Wxtags are tags or groups that can be created and used within a specific site. They are used to classify users and resources and can be applied to Access Points, WLAN configurations or WxRules within that site. Site WxTags are created and managed at the site level and can only be referenced and used within that particular site.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2604.1.1**
>
> Date: **May 13, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Sites WxTags API
version: 2604.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- basicAuth: []
- basicAuth: []
csrfToken: []
tags:
- description: 'Wxtags are tags or groups that can be created and used within a specific site.
They are used to classify users and resources and can be applied to Access Points, WLAN configurations or WxRules within that site.
Site WxTags are created and managed at the site level and can only be referenced and used within that particular site.'
name: Sites WxTags
paths:
/api/v1/sites/{site_id}/wxtags:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Get List of Site WxTags
operationId: listSiteWxTags
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/WxtagArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listSiteWxTags
tags:
- Sites WxTags
post:
description: Create Site WxTag
operationId: createSiteWxTag
requestBody:
content:
application/json:
examples:
app:
value:
match: app
name: match app
type: match
values:
- gmail
- dropbox
client_mac:
value:
match: client_mac
name: file_servers
type: match
values:
- b0c4e7001543
- a0c4e7001543
- 00c4e7001543
hostnames:
value:
match: hostname
name: mist
type: match
values:
- mist.com
ip_range_subnets:
value:
match: ip_range_subnet
name: file_servers
type: match
values:
- 10.1.2.1
- 10.2.3.4/24
- 10.1.2.5-10.2.3.4
ports:
value:
match: port
name: web-ports
type: match
values:
- '80'
- '8000'
- '8080'
psk_name:
value:
match: psk_name
name: VIP
type: match
values:
- test_key1
- test_key2
psk_role:
value:
match: psk_role
name: VIP
type: match
values:
- test_role
radius_group:
value:
match: radius_group
name: VIP
type: match
values:
- vip
radius_username:
value:
match: radius_username
name: VIP
type: match
values:
- john@abc.com
- eric@abc.com
traffic-spec:
value:
name: protocol-subnet-port
specs:
- port_range: '80'
protocol: tcp
subnets:
- 10.1.2.0/24
type: spec
vlan:
value:
name: vlan-assignment
type: vlan
vlan_id: 1055
wlan_id:
value:
match: wlan_id
name: guest-wlan
type: match
values:
- be22bba78e22e1cf5185b880816fe2cf
schema:
$ref: '#/components/schemas/wxlan_tag'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Wxtag'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createSiteWxTag
tags:
- Sites WxTags
/api/v1/sites/{site_id}/wxtags/apps:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Get Application List
operationId: getSiteApplicationList
responses:
'200':
$ref: '#/components/responses/WxTagsAppsArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getSiteApplicationList
tags:
- Sites WxTags
/api/v1/sites/{site_id}/wxtags/{wxtag_id}:
parameters:
- $ref: '#/components/parameters/site_id'
- $ref: '#/components/parameters/wxtag_id'
delete:
description: Delete Site WxTag
operationId: deleteSiteWxTag
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteSiteWxTag
tags:
- Sites WxTags
get:
description: Get Site WxTag Details
operationId: getSiteWxTag
responses:
'200':
$ref: '#/components/responses/Wxtag'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getSiteWxTag
tags:
- Sites WxTags
put:
description: Update Site WxTag
operationId: updateSiteWxTag
requestBody:
content:
application/json:
examples:
app:
value:
match: app
name: match app
type: match
values:
- gmail
- dropbox
client_mac:
value:
match: client_mac
name: file_servers
type: match
values:
- b0c4e7001543
- a0c4e7001543
- 00c4e7001543
hostnames:
value:
match: hostname
name: mist
type: match
values:
- mist.com
ip_range_subnets:
value:
match: ip_range_subnet
name: file_servers
type: match
values:
- 10.1.2.1
- 10.2.3.4/24
- 10.1.2.5-10.2.3.4
ports:
value:
match: port
name: web-ports
type: match
values:
- '80'
- '8000'
- '8080'
psk_name:
value:
match: psk_name
name: VIP
type: match
values:
- test_key1
- test_key2
psk_role:
value:
match: psk_role
name: VIP
type: match
values:
- test_role
radius_group:
value:
match: radius_group
name: VIP
type: match
values:
- vip
radius_username:
value:
match: radius_username
name: VIP
type: match
values:
- john@abc.com
- eric@abc.com
traffic-spec:
value:
name: protocol-subnet-port
specs:
- port_range: '80'
protocol: tcp
subnets:
- 10.1.2.0/24
type: spec
vlan:
value:
name: vlan-assignment
type: vlan
vlan_id: 1055
wlan_id:
value:
match: wlan_id
name: guest-wlan
type: match
values:
- be22bba78e22e1cf5185b880816fe2cf
schema:
$ref: '#/components/schemas/wxlan_tag'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Wxtag'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateSiteWxTag
tags:
- Sites WxTags
components:
schemas:
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
wxlan_tag_type:
description: 'enum: `client`, `match`, `resource`, `spec`, `subnet`, `vlan`'
enum:
- client
- match
- resource
- spec
- subnet
- vlan
type: string
strings:
items:
type: string
type: array
uniqueItems: true
search_wxtag_apps_item:
additionalProperties: false
properties:
group:
examples:
- Emails
type: string
key:
examples:
- gmail
type: string
name:
examples:
- Gmail - web/app
type: string
required:
- key
- name
- group
type: object
response_http403:
additionalProperties: false
properties:
detail:
examples:
- You do not have permission to perform this action.
