Mist MSPs Admins API
An MSP Admin refers to a user who has access to the Juniper Mist managed service provider (MSP) portal and is responsible for managing and administering the network operations of multiple customer organizations and sites.
OpenAPI Specification
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins MSPs Admins API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: An MSP Admin refers to a user who has access to the Juniper Mist managed service provider (MSP) portal and is responsible for managing and administering the network operations of multiple customer organizations and sites.
name: MSPs Admins
paths:
/api/v1/msps/{msp_id}/admins:
parameters:
- $ref: '#/components/parameters/msp_id'
get:
description: List administrators that have privileges in this MSP hierarchy, including MSP, organization, organization group, site, or site group scopes.
operationId: listMspAdmins
responses:
'200':
$ref: '#/components/responses/AdminsArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listMspAdmins
tags:
- MSPs Admins
/api/v1/msps/{msp_id}/admins/{admin_id}:
parameters:
- $ref: '#/components/parameters/msp_id'
- $ref: '#/components/parameters/admin_id'
delete:
description: Remove all privileges this administrator has through the MSP hierarchy, including inherited organization and site access. This does not delete the administrator account.
operationId: revokeMspAdmin
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: revokeMspAdmin
tags:
- MSPs Admins
get:
description: Return administrator details and privilege assignments for one administrator under this MSP.
operationId: getMspAdmin
responses:
'200':
$ref: '#/components/responses/Admin'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getMspAdmin
tags:
- MSPs Admins
put:
description: Update identity fields and privilege assignments for an existing administrator under this MSP.
operationId: updateMspAdmin
requestBody:
content:
application/json:
examples:
Example:
value:
email: jsnow@abc.com
first_name: string
last_name: string
privileges:
- org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
sitegroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
- role: admin
scope: site
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
schema:
$ref: '#/components/schemas/admin'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Admin'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateMspAdmin
tags:
- MSPs Admins
/api/v1/msps/{msp_id}/invites:
parameters:
- $ref: '#/components/parameters/msp_id'
post:
description: 'Send an MSP administrator invitation with the requested identity fields and privilege assignments.
**Note**: An email will also be sent to the user with a link to https://manage.mist.com/verify/invite?token=:token'
operationId: inviteMspAdmin
requestBody:
content:
application/json:
examples:
Example:
value:
email: user@example.com
first_name: string
last_name: string
privileges:
- msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
msp_name: string
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
org_name: string
orggroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
sitegroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
schema:
$ref: '#/components/schemas/admin'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Admin'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: inviteMspAdmin
tags:
- MSPs Admins
/api/v1/msps/{msp_id}/invites/{invite_id}:
parameters:
- $ref: '#/components/parameters/msp_id'
- $ref: '#/components/parameters/invite_id'
delete:
description: Cancel a pending MSP administrator invitation before the invitee accepts it.
operationId: uninviteMspAdmin
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: uninviteMspAdmin
tags:
- MSPs Admins
put:
description: Update the identity fields or privilege assignments on a pending MSP administrator invitation.
