Mist Orgs Clients - NAC API
NAC Clients are devices connected to the network and authenticated by Juniper Mist Access Assurance.
OpenAPI Specification
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs Clients - NAC API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: NAC Clients are devices connected to the network and authenticated by Juniper Mist Access Assurance.
name: Orgs Clients - NAC
paths:
/api/v1/orgs/{org_id}/nac_clients/count:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Count NAC clients across the organization, optionally grouped by `distinct` and filtered by authentication, identity, endpoint, network, site, and time attributes.
operationId: countOrgNacClients
parameters:
- description: 'Field used to group this count response. enum: `ap`, `auth_type`, `device_mac`, `edr_managed`, `edr_provider`, `edr_status`, `family`, `hostname`, `idp_id`, `mfg`, `mdm_compliance`, `mdm_managed`, `mdm_provider`, `model`, `mxedge_id`, `nacrule_matched`, `nacrule_name`, `nacrule_id`, `nas_ip`, `nas_vendor`, `os`, `site_id`, `ssid`, `status`, `type`, `usermac_label`, `username`, `vlan`'
in: query
name: distinct
schema:
$ref: '#/components/schemas/org_nac_clients_count_distinct'
- description: NAC Policy Rule ID, if matched
in: query
name: last_nacrule_id
schema:
type: string
- description: NAC Policy Rule Matched
in: query
name: nacrule_matched
schema:
type: boolean
- description: Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"
in: query
name: auth_type
schema:
type: string
- description: Filter results by last VLAN ID
in: query
name: last_vlan_id
schema:
type: string
- description: Vendor of NAS device
in: query
name: last_nas_vendor
schema:
type: string
- description: SSO ID, if present and used
in: query
name: idp_id
schema:
type: string
- description: Filter results by last SSID
in: query
name: last_ssid
schema:
type: string
- description: Username presented by the client
in: query
name: last_username
schema:
type: string
- description: Filter results by site identifier
in: query
name: site_id
schema:
type: string
- description: AP MAC connected to by client
in: query
name: last_ap
schema:
type: string
- description: Filter results by MAC address
in: query
name: mac
schema:
type: string
- description: Connection status of client i.e "permitted", "denied, "session_ended"
in: query
name: last_status
schema:
type: string
- description: Client type i.e. "wireless", "wired" etc. Accepts multiple comma-separated values.
in: query
name: type
schema:
examples:
- wired,wireless
type: string
- description: MDM compliance of client i.e "compliant", "not compliant"
in: query
name: mdm_compliance_status
schema:
type: string
- description: MDM provider of client’s organization eg "intune", "jamf"
in: query
name: mdm_provider
schema:
type: string
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
responses:
'200':
$ref: '#/components/responses/Count'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: countOrgNacClients
tags:
- Orgs Clients - NAC
/api/v1/orgs/{org_id}/nac_clients/events/count:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Count NAC client events across the organization, optionally grouped by `distinct` and filtered by event type and time range.
operationId: countOrgNacClientEvents
parameters:
- description: 'Field used to group this count response. enum: `ap`, `auth_type`, `dryrun_nacrule_id`, `mac`, `nacrule_id`, `nas_vendor`, `ssid`, `type`, `username`, `vlan`'
in: query
name: distinct
schema:
$ref: '#/components/schemas/org_nac_client_events_count_distinct'
- description: See [List Device Events Definitions](/#operations/listNacEventsDefinitions). Accepts multiple comma-separated values.
in: query
name: type
schema:
examples:
- NAC_CLIENT_PERMIT,NAC_SESSION_STARTED
type: string
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
responses:
'200':
$ref: '#/components/responses/Count'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: countOrgNacClientEvents
tags:
- Orgs Clients - NAC
/api/v1/orgs/{org_id}/nac_clients/events/search:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Search NAC client authentication event records across the organization with filters for authentication, NAC rule, identity provider, RADIUS, network, endpoint, site, and time attributes.
operationId: searchOrgNacClientEvents
parameters:
- description: See [List Device Events Definitions](/#operations/listNacEventsDefinitions). Accepts multiple comma-separated values.
in: query
name: type
schema:
examples:
- NAC_CLIENT_PERMIT,NAC_SESSION_STARTED
type: string
- description: NAC Policy Rule ID, if matched. Accepts multiple comma-separated values.
in: query
name: nacrule_id
schema:
examples:
- 00000000-0000-0000-0000-000000000001,00000000-0000-0000-0000-000000000002
format: uuid
type: string
- description: NAC Policy Rule Matched
in: query
name: nacrule_matched
schema:
type: boolean
- description: NAC Policy Dry Run Rule ID, if present and matched
in: query
name: dryrun_nacrule_id
schema:
type: string
- description: True - if dryrun rule present and matched with priority, False - if not matched or not present
in: query
name: dryrun_nacrule_matched
schema:
type: boolean
- description: Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth". Accepts multiple comma-separated values.
in: query
name: auth_type
schema:
examples:
- mab,eap-tls
type: string
- description: Filter results by VLAN ID. Accepts multiple comma-separated integer values.
in: query
name: vlan
schema:
examples:
- 250,10
type: integer
- description: Vendor of NAS device
in: query
name: nas_vendor
schema:
type: string
- description: Filter results by BSSID
in: query
name: bssid
schema:
type: string
- description: SSO ID, if present and used
in: query
name: idp_id
schema:
format: uuid
type: string
- description: IDP returned roles/groups for the user
in: query
name: idp_role
schema:
type: string
- description: Username presented to the Identity Provider
in: query
name: idp_username
schema:
type: string
- description: RADIUS attributes returned by NAC to NAS derive
in: query
name: resp_attrs
schema:
$ref: '#/components/schemas/resp_attrs'
- description: Filter results by SSID
in: query
name: ssid
schema:
type: string
- description: Filter results by username. Accepts multiple comma-separated values.
in: query
name: username
schema:
examples:
- john.doe,jane.doe
type: string
- description: Filter results by one site identifier. Use a single value; comma-separated values are not supported
in: query
name: site_id
schema:
type: string
- description: Filter results by AP MAC address
in: query
name: ap
schema:
type: string
- description: Filter results by whether the client is using a randomized MAC address. Accepts multiple comma-separated boolean values.
in: query
name: random_mac
schema:
examples:
- true,false
type: boolean
- description: Filter results by one MAC address. Use a single value; comma-separated values are not supported
in: query
name: mac
schema:
type: string
- description: Labels derived from usermac entry
in: query
name: usermac_label
schema:
type: string
- description: Partial / full MAC address, username, device_mac or ap
in: query
name: text
schema:
type: string
- description: IP address of NAS device. Accepts multiple comma-separated values.
in: query
name: nas_ip
schema:
examples:
- 192.0.2.10,192.0.2.11
type: string
- description: Vendor specific VLAN ID in RADIUS requests
in: query
name: ingress_vlan
schema:
type: string
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/sort_wcid'
- $ref: '#/components/parameters/search_after'
responses:
'200':
$ref: '#/components/responses/EventsNacClientSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: searchOrgNacClientEvents
tags:
- Orgs Clients - NAC
/api/v1/orgs/{org_id}/nac_clients/search:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Search NAC client records across the organization with filters for authentication, endpoint posture, identity, network, NAC rule, site, and time attributes.
operationId: searchOrgNacClients
parameters:
- description: MAC address of the AP the client is/was connected to
in: query
name: ap
schema:
type: string
- description: Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth". Accepts multiple comma-separated values.
in: query
name: auth_type
schema:
examples:
- mab,eap-tls
type: string
- description: Filter by certificate expiry within a specific duration from now (e.g., "7d" for 7 days, "1m" for 1 month). Accepts multiple comma-separated values.
in: query
name: cert_expiry_duration
schema:
examples:
- 7d,1m
- 7d
- 1m
type: string
- description: Filters NAC clients that are integrated with EDR providers
in: query
name: edr_managed
schema:
type: boolean
- description: 'EDR provider used to filter NAC clients. enum: `crowdstrike`, `sentinelone`'
in: query
name: edr_provider
schema:
$ref: '#/components/schemas/edr_provider'
- description: 'EDR status used to filter NAC clients. enum: `sentinelone_healthy`, `sentinelone_infected`, `crowdstrike_low`, `crowdstrike_medium`, `crowdstrike_high`, `crowdstrike_critical`, `crowdstrike_informational`'
in: query
name: edr_status
schema:
$ref: '#/components/schemas/edr_status'
- description: Partial / full Client family (e.g. "Phone/Tablet/Wearable", "Access Point"). Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `Surveillance*` and `*urveillance*` match `Surveillance Camera`). Suffix-only wildcards (e.g. `*Camera`) are not supported. Accepts multiple comma-separated values.
