Mist Orgs AP Templates API
AP Templates are defining Wi-Fi and AP settings that can be assigned to Access Points based on different types of rules. AP Templates must be assigned to one or multiple sites to be used.
OpenAPI Specification
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs AP Templates API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'AP Templates are defining Wi-Fi and AP settings that can be assigned to Access Points based on different types of rules.
AP Templates must be assigned to one or multiple sites to be used.'
name: Orgs AP Templates
paths:
/api/v1/orgs/{org_id}/aptemplates:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: List organization AP templates that define AP matching rules, port configuration, Wi-Fi, and mesh settings for assignment to sites.
operationId: listOrgAptemplates
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/AptemplatesArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgAptemplates
tags:
- Orgs AP Templates
post:
description: Create an organization AP template with AP matching rules, port configuration, Wi-Fi settings, and mesh settings.
operationId: createOrgAptemplate
requestBody:
content:
application/json:
examples:
Example:
value:
ap_matching:
enabled: true
rules:
- match_model: string
name: string
port_config:
property1:
disabled: true
dynamic_vlan:
default_vlan_id: 999
enabled: true
type: string
vlans:
1-10: null
user: null
enable_mac_auth: false
forwarding: all
mx_tunnel_id: 08cd7499-5841-51c8-e663-fb16b6f3b45e
mxtunnel_name: string
port_auth: none
port_vlan_id: 1
radius_config:
acct_interim_interval: 0
acct_servers:
- host: 1.2.3.4
keywrap_enabled: true
keywrap_format: hex
keywrap_kek: '1122334455'
keywrap_mack: '1122334455'
port: 1813
secret: testing123
auth_servers:
- host: 1.2.3.4
keywrap_enabled: true
keywrap_format: hex
keywrap_kek: '1122334455'
keywrap_mack: '1122334455'
port: 1812
secret: testing123
auth_servers_retries: 3
auth_servers_timeout: 5
coa_enabled: false
coa_port: 3799
network: string
source_ip: string
radsec:
enabled: true
idle_timeout: 60
mxcluster_ids:
- 572586b7-f97b-a22b-526c-8b97a3f609c4
proxy_hosts:
- mxedge1.local
server_name: radsec.abc.com
servers:
- host: 1.1.1.1
port: 1812
use_mxedge: true
use_site_mxedge: false
vlan_id: 9
vlan_ids: 1, 10, 50
wxtunnel_id: 7dae216d-7c98-a51b-e068-dd7d477b7216
wxtunnel_remote_id: wifiguest
property2:
disabled: true
dynamic_vlan:
default_vlan_id: 999
enabled: true
type: string
vlans:
1-10: null
user: null
enable_mac_auth: false
forwarding: all
mx_tunnel_id: 08cd7499-5841-51c8-e663-fb16b6f3b45e
mxtunnel_name: string
port_auth: none
port_vlan_id: 1
radius_config:
acct_interim_interval: 0
acct_servers:
- host: 1.2.3.4
keywrap_enabled: true
keywrap_format: hex
keywrap_kek: '1122334455'
keywrap_mack: '1122334455'
port: 1813
secret: testing123
auth_servers:
- host: 1.2.3.4
keywrap_enabled: true
keywrap_format: hex
keywrap_kek: '1122334455'
keywrap_mack: '1122334455'
port: 1812
secret: testing123
auth_servers_retries: 3
auth_servers_timeout: 5
coa_enabled: false
coa_port: 3799
network: string
source_ip: string
radsec:
enabled: true
idle_timeout: 60
mxcluster_ids:
- 572586b7-f97b-a22b-526c-8b97a3f609c4
proxy_hosts:
- mxedge1.local
server_name: radsec.abc.com
servers:
- host: 1.1.1.1
port: 1812
use_mxedge: true
use_site_mxedge: false
vlan_id: 9
vlan_ids: 1, 10, 50
wxtunnel_id: 7dae216d-7c98-a51b-e068-dd7d477b7216
wxtunnel_remote_id: wifiguest
wifi:
cisco_enabled: true
disable_11k: false
disable_radios_when_power_constrained: true
enable_arp_spoof: true
enable_shared_radio_scanning: false
enabled: true
locate_connected: false
locate_unconnected: false
mesh_allow_dfs: false
mesh_enable_crm: true
mesh_enabled: true
proxy_arp: false
schema:
$ref: '#/components/schemas/ap_template'
responses:
'200':
$ref: '#/components/responses/Aptemplate'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgAptemplate
tags:
- Orgs AP Templates
/api/v1/orgs/{org_id}/aptemplates/{aptemplate_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/aptemplate_id'
delete:
description: Delete an organization AP template by template ID from this organization.
