MSP SSO roles refer to the different functions assigned to users within a Single Sign-On (SSO) system. These roles determine the tasks and actions that users can perform within the SSO system. There are typically predefined roles and custom roles in an SSO system. Roles in SSO provide a well-defined separation of responsibility and visibility, allowing for granular-level access control on SSO objects.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins MSPs SSO Roles API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'MSP SSO roles refer to the different functions assigned to users within a Single Sign-On (SSO) system.
These roles determine the tasks and actions that users can perform within the SSO system. There are typically predefined roles and custom roles in an SSO system.
Roles in SSO provide a well-defined separation of responsibility and visibility, allowing for granular-level access control on SSO objects.'
name: MSPs SSO Roles
paths:
/api/v1/msps/{msp_id}/ssoroles:
parameters:
- $ref: '#/components/parameters/msp_id'
get:
description: List MSP SSO role definitions that map identity-provider role assertions to MSP privilege scopes.
operationId: listMspSsoRoles
responses:
'200':
$ref: '#/components/responses/SsoRolesMspArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listMspSsoRoles
tags:
- MSPs SSO Roles
post:
description: Create an MSP SSO role definition with a display name and the MSP privileges granted when the role is matched during SSO.
operationId: createMspSsoRole
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/sso_role_msp'
description: Request Body
responses:
'200':
$ref: '#/components/responses/SsoRoleMsp'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createMspSsoRole
tags:
- MSPs SSO Roles
/api/v1/msps/{msp_id}/ssoroles/{ssorole_id}:
parameters:
- $ref: '#/components/parameters/msp_id'
- $ref: '#/components/parameters/ssorole_id'
delete:
description: Delete an MSP SSO role definition so it can no longer grant MSP privileges during SSO.
operationId: deleteMspSsoRole
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteMspSsoRole
tags:
- MSPs SSO Roles
put:
description: Update an MSP SSO role definition, including its display name and granted MSP privileges.
operationId: updateMspSsoRole
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/sso_role_msp'
description: Request Body
responses:
'200':
$ref: '#/components/responses/SsoRoleMsp'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateMspSsoRole
tags:
- MSPs SSO Roles
components:
responses:
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
OK:
description: OK
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
SsoRoleMsp:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/SsoRoleMspExample'
schema:
$ref: '#/components/schemas/sso_role_msp'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/SsoRoleMspExample'
schema:
$ref: '#/components/schemas/sso_role_msp'
description: OK
SsoRolesMspArray:
content:
application/json:
schema:
$ref: '#/components/schemas/sso_roles_msp'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/sso_roles_msp'
description: Example response
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
schemas:
admin_privilege_view:
description: 'UI view name allowed by a custom admin role. enum: `lobby_admin`, `location`, `marketing`, `mxedge_admin`, `reporting`, `security`, `super_observer`, `switch_admin`'
enum:
- lobby_admin
- location
- marketing
- mxedge_admin
- reporting
- security
- super_observer
- switch_admin
type: string
privilege_msp:
additionalProperties: false
description: MSP privilege scope and role settings
properties:
org_id:
description: If `scope`==`org`, organization ID this MSP privilege applies to
format: uuid
type: string
org_name:
description: Name of the org (for a site belonging to org)
readOnly: true
type: string
orggroup_id:
description: If `scope`==`orggroup`, organization group ID this MSP privilege applies to
format: uuid
type: string
role:
$ref: '#/components/schemas/privilege_msp_role'
description: Access role granted by this MSP privilege
scope:
$ref: '#/components/schemas/privilege_msp_scope'
description: MSP hierarchy level where this privilege applies
views:
$ref: '#/components/schemas/admin_privilege_views'
description: UI views allowed by custom role restrictions
required:
- role
- scope
type: object
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
sso_role_msp:
description: MSP SSO role definition
properties:
created_time:
$ref: '#/components/schemas/created_time'
description: Time when this MSP SSO role was created, in epoch seconds
for_site:
description: Whether this MSP SSO role is scoped for site-level access
readOnly: true
type: boolean
id:
$ref: '#/components/schemas/id'
description: Unique identifier for this MSP SSO role
modified_time:
$ref: '#/components/schemas/modified_time'
description: Time when this MSP SSO role was last modified, in epoch seconds
msp_id:
$ref: '#/components/schemas/msp_id'
description: Owning MSP identifier for this SSO role
name:
description: Display name of the MSP SSO role
type: string
org_id:
$ref: '#/components/schemas/org_id'
description: Organization identifier associated with this MSP SSO role, when applicable
privileges:
$ref: '#/components/schemas/sso_role_msp_privileges'
description: Access privileges granted by this MSP SSO role
required:
- name
- privileges
type: object
sso_role_msp_privileges:
description: Access privileges granted by an MSP SSO role
items:
$ref: '#/components/schemas/privilege_msp'
minItems: 1
type: array
uniqueItems: true
msp_id:
description: Managed service provider identifier
examples:
- b9d42c2e-88ee-41f8-b798-f009ce7fe909
format: uuid
readOnly: true
type: string
sso_roles_msp:
description: MSP SSO roles returned by the request
items:
$ref: '#/components/schemas/sso_role_msp'
type: array
admin_privilege_views:
description: "Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. Custom roles restrict Org users to specific UI views. This is useful for limiting UI access of Org users. \nYou can define custom roles by adding the `views` attribute along with `role` when assigning privileges. \nBelow are the list of supported UI views. Note that this is UI only feature. \n\n | UI View | Required Role | Description |\n | --- | --- | --- |\n | `reporting` | `read` | full access to all analytics tools |\n | `marketing` | `read` | can view analytics and location maps |\n | `super_observer` | `read` | can view all the organization except the subscription page |\n | `location` | `write` | can view and manage location maps, can view analytics |\n | `security` | `write` | can view and manage site labels, policies and security |\n | `switch_admin` | `helpdesk` | can view and manage Switch ports, can view wired clients |\n | `mxedge_admin` | `admin` | can view and manage Mist edges and Mist tunnels |\n | `lobby_admin` | `admin` | full access to Org and Site Pre-shared keys |"
items:
$ref: '#/components/schemas/admin_privilege_view'
type: array
privilege_msp_role:
description: 'access permissions. enum: `admin`, `helpdesk`, `installer`, `read`, `write`'
enum:
- admin
- helpdesk
- installer
- read
- write
type: string
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
privilege_msp_scope:
description: 'enum: `msp`, `org`, `orggroup`'
enum:
- msp
- org
- orggroup
type: string
parameters:
msp_id:
in: path
name: msp_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
ssorole_id:
in: path
name: ssorole_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
examples:
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
SsoRoleMspExample:
value:
created_time: 0
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
modified_time: 0
msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
privileges:
- orggroup_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
role: read
scope: orggroup
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401Example:
value:
detail: Authentication credentials were not provided.
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey