A Mist Tunnel (MxTunnel) is a configuration object that allows for the tunneling of user VLANs from the Access Points (APs) to a central point on the network. It specifies the VLAN IDs that need to be tunneled and assigns the tunnel to a primary or secondary mist edge cluster. The mist tunnel also includes settings for tunnel fail over, auto-preemption, and other parameters related to tunnel termination services.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs MxTunnels API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'A Mist Tunnel (MxTunnel) is a configuration object that allows for the tunneling of user VLANs from the Access Points (APs) to a central point on the network.
It specifies the VLAN IDs that need to be tunneled and assigns the tunnel to a primary or secondary mist edge cluster. The mist tunnel also includes settings for tunnel fail over, auto-preemption, and other parameters related to tunnel termination services.'
name: Orgs MxTunnels
paths:
/api/v1/orgs/{org_id}/mxtunnels:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: List organization Mist Tunnel configurations used to carry AP user VLANs to Mist Edge clusters.
operationId: listOrgMxTunnels
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/MxtunnelsArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgMxTunnels
tags:
- Orgs MxTunnels
post:
description: Create an organization Mist Tunnel configuration, including hosting Mist Edge clusters, VLANs, heartbeat settings, and optional IPsec settings.
operationId: createOrgMxTunnel
requestBody:
content:
application/json:
examples:
Example:
value:
cluster_ids:
- string
hello_interval: 60
hello_retries: 7
ipsec:
dns_servers:
- string
enabled: true
extra_routes:
- dest: string
next_hop: 192.168.0.1
split_tunnel: true
use_mxedge: true
vlan_ids:
- 0
schema:
$ref: '#/components/schemas/mxtunnel'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Mxtunnel'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgMxTunnel
tags:
- Orgs MxTunnels
/api/v1/orgs/{org_id}/mxtunnels/{mxtunnel_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/mxtunnel_id'
delete:
description: Delete an organization Mist Tunnel configuration by Mist Tunnel ID.
operationId: deleteOrgMxTunnel
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgMxTunnel
tags:
- Orgs MxTunnels
get:
description: Retrieve configuration details for a specific organization Mist Tunnel, including cluster, VLAN, heartbeat, IPsec, and preemption settings.
operationId: getOrgMxTunnel
responses:
'200':
$ref: '#/components/responses/Mxtunnel'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgMxTunnel
tags:
- Orgs MxTunnels
put:
description: Update an organization Mist Tunnel configuration, including cluster membership, VLANs, heartbeat settings, IPsec, and preemption behavior.
operationId: updateOrgMxTunnel
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/mxtunnel'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Mxtunnel'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgMxTunnel
tags:
- Orgs MxTunnels
components:
parameters:
mxtunnel_id:
in: path
name: mxtunnel_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
page:
description: Select the page number to return when using page-based pagination; starts at `1`
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
responses:
MxtunnelsArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/MxtunnelsArrayExample'
schema:
$ref: '#/components/schemas/mxtunnels'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/MxtunnelsArrayExample'
schema:
$ref: '#/components/schemas/mxtunnels'
description: OK
OK:
description: OK
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
Mxtunnel:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/MxtunnelExample'
schema:
$ref: '#/components/schemas/mxtunnel'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/MxtunnelExample'
schema:
$ref: '#/components/schemas/mxtunnel'
description: OK
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
schemas:
mxtunnel:
description: Mist Tunnel configuration for tunneling AP user VLANs to Mist Edge clusters
properties:
anchor_mxtunnel_ids:
$ref: '#/components/schemas/mxtunnel_anchor_mxtunnel_ids'
description: IDs of anchor Mist Tunnels used for edge-to-edge tunnel formation
auto_preemption:
$ref: '#/components/schemas/auto_preemption'
description: Preemption behavior for restoring preferred tunnel peers after failover
created_time:
$ref: '#/components/schemas/created_time'
description: Timestamp when the Mist Tunnel was created
for_site:
description: Whether this Mist Tunnel is scoped to a site
readOnly: true
type: boolean
hello_interval:
default: 60
description: In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by `hello_retries`.