operationId: updateMspAdminInvite
requestBody:
content:
application/json:
examples:
Example:
value:
email: user@example.com
first_name: string
last_name: string
privileges:
- msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
msp_name: string
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
org_name: string
orggroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
sitegroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
schema:
$ref: '#/components/schemas/admin'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Admin'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateMspAdminInvite
tags:
- MSPs Admins
components:
schemas:
admin_privilege:
additionalProperties: false
description: Admin privilege scope, role, and UI access settings
properties:
msp_id:
$ref: '#/components/schemas/admin_privilege_msp_id'
description: Required if `scope`==`msp`. MSP granted by this privilege
msp_logo_url:
description: Logo of the MSP (if the MSP belongs to an Advanced tier)
readOnly: true
type: string
msp_name:
description: Name of the MSP (if the org belongs to an MSP)
readOnly: true
type:
- string
- 'null'
msp_url:
description: Custom url of the MSP (if the MSP belongs to an Advanced tier)
readOnly: true
type: string
name:
description: Display name of the object for this privilege scope
readOnly: true
type: string
org_id:
$ref: '#/components/schemas/admin_privilege_org_id'
description: Required if `scope`==`org`. Organization granted by this privilege
org_name:
description: Name of the org (for a site belonging to org)
readOnly: true
type: string
orggroup_ids:
$ref: '#/components/schemas/admin_privilege_orggroup_ids'
description: If `scope`==`orggroup`. Organization groups granted by this privilege
role:
$ref: '#/components/schemas/admin_privilege_role'
description: Access role granted by this privilege
scope:
$ref: '#/components/schemas/admin_privilege_scope'
description: Object scope where this privilege applies
site_id:
$ref: '#/components/schemas/admin_privilege_site_id'
description: Required if `scope`==`site`. Site granted by this privilege
sitegroup_ids:
$ref: '#/components/schemas/admin_privilege_sitegroup_ids'
description: If `scope`==`sitegroup`. Site groups granted by this privilege
views:
$ref: '#/components/schemas/admin_privilege_views'
description: UI view restrictions applied when custom roles limit this privilege
required:
- role
- scope
type: object
admin_privilege_orggroup_ids:
description: If `scope`==`orggroup`. Organization groups granted by this privilege
items:
$ref: '#/components/schemas/orggroup_id'
type: array
admin_privilege_view:
description: 'UI view name allowed by a custom admin role. enum: `lobby_admin`, `location`, `marketing`, `mxedge_admin`, `reporting`, `security`, `super_observer`, `switch_admin`'
enum:
- lobby_admin
- location
- marketing
- mxedge_admin
- reporting
- security
- super_observer
- switch_admin
type: string
admin_privilege_site_id:
description: Required if `scope`==`site`. Site granted by this privilege
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
type: string
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
admin_privilege_sitegroup_ids:
description: Site group identifiers granted by an admin privilege when scope is `sitegroup`
items:
$ref: '#/components/schemas/sitegroup_id'
type: array
admin_compliance_status:
description: 'trade compliance status. enum: `blocked`, `restricted`'
enum:
- blocked
- restricted
type: string
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
sitegroup_id:
description: Unique identifier of a Mist site group
examples:
- 3c708be3-9422-4695-b729-babdbd2f7615
format: uuid
type: string
admin_id:
description: ID of the administrator
examples:
- 456b7016-a916-a4b1-78dd-72b947c152b7
format: uuid
readOnly: true
type: string
admin:
description: Mist administrator account or organization API token details
properties:
admin_id:
$ref: '#/components/schemas/admin_id'
description: Unique identifier of the administrator
compliance_status:
$ref: '#/components/schemas/admin_compliance_status'
description: Trade compliance status for this administrator
email:
description: If admin account is not an Org API Token
examples:
- jsnow@abc.com
format: email
type: string
enable_two_factor:
description: If admin account is not an Org API Token
readOnly: true
type: boolean
expire_time:
description: Expiration time for the admin invitation, in epoch seconds
type: integer
first_name:
description: If admin account is not an Org API Token. For an invite, this is the original first name used
examples:
- John
type: string
hours:
default: 24
description: If admin account is not an Org API Token, how long the invite should be valid
maximum: 168
minimum: 1
type: integer
last_name:
description: If admin account is not an Org API Token. For an invite, this is the original last name used
examples:
- Sno
type: string
name:
description: For Org API Token Only
type: string
no_tracking:
default: null
description: Optional, whether to store privacy-consent information. When it doesn’t exist, it’s assumed true on EU (i.e. no tracking, the user has to opt-in); otherwise, the user would have to opt-out
type:
- boolean
- 'null'
oauth_google:
description: If admin account is not an Org API Token
readOnly: true
type: boolean
password_modified_time:
description: Password last modified time, in epoch
format: double
type: number
phone:
description: If admin account is not an Org API Token. Phone number (numbers only, including country code)
type: string
phone2:
description: If admin account is not an Org API Token. Secondary phone number (numbers only, including country code)