in: query
name: family
schema:
examples:
- Surveillance Camera,Surveillance*
- Surveillance Camera
- Surveillance*
- '*urveillance*'
type: string
- description: Partial / full Client hostname. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `everest*` and `*rest*` match `my-everest-client`). Suffix-only wildcards (e.g. `*everest`) are not supported. Accepts multiple comma-separated values.
in: query
name: hostname
schema:
examples:
- my-everest-client,my-everest*
- my-everest-client
- my-everest*
- '*everest*'
type: string
- description: SSO ID, if present and used
in: query
name: idp_id
schema:
type: string
- description: Partial / full Client MAC address. Use a single value; comma-separated values are not supported. Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `aabbcc*` and `*bbcc*` match `aabbccddeeff`). Suffix-only wildcards (e.g. `*bccddeeff`) are not supported
in: query
name: mac
schema:
examples:
- aabbccddeeff
- aabbcc*
- '*bbcc*'
type: string
- description: MDM compliance of client i.e "compliant", "not compliant"
in: query
name: mdm_compliance
schema:
type: string
- description: MDM provider of client’s organization eg "intune", "jamf"
in: query
name: mdm_provider
schema:
type: string
- description: Filters NAC clients that are managed by MDM providers
in: query
name: mdm_managed
schema:
type: boolean
- description: Partial / full Client manufacturer (e.g. "apple", "cisco", "juniper"). Use `prefix*` for prefix search or `*substring*` for contains search (e.g. `Raspberry Pi*` and `*Pi*` match `Raspberry Pi Trading Ltd`). Suffix-only wildcards (e.g. `*Ltd`) are not supported. Accepts multiple comma-separated values.
in: query
name: mfg
schema:
examples:
- Raspberry Pi Trading Ltd,Raspberry Pi*
- Raspberry Pi Trading Ltd
- Raspberry Pi*
- '*Pi*'
type: string
- description: Client model, e.g. "iPhone 12", "MX100"
in: query
name: model
schema:
type: string
- description: NAC Policy Rule Name matched
in: query
name: nacrule_name
schema:
type: string
- description: NAC Policy Rule ID, if matched
in: query
name: nacrule_id
schema:
type: string
- description: NAC Policy Rule Matched
in: query
name: nacrule_matched
schema:
type: boolean
- description: Vendor of NAS device
in: query
name: nas_vendor
schema:
type: string
- description: IP address of NAS device. Accepts multiple comma-separated values.
in: query
name: nas_ip
schema:
examples:
- 192.0.2.10,192.0.2.11
type: string
- description: Vendor specific VLAN ID in RADIUS requests
in: query
name: ingress_vlan
schema:
type: string
- description: Client OS, e.g. "iOS 18.1", "Android", "Windows", "Linux"
in: query
name: os
schema:
type: string
- description: Filter results by SSID
in: query
name: ssid
schema:
type: string
- description: 'Client connection status used to filter results. enum: `permitted`, `session_started`, `session_stopped`, `denied`'
in: query
name: status
schema:
$ref: '#/components/schemas/nac_client_last_status'
- description: partial / full MAC address, last_username, device_mac, nas_ip or last_ap
in: query
name: text
schema:
type: string
- description: Client type i.e. "wireless", "wired" etc. Accepts multiple comma-separated values.
in: query
name: type
schema:
examples:
- wired,wireless
type: string
- description: Labels derived from usermac entry
in: query
name: usermac_label
schema:
$ref: '#/components/schemas/strings'
- description: Filter results by username
in: query
name: username
schema:
type: string
- description: Filter results by VLAN ID
in: query
name: vlan
schema:
type: string
- description: Filter results by one site identifier. Use a single value; comma-separated values are not supported
in: query
name: site_id
schema:
type: string
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/sort_wcid'
- $ref: '#/components/parameters/search_after'
responses:
'200':
$ref: '#/components/responses/ClientNacSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: searchOrgNacClients
tags:
- Orgs Clients - NAC
/api/v1/orgs/{org_id}/nac_clients/{client_mac}/coa:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/client_mac'
post:
description: Sends CoA (Change of Authorization) command to a NAC client.
operationId: sendOrgNacClientCoA
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/nac_client_coa'
description: Request Body
responses:
'200':
$ref: '#/components/responses/NacClientCoa'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: sendOrgNacClientCoA
tags:
- Orgs Clients - NAC
components:
schemas:
nac_nacrule_name:
description: Name of the NAC Rules used to authenticate the client for the specified duration
examples:
- - Wireless Cert Auth
items:
type: string
readOnly: true
type: array
last_cert_expiry:
description: When certificate based authentication is used, the expiration date from the latest certificate used
examples:
- 1746711240
type: number
nac_cert_cn:
description: When certificate based authentication is used, the CN from the certificates used for the specified duration
examples:
- - john@mycorp.net
items:
type: string
readOnly: true
type: array
timestamp:
description: Epoch timestamp, in seconds
format: double
readOnly: true
type: number
nac_nacrule_id:
description: IDs of the NAC Rules used to authenticate the client for the specified duration
examples:
- - 603b62db-d839-4152-9f7f-f2578443de8d
items:
type: string
readOnly: true
type: array
last_cert_cn:
description: When certificate based authentication is used, the CN from the latest certificate used
examples:
- john@mycorp.net
type: string
nac_client_coa:
additionalProperties: false
description: Change of Authorization request for a NAC client
properties:
coa_type:
$ref: '#/components/schemas/nac_coa_type'
description: Change of Authorization command to send to the NAC client
type: object
nac_access_type:
description: 'Type of network access. enum: `wireless`, `wired`, `vty`'
enum:
- wireless
- wired
- vty
examples:
- wireless
type: string
nac_client_username:
description: List of usernames that have been assigned to the client
items:
type: string
readOnly: true
type: array
nac_nas_vendor:
description: Vendor name of the NAS for the specified duration
examples:
- - juniper-mist
items:
type: string
readOnly: true
type: array
nac_ssid:
description: SSIDs the client was connected to for the specified duration
examples:
- - MyCorp-NAC
items:
type: string
type: array
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
nac_client_mac:
description: Client MAC address observed in the NAC event
examples:
- ac3eb179e535
readOnly: true
type: string
nac_port_id:
description: Port-ids the client was connected to for the specified duration
examples:
- - ge-0/0/17.0
items:
type: string
readOnly: true
type: array
nac_coa_type:
default: reauth
description: 'CoA type to send. enum: `reauth`, `disconnect`'
enum:
- reauth
- disconnect
type: string
last_cert_serial:
description: When certificate based authentication is used, the Serial from the latest certificate used
examples:
- 2c63510123456789
type: string
org_nac_clients_count_distinct:
default: type
description: 'enum: `ap`, `auth_type`, `device_mac`, `edr_managed`, `edr_provider`, `edr_status`, `family`, `hostname`, `idp_id`, `mfg`, `mdm_compliance`, `mdm_managed`, `mdm_provider`, `model`, `mxedge_id`, `nacrule_matched`, `nacrule_name`, `nacrule_id`, `nas_ip`, `nas_vendor`, `os`, `site_id`, `ssid`, `status`, `type`, `usermac_label`, `username`, `vlan`'
enum:
- ap
- auth_type
- device_mac
- edr_managed
- edr_provider
- edr_status
- family
- hostname
- idp_id
- mfg
- mdm_compliance
- mdm_managed
- mdm_provider
- model
- mxedge_id
- nacrule_matched
- nacrule_name
- nacrule_id
- nas_ip
- nas_vendor
- os
- site_id
- ssid
- status
- type
- usermac_label
- username
- vlan
type: string
site_id:
description: Unique identifier of a Mist site
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
nac_event_port_id:
description: Port ID where the NAC client event occurred
examples:
- ge-0/0/17.0
readOnly: true
type: string
nac_client_last_status:
description: 'Latest Authentication status of the client. enum: `denied`, `permitted`, `session_started`, `session_stopped`'
enum:
- permitted
- session_started
- session_stopped
- denied
examples:
- permitted
type: string
nac_event_nacrule_matched:
description: NAC Policy Rule Matched
readOnly: true
type: boolean
nac_cert_issuer:
description: When certificate based authentication is used, the Issuer from the certificates used for the specified duration
examples:
- - /C=US/ST=CA/CN=MyCorp
items:
type: string
readOnly: true
type: array
nac_event_type:
description: Event type, e.g. NAC_CLIENT_PERMIT. Use the [List NAC Events Definitions](/#operations/listNacEventsDefinitions) endpoint to get the full list of available values.