type: string
type: object
wxlan_tag_specs:
description: If `type`==`spec`
items:
$ref: '#/components/schemas/wxlan_tag_spec'
type: array
wxlan_tag_operation:
default: in
description: 'required if `type`==`match`, type of tag (inclusive/exclusive). enum: `in`, `not_in`'
enum:
- in
- not_in
type: string
wxlan_tag:
description: "WxLAN Tag\n * type:\n * client: created manually (e.g. on wireless client table, when they spot a device of interest, they can create a wxlan tag for it\n * resource: created automatically when we discover a network resource\n * subnet: create automatically when a subnet is discovered\n * match:\n * wlan_id, ap_id: values are a list of Wlan / Device ids\n * client_mac: values are a list of MAC addresses\n * radius_group: this is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\n * radius_username: this matches the ATTR-User-Name(1)\n * radius_class: the matches the ATTR-Class(25)\n * radius_attr: the values are [ \"6=1\" , \"26=10.2.3.4\" ], this support other RADIUS attributes where we know the type\n * radius_vendor: the values are [ \"14179.10=1\" , \"14178.16=1.2.3.4\" ], this matches vendor attributes and will be dynamically evaluated"
properties:
created_time:
$ref: '#/components/schemas/created_time'
for_site:
readOnly: true
type: boolean
id:
$ref: '#/components/schemas/id'
last_ips:
$ref: '#/components/schemas/wxlan_tag_last_ips'
mac:
description: If `type`==`client`, Client MAC Address
type:
- string
- 'null'
match:
$ref: '#/components/schemas/wxlan_tag_match'
modified_time:
$ref: '#/components/schemas/modified_time'
name:
description: The name
type: string
op:
$ref: '#/components/schemas/wxlan_tag_operation'
org_id:
$ref: '#/components/schemas/org_id'
resource_mac:
type:
- string
- 'null'
services:
$ref: '#/components/schemas/strings'
site_id:
$ref: '#/components/schemas/site_id'
specs:
$ref: '#/components/schemas/wxlan_tag_specs'
subnet:
type: string
type:
$ref: '#/components/schemas/wxlan_tag_type'
values:
$ref: '#/components/schemas/wxlan_tag_values'
vlan_id:
$ref: '#/components/schemas/wxlan_tag_vlan_id'
required:
- type
- name
type: object
search_wxtag_apps:
items:
$ref: '#/components/schemas/search_wxtag_apps_item'
type: array
site_id:
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
response_http404:
additionalProperties: false
properties:
id:
type: string
type: object
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
wxlan_tag_vlan_id:
description: If `type`==`vlan_id`, VLAN ID or variable
examples:
- '1055'
oneOf:
- type: string
- maximum: 4094
minimum: 1
type: integer
response_http400:
additionalProperties: false
properties:
detail:
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
wxlan_tag_spec:
additionalProperties: false
properties:
port_range:
default: '0'
description: Matched destination port, "0" means any
type: string
protocol:
default: any
description: tcp / udp / icmp / gre / any / ":protocol_number", `protocol_number` is between 1-254
type: string
subnets:
$ref: '#/components/schemas/wxlan_tag_spec_subnets'
type: object
response_http429:
additionalProperties: false
properties:
detail:
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
wxlan_tag_values:
description: "Required if `type`==`match` and\n * `match`==`ap_id`: list of AP IDs\n * `match`==`app`: list of Application Names\n * `match`==`asset_mac`: list of Asset MAC Addresses\n * `match`==`client_mac`: list of Client MAC Addresses\n * `match`==`hostname`: list of Resources Hostnames\n * `match`==`ip_range_subnet`: list of IP Addresses and/or CIDRs\n * `match`==`psk_name`: list of PSK Names\n * `match`==`psk_role`: list of PSK Roles\n * `match`==`port`: list of Ports or Port Ranges\n * `match`==`radius_attr`: list of RADIUS Attributes. The values are [ \"6=1\", \"26=10.2.3.4\" ], this support other RADIUS attributes where we know the type\n * `match`==`radius_class`: list of RADIUS Classes. This matches the ATTR-Class(25)\n * `match`==`radius_group`: list of RADIUS Groups. This is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\n * `match`==`radius_username`: list of RADIUS Usernames. This matches the ATTR-User-Name(1)\n * `match`==`sdkclient_uuid`: list of SDK UUIDs\n * `match`==`wlan_id`: list of WLAN IDs\n\n**Notes**:\nVariables are not allowed"
items:
type: string
type: array
wxlan_tag_match:
description: 'required if `type`==`match`. enum: `ap_id`, `app`, `asset_mac`, `client_mac`, `hostname`, `ip_range_subnet`, `port`, `psk_name`, `psk_role`, `radius_attr`, `radius_class`, `radius_group`, `radius_username`, `sdkclient_uuid`, `wlan_id`'
