SkyATP is a cloud-based solution that provides advanced threat protection for network security. It allows security analysts to update their defense against new attack techniques in real-time and distribute threat intelligence quickly. SkyATP inspects network traffic and blocks devices that have downloaded malware or accessed command and control servers. It also offers configuration and troubleshooting capabilities for administrators.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2604.1.1**
>
> Date: **May 13, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Sites Skyatp API
version: 2604.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
csrfToken: []
tags:
- description: 'SkyATP is a cloud-based solution that provides advanced threat protection for network security.
It allows security analysts to update their defense against new attack techniques in real-time and distribute threat intelligence quickly.
SkyATP inspects network traffic and blocks devices that have downloaded malware or accessed command and control servers. It also offers configuration and troubleshooting capabilities for administrators.'
name: Sites Skyatp
paths:
/api/v1/sites/{site_id}/skyatp/events/count:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Count by Distinct Attributes of Skyatp Events (WIP)
operationId: countSiteSkyatpEvents
parameters:
- in: query
name: distinct
schema:
$ref: '#/components/schemas/site_sky_atp_events_count_distinct'
- description: Event type, e.g. cc, fs, mw
in: query
name: type
schema:
type: string
- description: Client MAC
in: query
name: mac
schema:
type: string
- description: Device MAC
in: query
name: device_mac
schema:
type: string
- description: Threat level
in: query
name: threat_level
schema:
type: integer
- $ref: '#/components/parameters/ip'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
responses:
'200':
$ref: '#/components/responses/Count'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: countSiteSkyatpEvents
tags:
- Sites Skyatp
/api/v1/sites/{site_id}/skyatp/events/search:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Search Skyatp Events (WIP)
operationId: searchSiteSkyatpEvents
parameters:
- description: Event type, e.g. cc, fs, mw
in: query
name: type
schema:
type: string
- description: Client MAC
in: query
name: mac
schema:
type: string
- description: Device MAC
in: query
name: device_mac
schema:
type: string
- description: Threat level
in: query
name: threat_level
schema:
type: integer
- $ref: '#/components/parameters/ip'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/sort'
- $ref: '#/components/parameters/search_after'
responses:
'200':
$ref: '#/components/responses/SkyAtpEventsSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: searchSiteSkyatpEvents
tags:
- Sites Skyatp
components:
schemas:
response_count:
additionalProperties: false
properties:
distinct:
type: string
end:
type: integer
limit:
type: integer
results:
$ref: '#/components/schemas/count_results'
start:
type: integer
total:
type: integer
required:
- distinct
- end
- limit
- results
- start
- total
type: object
response_http403:
additionalProperties: false
properties:
detail:
examples:
- You do not have permission to perform this action.
type: string
type: object
count_results:
items:
$ref: '#/components/schemas/count_result'
type: array
uniqueItems: true
count_result:
additionalProperties:
type: string
properties:
count:
type: integer
required:
- count
type: object
site_id:
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
response_http404:
additionalProperties: false
properties:
id:
type: string
type: object
timestamp:
description: Epoch (seconds)
format: double
readOnly: true
type: number
response_events_sky_atp_search_results:
items:
$ref: '#/components/schemas/events_skyatp'
type: array
uniqueItems: true
response_http400:
additionalProperties: false
properties:
detail:
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
site_sky_atp_events_count_distinct:
default: type
description: 'enum: `device_mac`, `mac`, `threat_level`, `type`'
enum:
- device_mac
- mac
- threat_level
- type
type: string
response_http429:
additionalProperties: false
properties:
detail:
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
response_events_sky_atp_search:
additionalProperties: false
properties:
end:
type: integer
limit:
type: integer
next:
type: string
results:
$ref: '#/components/schemas/response_events_sky_atp_search_results'
start:
type: integer
total:
type: integer
required:
- end
- limit
- results
- start
- total
type: object
events_skyatp:
additionalProperties: false
description: SkyATP events
properties:
device_mac:
readOnly: true
type: string
for_site:
readOnly: true
type: boolean
ip:
readOnly: true
type: string
mac:
readOnly: true
type: string
org_id:
$ref: '#/components/schemas/org_id'
site_id:
$ref: '#/components/schemas/site_id'
threat_level:
readOnly: true
type: integer
timestamp:
$ref: '#/components/schemas/timestamp'
type:
readOnly: true
type: string
required:
- mac
- threat_level
- device_mac
- timestamp
- org_id
- site_id
- type
- ip
type: object
response_http401:
additionalProperties: false
properties:
detail:
examples:
- Authentication credentials were not provided.
type: string
type: object
org_id:
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
parameters:
ip:
in: query
name: ip
schema:
examples:
- 192.168.1.1
format: ipv4
type: string
start:
description: Start time (epoch timestamp in seconds, or relative string like "-1d", "-1w")
in: query
name: start
schema:
type: string
sort:
description: On which field the list should be sorted, -prefix represents DESC order
in: query
name: sort
schema:
default: timestamp
examples:
- -site_id
type: string
duration:
description: Duration like 7d, 2w
in: query
name: duration
schema:
default: 1d
examples:
- 10m
type: string
search_after:
description: Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the `next` URL from the previous response and should not be manually constructed.
in: query
name: search_after
schema:
type: string
end:
description: End time (epoch timestamp in seconds, or relative string like "-1d", "-2h", "now")
in: query
name: end
schema:
type: string
site_id:
in: path
name: site_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
examples:
CountExample:
value:
distinct: string
end: 0
limit: 0
results:
- count: 0
property: string
start: 0
total: 0
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
SkyAtpEventsSearchExample:
value:
end: 1513176951
limit: 10
results:
- device_mac: 658279bb1fa4
ip: 172.16.0.11
mac: b019c66c8348
org_id: 3139f2c2-fac6-11e5-8156-0242ac110006
site_id: 70e0f468-fc13-11e5-85ad-0242ac110008
threat_level: 7
timestamp: 1592524478
type: cc
start: 1512572151
total: 1
HTTP401Example:
value:
detail: Authentication credentials were not provided.
responses:
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
SkyAtpEventsSearch:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/SkyAtpEventsSearchExample'
schema:
$ref: '#/components/schemas/response_events_sky_atp_search'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/SkyAtpEventsSearchExample'
schema:
$ref: '#/components/schemas/response_events_sky_atp_search'
description: OK
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
Count:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/CountExample'
schema:
$ref: '#/components/schemas/response_count'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/CountExample'
schema:
$ref: '#/components/schemas/response_count'
description: Result of Count
securitySchemes:
apiToken:
description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
in: header
name: Authorization
type: apiKey
basicAuth:
description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
scheme: basic
type: http
csrfToken:
description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
in: header
name: X-CSRFToken
type: apiKey