Mist

Mist Orgs Antivirus Profiles API

Antivirus profiles are used to define the content to scan for any malware and the action to be taken when malware is detected. These profiles can be assigned to Content Security policies to scan Web, file transfer, and e-mail traffic. The profiles help in ensuring that the network is protected from malicious content by specifying fallback options and notification methods when malware is detected or when the antivirus system experiences errors. Key Features of Antivirus Profiles: * Content Scanning: Defines the content to scan for malware. * Action on Detection: Specifies the action to be taken when malware is detected. * Fallback Options: Configures actions to be taken when the antivirus system encounters errors. * Notification Options: Sets up methods to notify users when a fallback occurs or a virus is detected.

GitHub OpenAPI

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-antivirus-profiles-api-openapi.yml

OpenAPI Specification

mist-orgs-antivirus-profiles-api-openapi.yml Raw ↑ 
openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs Antivirus Profiles API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: "Antivirus profiles are used to define the content to scan for any malware and the action to be taken when malware is detected. \nThese profiles can be assigned to Content Security policies to scan Web, file transfer, and e-mail traffic. \nThe profiles help in ensuring that the network is protected from malicious content by specifying fallback options and notification methods when malware is detected or when the antivirus system experiences errors.\n\n\nKey Features of Antivirus Profiles:\n\n* Content Scanning: Defines the content to scan for malware.\n* Action on Detection: Specifies the action to be taken when malware is detected.\n* Fallback Options: Configures actions to be taken when the antivirus system encounters errors.\n* Notification Options: Sets up methods to notify users when a fallback occurs or a virus is detected."
  name: Orgs Antivirus Profiles
paths:
  /api/v1/orgs/{org_id}/avprofiles:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: List organization antivirus scanning profiles, including inspected protocols, scan limits, whitelist settings, and fallback actions.
      operationId: listOrgAntivirusProfiles
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/AvProfilesArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgAntivirusProfiles
      tags:
      - Orgs Antivirus Profiles
    post:
      description: Create an organization antivirus scanning profile with inspected protocols, maximum file size, whitelist settings, and fallback action.
      operationId: createOrgAntivirusProfile
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  fallback_action: permit
                  max_filesize: 10000
                  mime_whitelist: []
                  name: av-custom
                  protocols:
                  - http
                  url_whitelist: []
            schema:
              $ref: '#/components/schemas/avprofile'
      responses:
        '200':
          $ref: '#/components/responses/AvProfile'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgAntivirusProfile
      tags:
      - Orgs Antivirus Profiles
  /api/v1/orgs/{org_id}/avprofiles/{avprofile_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/avprofile_id'
    delete:
      description: Delete an organization antivirus scanning profile by profile ID.
      operationId: deleteOrgAntivirusProfile
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: Delete Org Antivirus Profile
      tags:
      - Orgs Antivirus Profiles
    get:
      description: Return one organization antivirus scanning profile, including inspected protocols, scan limits, whitelist settings, and fallback action.
      operationId: getOrgAntivirusProfile
      responses:
        '200':
          $ref: '#/components/responses/AvProfile'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgAntivirusProfile
      tags:
      - Orgs Antivirus Profiles
    put:
      description: Update an organization antivirus scanning profile's inspected protocols, maximum file size, whitelist settings, or fallback action.
      operationId: updateOrgAntivirusProfile
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  fallback_action: permit
                  max_filesize: 10000
                  mime_whitelist: []
                  name: av-custom
                  protocols:
                  - http
                  url_whitelist: []
            schema:
              $ref: '#/components/schemas/avprofile'
      responses:
        '200':
          $ref: '#/components/responses/AvProfile'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgAntivirusProfile
      tags:
      - Orgs Antivirus Profiles
components:
  responses:
    AvProfilesArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/AvProfilesArrayExample'
          schema:
            $ref: '#/components/schemas/avprofiles'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/AvProfilesArrayExample'
          schema:
            $ref: '#/components/schemas/avprofiles'
      description: OK
    OK:
      description: OK
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    AvProfile:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/AvProfileExample'
          schema:
            $ref: '#/components/schemas/avprofile'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/AvProfileExample'
          schema:
            $ref: '#/components/schemas/avprofile'
      description: OK
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    avprofile_id:
      in: path