operationId: deleteOrgAptemplate
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgAptemplate
tags:
- Orgs AP Templates
get:
description: Return one organization AP template, including AP matching rules, port configuration, Wi-Fi settings, and mesh settings.
operationId: getOrgAptemplate
responses:
'200':
$ref: '#/components/responses/Aptemplate'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgAptemplate
tags:
- Orgs AP Templates
put:
description: Update an organization AP template's AP matching rules, port configuration, Wi-Fi settings, or mesh settings.
operationId: updateOrgAptemplate
requestBody:
content:
application/json:
examples:
Example:
value:
ap_matching:
enabled: true
rules:
- match_model: string
name: string
port_config:
eth1,eth2:
disabled: true
dynamic_vlan:
default_vlan_id: 999
enabled: true
port_vlan_id: 1
vlan_id: 9
vlan_ids: 1, 10, 50
wifi:
cisco_enabled: true
disable_11k: false
disable_radios_when_power_constrained: true
enable_arp_spoof: true
enable_shared_radio_scanning: false
enabled: true
locate_connected: false
locate_unconnected: false
mesh_allow_dfs: false
mesh_enable_crm: true
mesh_enabled: true
proxy_arp: false
schema:
$ref: '#/components/schemas/ap_template'
responses:
'200':
$ref: '#/components/responses/Aptemplate'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgAptemplate
tags:
- Orgs AP Templates
components:
parameters:
aptemplate_id:
in: path
name: aptemplate_id
required: true
schema:
format: uuid
type: string
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
page:
description: Select the page number to return when using page-based pagination; starts at `1`
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
schemas:
ap_template:
description: Access point template configuration
properties:
ap_matching:
$ref: '#/components/schemas/ap_template_matching'
description: Rules used to select access points for this AP template
created_time:
$ref: '#/components/schemas/created_time'
description: Timestamp when the AP template was created
for_site:
description: Whether the AP template is scoped to a site rather than the organization
readOnly: true
type: boolean
id:
$ref: '#/components/schemas/id'
description: Unique identifier of the AP template
modified_time:
$ref: '#/components/schemas/modified_time'
description: Timestamp when the AP template was last modified
org_id:
$ref: '#/components/schemas/org_id'
description: Organization that owns this AP template
site_id:
$ref: '#/components/schemas/site_id'
description: Site that owns this site-level AP template
wifi:
$ref: '#/components/schemas/ap_template_wifi'
description: Wi-Fi and mesh settings applied by this AP template
required:
- ap_matching
type: object
ap_template_matching_rules:
description: Ordered AP template matching rules
items:
$ref: '#/components/schemas/ap_template_matching_rule'
type: array
uniqueItems: true
radius_auth_servers:
description: List of RADIUS authentication servers
items:
$ref: '#/components/schemas/radius_auth_server'
type: array
uniqueItems: true
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
ap_port_config:
additionalProperties: false
description: Ethernet port behavior settings for an access point
properties:
disabled:
default: false
description: Whether this AP Ethernet port is disabled
type: boolean
dynamic_vlan:
$ref: '#/components/schemas/ap_port_config_dynamic_vlan'
description: RADIUS-assigned VLAN settings for AP port authentication
enable_mac_auth:
default: false
description: Whether MAC authentication is enabled on this AP port
type: boolean
forwarding:
$ref: '#/components/schemas/ap_port_config_forwarding'
description: Traffic forwarding mode for this AP Ethernet port
mac_auth_preferred:
default: false
description: When `true`, we'll do dot1x then mac_auth. enable this to prefer mac_auth
type: boolean
mac_auth_protocol:
$ref: '#/components/schemas/ap_port_config_mac_auth_protocol'
description: Protocol used for MAC authentication when `enable_mac_auth` is `true`
mist_nac:
$ref: '#/components/schemas/wlan_mist_nac'
description: Juniper Mist NAC settings used by AP port authentication
mx_tunnel_id:
default: ''
description: If `forwarding`==`mxtunnel`, vlan_ids comes from mxtunnel
examples:
- 08cd7499-5841-51c8-e663-fb16b6f3b45e
format: uuid
type: string
mxtunnel_name:
default: ''
description: If `forwarding`==`site_mxedge`, vlan_ids comes from site_mxedge (`mxtunnel` under site setting)
type: string
port_auth:
$ref: '#/components/schemas/ap_port_config_port_auth'
description: Authentication mode for this AP Ethernet port
port_vlan_id:
description: If `forwarding`==`limited`. VLAN ID allowed on this AP Ethernet port
examples:
- 1
maximum: 4094
minimum: 1
type: integer
radius_config:
$ref: '#/components/schemas/radius_config'