enum:
- ap_id
- app
- asset_mac
- client_mac
- hostname
- ip_range_subnet
- port
- psk_name
- psk_role
- radius_attr
- radius_class
- radius_group
- radius_username
- sdkclient_uuid
- wlan_id
type: string
response_http401:
additionalProperties: false
properties:
detail:
examples:
- Authentication credentials were not provided.
type: string
type: object
wxlan_tags:
items:
$ref: '#/components/schemas/wxlan_tag'
type: array
wxlan_tag_spec_subnets:
default: []
description: Matched destination subnets and/or IP Addresses
examples:
- - 0.0.0.0/0
items:
type: string
type: array
org_id:
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
wxlan_tag_last_ips:
items:
type: string
readOnly: true
type: array
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
examples:
WxtagArrayExample:
value:
- created_time: 0
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
last_ips:
- string
mac: string
match: wlan_id
modified_time: 0
name: string
op: in
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
resource_mac: string
services:
- string
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
specs:
- port_range: string
protocol: tcp
subnets:
- string
subnet: string
type: match
values:
- string
WxtagExample:
value:
created_time: 0
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
last_ips:
- string
mac: string
match: wlan_id
modified_time: 0
name: string
op: in
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
resource_mac: string
services:
- string
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
specs:
- port_range: string
protocol: tcp
subnets:
- string
subnet: string
type: match
values:
- string
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401Example:
value:
detail: Authentication credentials were not provided.
WxTagsAppsArrayExample:
value:
- group: Emails
key: gmail
name: Gmail - web/app
responses:
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
Wxtag:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxtagExample'
schema:
$ref: '#/components/schemas/wxlan_tag'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxtagExample'
schema:
$ref: '#/components/schemas/wxlan_tag'
description: OK
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
WxtagArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxtagArrayExample'
schema:
$ref: '#/components/schemas/wxlan_tags'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxtagArrayExample'
schema:
$ref: '#/components/schemas/wxlan_tags'
description: OK
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
WxTagsAppsArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxTagsAppsArrayExample'
schema:
$ref: '#/components/schemas/search_wxtag_apps'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxTagsAppsArrayExample'
schema:
$ref: '#/components/schemas/search_wxtag_apps'
description: List of Applications
OK:
description: OK
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
parameters:
wxtag_id:
in: path
name: wxtag_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
page:
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
site_id:
in: path
name: site_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
securitySchemes:
apiToken:
description: "Like many other API providers, it’s also possible to generate API Tokens to be used (in HTTP Header) for authentication. An API token ties to a Admin with equal or less privileges.\n\n**Format**:\n API Token value format is `Token {apitoken}`\n\n**Notes**:\n* an API token generated for a specific admin has the same privilege as the user\n* an API token will be automatically removed if not used for > 90 days\n* SSO admins cannot generate these API tokens. Refer Org level API tokens which can have privileges of a specific Org/Site for more information."
in: header
name: Authorization
type: apiKey
basicAuth:
description: While our current UI uses Session / Cookie-based authentication, it’s also possible to do Basic Auth.
scheme: basic
type: http
csrfToken:
description: "This protects the website against [Cross Site Request Forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery), all the POST / PUT / DELETE APIs needs to have CSRF token in the AJAX Request header when using Login/Password authentication (with or without MFA)\n\n\nThe CSRF Token is sent back by Mist in the Cookies from the Login Response API Call:\n`cookies[csrftoken]` \n\nThe CSRF Token must be added in the HTTP Request Headers:\n```\nX-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx\n```"
in: header
name: X-CSRFToken
type: apiKey