      name: avprofile_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      description: Maximum number of results to return per page
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
    page:
      description: Select the page number to return when using page-based pagination; starts at `1`
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
  schemas:
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    strings:
      description: Unique string values returned or accepted by this schema
      items:
        type: string
      type: array
      uniqueItems: true
    org_id:
      description: Unique identifier of a Mist organization
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    response_http401:
      additionalProperties: false
      description: Standard HTTP 401 authentication error response
      properties:
        detail:
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    response_http429:
      additionalProperties: false
      description: Standard HTTP 429 rate limit error response
      properties:
        detail:
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
    avprofile_protocols:
      description: 'List of network protocols monitored by the antivirus profile. enum: `ftp`, `http`, `imap`, `pop3`, `smtp`'
      items:
        $ref: '#/components/schemas/avprofile_protocol'
      minItems: 1
      type: array
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    avprofile_protocol:
      description: 'Protocol that can be inspected by an antivirus profile. enum: `ftp`, `http`, `imap`, `pop3`, `smtp`'
      enum:
      - ftp
      - http
      - imap
      - pop3
      - smtp
      type: string
    response_http400:
      additionalProperties: false
      description: Standard HTTP 400 bad request error response
      properties:
        detail:
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    site_id:
      description: Unique identifier of a Mist site
      examples:
      - 441a1214-6928-442a-8e92-e1d34b8ec6a6
      format: uuid
      readOnly: true
      type: string
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    avprofiles:
      description: List of antivirus scanning profiles
      items:
        $ref: '#/components/schemas/avprofile'
      type: array
    response_http404:
      additionalProperties: false
      description: Standard HTTP 404 not found error response
      properties:
        id:
          description: Missing resource identifier, when the API includes one
          type: string
      type: object
    avprofile:
      description: Antivirus scanning profile with protocols, limits, and whitelist settings
      properties:
        created_time:
          $ref: '#/components/schemas/created_time'
          description: Timestamp when this antivirus profile was created
        fallback_action:
          $ref: '#/components/schemas/avprofile_fallback_action'
          description: Action to take when antivirus scanning cannot complete
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier of the antivirus profile
        max_filesize:
          default: 10000
          description: Maximum file size scanned by this antivirus profile, in KB
          maximum: 40000
          minimum: 20
          type: integer
        mime_whitelist:
          $ref: '#/components/schemas/strings'
          description: Content MIME types exempted from antivirus scanning
        modified_time:
          $ref: '#/components/schemas/modified_time'
          description: Timestamp when this antivirus profile was last modified
        name:
          description: Display name of the antivirus profile
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
          description: Owning organization identifier for this antivirus profile
        protocols:
          $ref: '#/components/schemas/avprofile_protocols'
          description: Network protocols inspected by this antivirus profile
        site_id:
          $ref: '#/components/schemas/site_id'
          description: Associated site identifier for this antivirus profile, when site-scoped
        url_whitelist:
          $ref: '#/components/schemas/strings'
          description: Allowed URL entries exempted from antivirus scanning
      required:
      - name
      type: object
    avprofile_fallback_action:
      description: 'Action applied when antivirus scanning cannot complete. enum: `block`, `log-and-permit`, `permit`'
      enum:
      - block
      - log-and-permit
      - permit
      type: string
  examples:
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    AvProfileExample:
      value:
        fallback_action: permit
        max_filesize: 10000
        mime_whitelist: []
        name: av-custom
        protocols:
        - http
        url_whitelist: []
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    AvProfilesArrayExample:
      value:
      - fallback_action: permit
        max_filesize: 10000
        mime_whitelist: []
        name: av-custom
        protocols:
        - http
        url_whitelist: []
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  securitySchemes:
    apiToken:
      description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n  `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
      in: header
      name: Authorization
      type: apiKey
    csrfToken:
      description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.


        **Format**:

        ```

        X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx

        ```


        For automation, API Token authentication is preferred.'
      in: header
      name: X-CSRFToken
      type: apiKey