth:
description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
scheme: basic
type: http
csrfToken:
description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
in: header
name: X-CSRFToken
type: apiKey