description: RADIUS authentication and accounting settings for this AP port
radsec:
$ref: '#/components/schemas/radsec'
description: TLS-secured RADIUS settings for this AP port
vlan_id:
description: "Optional to specify the VLAN ID for a tunnel if forwarding is for `wxtunnel`, `mxtunnel` or `site_mxedge`.\n * if vlan_id is not specified then it will use first one in vlan_ids[] of the mxtunnel.\n * if forwarding == site_mxedge, vlan_ids comes from site_mxedge (`mxtunnel` under site setting)"
examples:
- 9
maximum: 4094
minimum: 1
type: integer
vlan_ids:
description: If `forwarding`==`limited`, comma separated list of additional VLAN IDs allowed on this port
examples:
- 10,20,30
type: string
wxtunnel_id:
default: ''
description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
examples:
- 7dae216d-7c98-a51b-e068-dd7d477b7216
format: uuid
type: string
wxtunnel_remote_id:
default: ''
description: If `forwarding`==`wxtunnel`, the port is bridged to the vlan of the session
examples:
- wifiguest
type: string
type: object
radius_auth_port:
anyOf:
- maximum: 65545
minimum: 1
type: integer
- type: string
description: RADIUS Auth Port, value from 1 to 65535, default is 1812
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
ap_port_config_dynamic_vlan_type:
description: 'Mapping mode for interpreting dynamic VLAN attributes returned by RADIUS.\ \ enum: `airespace-interface-name`, where the VLAN is determined by parsing\ \ the RADIUS attribute as an Airespace interface name (e.g. "guest"\ \ would map to VLAN 100), or `standard`, where the VLAN is determined by parsing\ \ the RADIUS attribute as a standard VLAN ID number'
enum:
- airespace-interface-name
- standard
type: string
ap_template_wifi:
additionalProperties: false
description: Wi-Fi behavior settings applied by an AP template
properties:
cisco_enabled:
description: Whether Cisco-specific Wi-Fi compatibility behavior is enabled
type: boolean
disable_11k:
default: false
description: Whether 802.11k neighbor reports are disabled
type: boolean
disable_radios_when_power_constrained:
description: Whether AP radios are disabled when power is constrained
type: boolean
enable_arp_spoof:
description: Whether ARP spoofing checks are enabled when proxy ARP is used
type: boolean
enable_shared_radio_scanning:
default: false
description: Whether shared radio scanning is enabled for AP radio scanning
type: boolean
enabled:
default: true
description: Whether Wi-Fi settings in this AP template are enabled
type: boolean
locate_connected:
default: false
description: Whether location tracking is enabled for connected clients
type: boolean
locate_unconnected:
default: false
description: Whether location tracking is enabled for unconnected clients
type: boolean
mesh_allow_dfs:
default: false
description: Whether mesh links may use DFS channels, which can add CAC delays during scanning
type: boolean
mesh_enable_crm:
description: Whether CRM is enabled for mesh networking in this AP template
type: boolean
mesh_enabled:
description: Whether mesh networking is enabled by this AP template
type: boolean
proxy_arp:
default: false
description: Whether proxy ARP is enabled for Wi-Fi clients
type: boolean
type: object
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
radius_acct_port:
anyOf:
- maximum: 65545
minimum: 1
type: integer
- type: string
description: RADIUS Auth Port, value from 1 to 65535, default is 1813
radius_acct_server:
additionalProperties: false
description: RADIUS accounting server settings
properties:
host:
description: Address or hostname of the RADIUS accounting server
examples:
- 1.2.3.4
type: string
keywrap_enabled:
description: Whether RADIUS keywrap is enabled for messages sent to this accounting server
type: boolean
keywrap_format:
$ref: '#/components/schemas/radius_keywrap_format'
description: Encoding format for RADIUS keywrap KEK and MACK values
keywrap_kek:
description: RADIUS keywrap key encryption key (KEK)
examples:
- '1122334455'
type: string
keywrap_mack:
description: RADIUS keywrap message authentication code key (MACK)
examples:
- '1122334455'
type: string
port:
$ref: '#/components/schemas/radius_acct_port'
description: UDP port used by the RADIUS accounting server
secret:
description: Shared secret used with this RADIUS accounting server
examples:
- testing123
format: password
type: string
required:
- host
- secret
type: object
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
radsec_proxy_hosts:
description: Default is site.mxedge.radsec.proxy_hosts which must be a superset of all `wlans[*].radsec.proxy_hosts`. When `radsec.proxy_hosts` are not used, tunnel peers (org or site Mist Edges) are used irrespective of `use_site_mxedge`
items:
examples:
- mxedge1.local
type: string
type: array
radsec_servers:
description: External RadSec servers. Only if not Mist Edge.