type: string
privileges:
$ref: '#/components/schemas/admin_privileges'
description: Privilege assignments that define the admin's MSP, organization, site, or site group access
session_expiry:
description: Session lifetime for the admin, in minutes
examples:
- 1440
format: int64
maximum: 20160
minimum: 10
readOnly: true
type: integer
tags:
$ref: '#/components/schemas/admin_tags'
description: Read-only tags associated with the admin account
two_factor_verified:
description: If admin account is not an Org API Token. Two factor status
readOnly: true
type: boolean
via_sso:
description: If admin account is not an Org API Token, an admin login via_sso is more restircted. (password and email cannot be changed)
readOnly: true
type: boolean
type: object
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
admin_privileges:
description: List of privileges the admin has
items:
$ref: '#/components/schemas/admin_privilege'
minItems: 1
type: array
uniqueItems: true
orggroup_id:
description: Unique identifier of an MSP organization group
examples:
- 832b1d74-9531-409b-ae37-4d7f3edbde92
format: uuid
type: string
admin_privilege_org_id:
description: Required if `scope`==`org`. Organization granted by this privilege
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
type: string
admin_tags:
description: Read-only tags associated with an administrator account
items:
type: string
readOnly: true
type: array
admins:
description: List of Mist administrator accounts
items:
$ref: '#/components/schemas/admin'
type: array
uniqueItems: true
admin_privilege_scope:
description: 'enum: `msp`, `org`, `orggroup`, `site`, `sitegroup`'
enum:
- msp
- org
- orggroup
- site
- sitegroup
type: string
admin_privilege_role:
description: 'access permissions. enum: `admin`, `helpdesk`, `installer`, `read`, `write`'
enum:
- admin
- helpdesk
- installer
- read
- write
type: string
admin_privilege_views:
description: "Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. \nYou can define custom roles by adding the `views` attribute along with `role` when assigning privileges. \nBelow are the list of supported UI views. Note that this is UI only feature. \n\n | UI View | Required Role | Description |\n | --- | --- | --- |\n | `reporting` | `read` | full access to all analytics tools |\n | `marketing` | `read` | can view analytics and location maps |\n | `super_observer` | `read` | can view all the organization except the subscription page |\n | `location` | `write` | can view and manage location maps, can view analytics |\n | `security` | `write` | can view and manage site labels, policies and security |\n | `switch_admin` | `helpdesk` | can view and manage Switch ports, can view wired clients |\n | `mxedge_admin` | `admin` | can view and manage Mist edges and Mist tunnels |\n | `lobby_admin` | `admin` | full access to Org and Site Pre-shared keys |"
items:
$ref: '#/components/schemas/admin_privilege_view'
type: array
admin_privilege_msp_id:
description: Required if `scope`==`msp`. MSP granted by this privilege
examples:
- b9d42c2e-88ee-41f8-b798-f009ce7fe909
format: uuid
type: string
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
responses:
OK:
description: OK
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
AdminsArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/AdminsArrayExample'
Example2:
$ref: '#/components/examples/AdminsArrayExample2'
schema:
$ref: '#/components/schemas/admins'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/AdminsArrayExample'
Example2:
$ref: '#/components/examples/AdminsArrayExample2'
schema:
$ref: '#/components/schemas/admins'
description: OK
Admin:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/AdminExample'
schema:
$ref: '#/components/schemas/admin'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/AdminExample'
schema:
$ref: '#/components/schemas/admin'
description: OK
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
parameters:
msp_id:
in: path
name: msp_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
admin_id:
in: path
name: admin_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
invite_id:
in: path
name: invite_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
examples:
AdminExample:
value:
admin_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
email: user@example.com
first_name: string
last_name: string
password_modified_time: 1656353525
privileges:
- msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
msp_name: string
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
org_name: string
orggroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
sitegroup_ids:
- 6f4bf402-45f9-2a56-6c8b-7f83d3bc98e9
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
AdminsArrayExample:
value:
- admin_id: 456b7016-a916-a4b1-78dd-72b947c152b7
email: jsmith@mycorp.org
first_name: Joe
last_name: Smith
privileges:
- role: admin
scope: msp
- org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
- orggroup_ids:
- 507f1bab-13ba-73e2-f291-2bcb8d1362b0
role: read
scope: orggroup
AdminsArrayExample2:
value:
- admin_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
email: user@example.com
first_name: string
last_name: string
privileges:
- msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
msp_name: string
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
org_name: string
orggroup_ids:
- b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: admin
scope: org
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
sitegroup_ids:
- 6f4bf402-45f9-2a56-6c8b-7f83d3bc98e9
HTTP401Example:
value:
detail: Authentication credentials were not provided.
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey