Mist Orgs Integration SkyATP API

Sky Advanced Threat Prevention (Sky ATP) is a cloud-based security designed to detect and mitigate advanced threats in real-time, ensuring the security and integrity of your network. The integration of Sky ATP with Mist is a strategic move to enhance the security posture of wireless networks by leveraging the capabilities of both solutions. The integration of Sky ATP with Mist enhances the security of wireless networks by providing real-time threat alerts and mitigation capabilities. Here are the key benefits of this integration: * Enhanced Security: Adds another layer of security to the robust mechanisms already in place within the Mist WLAN platform. It leverages artificial intelligence (AI) for tighter security, lower operational costs, and optimized user experience. * Real-Time Threat Detection: Quickly identifies devices on the network that are infected with malware and takes appropriate actions. This ensures that security risks are assessed and mitigated promptly when users and devices are connected to wireless networks. * Improved Device Tracking: Allows for better tracking of client hosts as Mist supplies client MAC addresses to Juniper ATP Cloud. This information is crucial for identifying and mitigating threats. * Streamlined Security Events: Threat alerts detected by Juniper SRX Series Firewalls and ATP Cloud are automatically streamed to Mist, enabling administrators to quickly assess security risks and take appropriate actions such as quarantine or enforce security policies.

OpenAPI Specification

mist-orgs-integration-skyatp-api-openapi.yml Raw ↑
openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs Integration SkyATP API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: "Sky Advanced Threat Prevention (Sky ATP) is a cloud-based security designed to detect and mitigate advanced threats in real-time, ensuring the security and integrity of your network.  \nThe integration of Sky ATP with Mist is a strategic move to enhance the security posture of wireless networks by leveraging the capabilities of both solutions.\n\n\nThe integration of Sky ATP with Mist enhances the security of wireless networks by providing real-time threat alerts and mitigation capabilities. Here are the key benefits of this integration:\n\n* Enhanced Security: Adds another layer of security to the robust mechanisms already in place within the Mist WLAN platform. It leverages artificial intelligence (AI) for tighter security, lower operational costs, and optimized user experience.\n* Real-Time Threat Detection: Quickly identifies devices on the network that are infected with malware and takes appropriate actions. This ensures that security risks are assessed and mitigated promptly when users and devices are connected to wireless networks.\n* Improved Device Tracking: Allows for better tracking of client hosts as Mist supplies client MAC addresses to Juniper ATP Cloud. This information is crucial for identifying and mitigating threats.\n* Streamlined Security Events: Threat alerts detected by Juniper SRX Series Firewalls and ATP Cloud are automatically streamed to Mist, enabling administrators to quickly assess security risks and take appropriate actions such as quarantine or enforce security policies."
  name: Orgs Integration SkyATP
paths:
  /api/v1/orgs/{org_id}/setting/skyatp/secintel_allowlist:
    parameters:
    - $ref: '#/components/parameters/org_id'
    put:
      description: Update the Sky ATP SecIntel allowlist with domain and IP address entries for the organization.
      operationId: udpateOrgAtpAllowedList
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  domains:
                  - comment: restricted
                    value: unsafe.xxx
                  ips:
                  - comment: nas
                    value: 10.1.3.5
            schema:
              $ref: '#/components/schemas/skyatp_list'
      responses:
        '200':
          $ref: '#/components/responses/SkyAtpList'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: udpateOrgAtpAllowedList
      tags:
      - Orgs Integration SkyATP
  /api/v1/orgs/{org_id}/setting/skyatp/secintel_blocklist:
    parameters:
    - $ref: '#/components/parameters/org_id'
    put:
      description: Update the Sky ATP SecIntel blocklist with domain and IP address entries for the organization.
      operationId: udpateOrgAtpBlockedList
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  domains:
                  - comment: restricted
                    value: unsafe.xxx
                  ips:
                  - comment: nas
                    value: 10.1.3.5
            schema:
              $ref: '#/components/schemas/skyatp_list'
      responses:
        '200':
          $ref: '#/components/responses/SkyAtpList'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: udpateOrgAtpBlockedList
      tags:
      - Orgs Integration SkyATP
  /api/v1/orgs/{org_id}/setting/skyatp/setup:
    parameters:
    - $ref: '#/components/parameters/org_id'
    delete:
      description: Remove the Sky ATP integration configuration from the organization.