items:
$ref: '#/components/schemas/radsec_server'
type: array
uniqueItems: true
radius_auth_server:
additionalProperties: false
description: RADIUS authentication server settings
properties:
host:
description: Address or hostname of the RADIUS authentication server
examples:
- 1.2.3.4
type: string
keywrap_enabled:
description: Whether RADIUS keywrap is enabled for messages sent to this authentication server
type: boolean
keywrap_format:
$ref: '#/components/schemas/radius_keywrap_format'
description: Encoding format for RADIUS keywrap KEK and MACK values
keywrap_kek:
description: RADIUS keywrap key encryption key (KEK)
examples:
- '1122334455'
type: string
keywrap_mack:
description: RADIUS keywrap message authentication code key (MACK)
examples:
- '1122334455'
type: string
port:
$ref: '#/components/schemas/radius_auth_port'
description: UDP port used by the RADIUS authentication server
require_message_authenticator:
default: false
description: Whether to require Message-Authenticator in requests
type: boolean
secret:
description: Shared secret used with this RADIUS authentication server
examples:
- testing123
format: password
type: string
required:
- host
- secret
type: object
radius_keywrap_format:
description: 'Encoding format for RADIUS keywrap KEK and MACK values. enum: `ascii`, `hex`'
enum:
- ascii
- hex
type: string
ap_port_config_forwarding:
default: all
description: "enum: \n * `all`: local breakout, All VLANs\n * `limited`: local breakout, only the VLANs configured in `port_vlan_id` and `vlan_ids`\n * `mxtunnel`: central breakout to an Org Mist Edge (requires `mxtunnel_id`)\n * `site_mxedge`: central breakout to a Site Mist Edge (requires `mxtunnel_name`)\n * `wxtunnel`': central breakout to an Org WxTunnel (requires `wxtunnel_id`)"
enum:
- all
- limited
- mxtunnel
- site_mxedge
- wxtunnel
examples:
- all
type: string
radius_acct_servers:
description: List of RADIUS accounting servers
items:
$ref: '#/components/schemas/radius_acct_server'
type: array
uniqueItems: true
wlan_mist_nac:
additionalProperties: false
description: Mist NAC RADIUS settings for a WLAN
properties:
acct_interim_interval:
default: 0
description: How frequently should interim accounting be reported, 60-65535. default is 0 (use one specified in Access-Accept request from Server). Very frequent messages can affect the performance of the RADIUS server, 600 and up is recommended when enabled.
examples:
- 60
maximum: 65535
minimum: 0
type: integer
auth_servers_retries:
default: 2
description: RADIUS auth session retries. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "retries" are set to value of `auth_servers_timeout`. "max-requests" is also set when setting `auth_servers_retries` is set to default value to 3.
examples:
- 3
maximum: 10
minimum: 1
type: integer
auth_servers_timeout:
default: 5
description: RADIUS auth session timeout. Following fast timers are set if `fast_dot1x_timers` knob is enabled. "quite-period" and "transmit-period" are set to half the value of `auth_servers_timeout`. "supplicant-timeout" is also set when setting `auth_servers_timeout` is set to default value of 10.
examples:
- 5
maximum: 30
minimum: 1
type: integer
coa_enabled:
default: false
description: Allows a RADIUS server to dynamically modify the authorization status of a user session.
type: boolean
coa_port:
description: the communication port used for “Change of Authorization” (CoA) messages
examples:
- 3799
maximum: 65535
minimum: 1
type: integer
enabled:
default: false
description: "When enabled:\n * `auth_servers` is ignored\n * `acct_servers` is ignored\n * `auth_servers_*` are ignored\n * `coa_servers` is ignored\n * `radsec` is ignored\n * `coa_enabled` is assumed"
type: boolean
fast_dot1x_timers:
default: false
description: If set to true, sets default fast-timers with values calculated from `auth_servers_timeout` and `auth_server_retries`.
type: boolean
network:
description: Which network the mist nac server resides in
examples:
- default
type:
- string
- 'null'
source_ip:
description: In case there is a static IP for this network, we can specify it using source ip
examples:
- 1.2.3.4
type:
- string
- 'null'
type: object
ap_template_matching_rule:
additionalProperties: false
description: Model and name match criteria for an AP template port configuration
properties:
match_model:
description: Access point model matched by this AP template rule
minLength: 1
type: string
name:
description: Display label for this AP template matching rule
minLength: 1
type: string
port_config:
additionalProperties:
$ref: '#/components/schemas/ap_port_config'
description: Property key is the interface(s) name (e.g. "eth1,eth2")
type: object
type: object
ap_port_config_dynamic_vlan:
additionalProperties: false
description: Dynamic VLAN assignment settings for AP port authentication
properties:
default_vlan_id:
description: Fallback VLAN ID used when RADIUS does
# --- truncated at 32 KB (45 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-ap-templates-api-openapi.yml