examples:
- NAC_CLIENT_PERMIT
readOnly: true
type: string
nac_cert_subject:
description: When certificate based authentication is used, the Subject from the certificates used for the specified duration
examples:
- - /C=US/O=MyCorp/CN=john@mycorp.net/emailAddress=john@mycorp.net
items:
type: string
readOnly: true
type: array
nac_client_events:
description: List of NAC authentication events
items:
$ref: '#/components/schemas/nac_client_event'
type: array
edr_status:
description: 'EDR Status of the NAC client. enum: `sentinelone_healthy`, `sentinelone_infected`, `crowdstrike_low`, `crowdstrike_medium`, `crowdstrike_high`, `crowdstrike_critical`, `crowdstrike_informational`'
enum:
- sentinelone_healthy
- sentinelone_infected
- crowdstrike_low
- crowdstrike_medium
- crowdstrike_high
- crowdstrike_critical
- crowdstrike_informational
type: string
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
resp_attrs:
description: List of RADIUS AVP returned by the Authentication Server
examples:
- - Tunnel-Type=VLAN
- Tunnel-Medium-Type=IEEE-802
- Tunnel-Private-Group-Id=750
- User-Name=anonymous
items:
type: string
type: array
uniqueItems: true
nac_auth_type:
description: 'enum: `cert`, `device-auth`, `eap-teap`, `eap-tls`, `eap-ttls`, `idp`, `mab`, `eap-peap`'
enum:
- cert
- device-auth
- eap-teap
- eap-tls
- eap-ttls
- idp
- mab
- eap-peap
examples:
- eap-tls
type: string
nac_device_mac:
description: MAC address of the AP or switch the client is connected to
examples:
- 60c78d8c7f6f
readOnly: true
type: string
response_client_nac_search_results:
description: NAC client records returned by a search response
items:
$ref: '#/components/schemas/client_nac'
type: array
last_client_ip:
description: The last known IP address for the client
examples:
- 10.100.0.157
type: string
nac_event_username:
description: username assigned to the client
readOnly: true
type: string
nac_client_ip:
description: The known IP addresses used by the client for the specified duration
examples:
- - 10.100.0.157
items:
type: string
readOnly: true
type: array
count_result:
additionalProperties:
type: string
description: Count result row with the matching distinct field values
properties:
count:
description: Number of matching items for the distinct value or values in this result
type: integer
required:
- count
type: object
nac_client_ap:
description: AP MAC addresses observed for the NAC client during the selected time range
examples:
- - 5c5b35bf16bb
- d4dc090041b4
items:
type: string
readOnly: true
type: array
nac_client_event_usermac_labels:
description: Labels derived from usermac entry
examples:
- - bldg5
- printer
items:
type: string
type: array
random_mac:
description: 'Whether the client is using randomized MAC address or not. enum: `true`, `false`'
enum:
- 'true'
- 'false'
type: string
nac_event_dryrun_nacrule_id:
description: NAC Policy Dry Run Rule ID, if present and matched
examples:
- 32f27e7d-ff26-4a9b-b3d1-ff9bcb264012
format: uuid
readOnly: true
type: string
last_ssid:
description: If Wireless authentication, the latest SSID the client was connected to
examples:
- MyCorp-NAC
type: string
last_cert_issuer:
description: When certificate based authentication is used, the Issuer from the latest certificate used
# --- truncated at 32 KB (61 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-clients-nac-api-openapi.yml