      operationId: deleteOrgSkyAtpIntegration
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgSkyAtpIntegration
      tags:
      - Orgs Integration SkyATP
    get:
      description: Return the Sky ATP integration configuration, including linked realm information and generated SecIntel allowlist and blocklist URLs.
      operationId: getOrgSkyAtpIntegration
      responses:
        '200':
          $ref: '#/components/responses/AccountSkyAtpInfo'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSkyAtpIntegration
      tags:
      - Orgs Integration SkyATP
    post:
      description: Configure the Sky ATP integration by linking or creating the Sky ATP realm with the supplied cloud, realm, username, and password. The integration enables Security Intelligence and Advanced Anti-Malware features, with SecIntel configuration for command-and-control, DNS feeds, infected hosts, blocklists, and allowlists.
      operationId: setupOrgAtpIntegration
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  cloud_name: www.amerskyatp.com
                  password: foryoureyesonly
                  realm: mist-team
                  username: john@abc.com
            schema:
              $ref: '#/components/schemas/account_skyatp_config'
      responses:
        '200':
          $ref: '#/components/responses/AccountSkyAtpInfo'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: setupOrgAtpIntegration
      tags:
      - Orgs Integration SkyATP
    put:
      description: Update Sky ATP SecIntel feed configuration, including the third-party threat feeds enabled for the organization.
      operationId: udpateOrgAtpIntegration
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  secintel:
                    third_party_threat_feeds:
                    - block_list
            schema:
              $ref: '#/components/schemas/account_skyatp_data'
      responses:
        '200':
          $ref: '#/components/responses/AccountSkyAtpData'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: udpateOrgAtpIntegration
      tags:
      - Orgs Integration SkyATP
components:
  parameters:
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
  responses:
    OK:
      description: OK
    AccountSkyAtpData:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/account_skyatp_info'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/account_skyatp_info'
      description: OK
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    SkyAtpList:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/SkyAtpListExample'
          schema:
            $ref: '#/components/schemas/skyatp_list'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/SkyAtpListExample'
          schema:
            $ref: '#/components/schemas/skyatp_list'
      description: OK
    AccountSkyAtpInfo:
      content:
        application/json:
          example:
            Example:
              value:
                secintel:
                  third_party_threat_feeds:
                  - block_list
                secintel_allowlist_url: https://papi.s3.amazonaws.com/secintel_allowlist/xxx...
                secintel_blocklist_url: https://papi.s3.amazonaws.com/secintel_blocklist/xxx...
          schema:
            $ref: '#/components/schemas/account_skyatp_data'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/account_skyatp_data'
      description: OK
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  schemas:
    strings:
      description: Unique string values returned or accepted by this schema
      items:
        type: string
      type: array
      uniqueItems: true
    skyatp_list_ips:
      description: IP address entries in a Sky ATP SecIntel list
      items:
        $ref: '#/components/schemas/skyatp_list_ip'
      type: array
    response_http401:
      additionalProperties: false
      description: Standard HTTP 401 authentication error response
      properties:
        detail:
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    skyatp_list:
      description: Sky ATP SecIntel allowlist or blocklist entries
      properties:
        domains:
          $ref: '#/components/schemas/skyatp_list_domains'
          description: SecIntel domain entries in this Sky ATP list
        ip:
          $ref: '#/components/schemas/skyatp_list_ips'
          description: SecIntel IP address entries in this Sky ATP list
      type: object
    response_http429:
      additionalProperties: false
      description: Standard HTTP 429 rate limit error response
      properties:
        detail:
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    account_skyatp_config:
      description: Sky ATP account credentials and realm settings used for integration
      properties:
        cloud_name:
          $ref: '#/components/schemas/account_skyatp_cloud_name'
          description: Sky ATP cloud endpoint used for the integration
        password:
          description: Credential password for the Sky ATP realm user
          examples:
          - foryoureyesonly
          format: password
          type: string
        realm:
          description: Sky ATP realm to create or link with this Mist organization
          examples:
          - mist-team
          type: string
        username:
          description: Sky ATP username used to create or access the realm
          examples:
          - john@abc.com
          type: string
      required:
      - realm
      - username
      - password
      type: object
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    account_skyatp_data_secintel:
      additionalProperties: false
      description: "juniper secintel_feeds are enabled depending on your license tier: infected_host, geo_ip, attacker_ip, command_and_control.\nthird party:\n  * ip-based: block_list, threatfox_ip, feodo_tracker, dshield, tor\n  * url-based: threatfox_url, urlhaus, open_phish\n  * domain-based: threatfox_domains"
      properties:
        third_party_threat_feeds:
          $ref: '#/components/schemas/strings'
          description: Third-party threat feed names enabled for SecIntel
      type: object
    response_http400:
      additionalProperties: false
      description: Standard HTTP 400 bad request error response
      properties:
        detail:
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    skyatp_list_domains:
      description: Domain entries in a Sky ATP SecIntel list
      items:
        $ref: '#/components/schemas/skyatp_list_domain'
      type: array
    skyatp_list_ip:
      additionalProperties: false
      description: IP address entry in a Sky ATP SecIntel list
      properties:
        comment:
          description: Optional note describing the IP address list entry
          examples:
          - nas
          type: string
        value:
          description: IP address included in the Sky ATP SecIntel list
          examples:
          - 10.1.3.5
          type: string
      required:
      - value
      type: object
    account_skyatp_info:
      additionalProperties: false
      description: Linked Sky ATP account and realm information
      properties:
        cloud_name:
          $ref: '#/components/schemas/account_skyatp_cloud_name'
          description: Sky ATP cloud endpoint configured for the integration
        realm:
          description: Sky ATP realm linked with this Mist organization
          examples:
          - mist-team
          type: string
        username:
          description: Sky ATP username configured for the linked realm
          examples:
          - john@abc.com
          type: string
      type: object
    account_skyatp_data:
      description: Sky ATP SecIntel feed data and generated list URLs
      properties:
        secintel:
          $ref: '#/components/schemas/account_skyatp_data_secintel'
          description: Juniper SecIntel threat feed configuration provided by Sky ATP
        secintel_allowlist_url:
          description: URL for the Sky ATP SecIntel allowlist
          examples:
          - https://papi.s3.amazonaws.com/secintel_allowlist/xxx...
          readOnly: true
          type: string
        secintel_blocklist_url:
          description: URL for the Sky ATP SecIntel blocklist
          examples:
          - https://papi.s3.amazonaws.com/secintel_blocklist/xxx...
          readOnly: true
          type: string
      type: object
    response_http404:
      additionalProperties: false
      description: Standard HTTP 404 not found error response
      properties:
        id:
          description: Missing resource identifier, when the API includes one
          type: string
      type: object
    account_skyatp_cloud_name:
      description: 'Sky ATP cloud name. enum: `www.amerskyatp.com`, `www.apacskyatp.com`, `www.euroskyatp.com`, `www.canadaskyatp.com`'
      enum:
      - www.amerskyatp.com
      - www.apacskyatp.com
      - www.euroskyatp.com
      - www.canadaskyatp.com
      examples:
      - www.amerskyatp.com
      type: string
    skyatp_list_domain:
      additionalProperties: false
      description: Domain entry in a Sky ATP SecIntel list
      properties:
        comment:
          description: Optional note describing the domain list entry
          examples:
          - restricted
          type: string
        value:
          description: Domain name included in the Sky ATP SecIntel list
          examples:
          - unsafe.com
          type: string
      required:
      - value
      type: object
  examples:
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    SkyAtpListExample:
      value:
        domains:
        - comment: restricted
          value: unsafe.xxx
        ips:
        - comment: nas
          value: 10.1.3.5
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  securitySchemes:
    apiToken:
      description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n  `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
      in: header
      name: Authorization
      type: apiKey
    csrfToken:
      description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.


        **Format**:

        ```

        X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx

        ```


        For automation, API Token authentication is preferred.'
      in: header
      name: X-CSRFToken
      type: apiKey