maximum: 300
minimum: 1
type:
- integer
- 'null'
hello_retries:
default: 7
description: Number of missed hello heartbeats before an AP tries another tunnel peer
maximum: 30
minimum: 2
type:
- integer
- 'null'
id:
$ref: '#/components/schemas/id'
description: Unique identifier of the Mist Tunnel
ipsec:
$ref: '#/components/schemas/mxtunnel_ipsec'
description: Security settings for IPsec support on this Mist Tunnel
modified_time:
$ref: '#/components/schemas/modified_time'
description: Timestamp when the Mist Tunnel was last modified
mtu:
default: 0
description: 0 to enable PMTU, 552-1500 to start PMTU with a lower MTU
maximum: 1500
minimum: 0
type: integer
mxcluster_ids:
$ref: '#/components/schemas/mxtunnel_mxcluster_ids'
description: Mist Edge cluster IDs that host this Mist Tunnel
name:
description: Display name of the Mist Tunnel
type:
- string
- 'null'
org_id:
$ref: '#/components/schemas/org_id'
description: Identifier of the org that owns the Mist Tunnel
protocol:
$ref: '#/components/schemas/mxtunnel_protocol'
description: Encapsulation protocol used for the Mist Tunnel
site_id:
$ref: '#/components/schemas/site_id'
description: Identifier of the site when the Mist Tunnel is site-scoped
vlan_ids:
$ref: '#/components/schemas/mxtunnel_vlan_ids'
description: List of VLAN IDs carried by this Mist Tunnel
type: object
mxtunnel_ipsec_dns_servers:
description: Name server addresses advertised for IPsec tunnel clients
items:
type: string
type:
- array
- 'null'
mxtunnel_ipsec:
additionalProperties: false
description: IPsec settings for a Mist Tunnel
properties:
dns_servers:
$ref: '#/components/schemas/mxtunnel_ipsec_dns_servers'
description: Name server addresses advertised for IPsec tunnel clients
dns_suffix:
$ref: '#/components/schemas/strings'
description: Search suffixes advertised for IPsec tunnel clients
enabled:
description: Whether IPsec support is enabled for this Mist Tunnel
type: boolean
extra_routes:
$ref: '#/components/schemas/mxtunnel_ipsec_extra_routes'
description: Additional routes advertised for the IPsec tunnel
split_tunnel:
description: Whether split tunneling is enabled for IPsec clients
type: boolean
use_mxedge:
description: Whether IPsec termination uses Mist Edge
type: boolean
type: object
mxtunnels:
description: List of Mist Tunnel configurations
items:
$ref: '#/components/schemas/mxtunnel'
type: array
mxtunnel_vlan_ids:
description: List of VLAN IDs carried by this Mist Tunnel
items:
type: integer
type: array
mxtunnel_ipsec_extra_route:
additionalProperties: false
description: Extra route advertised for an IPsec tunnel
properties:
dest:
description: Route destination CIDR for the IPsec extra route
type: string
next_hop:
description: Route next-hop IPv4 address for the IPsec extra route
format: ipv4
type: string
type: object
strings:
description: Unique string values returned or accepted by this schema
items:
type: string
type: array
uniqueItems: true
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
mxtunnel_anchor_mxtunnel_ids:
description: List of anchor mxtunnels used for forming edge to edge tunnels
items:
examples:
- 1e970fec-0a7a-4d73-a472-3ef3b6a456aa
format: uuid
type: string
type: array
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
mxtunnel_ipsec_extra_routes:
description: Additional routes advertised for IPsec tunnel clients
items:
$ref: '#/components/schemas/mxtunnel_ipsec_extra_route'
type: array
auto_preemption:
additionalProperties: false
description: Schedule to preempt AP tunnels that are not connected to their preferred peer
properties:
day_of_week:
$ref: '#/components/schemas/day_of_week'
description: Scheduled weekday for auto preemption
enabled:
default: false
description: Whether auto preemption is enabled
type: boolean
time_of_day:
$ref: '#/components/schemas/time_of_day'
description: Scheduled time of day for auto preemption
type: object
site_id:
description: Unique identifier of a Mist site
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
time_of_day:
default: any
description: '`any` / HH:MM (24-hour format)'
examples:
- '12:00'
type: string
mxtunnel_mxcluster_ids:
description: Mist Edge cluster IDs that host this Mist Tunnel
items:
format: uuid
type: string
type: array
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
mxtunnel_protocol:
default: udp
description: 'Encapsulation protocol used for Mist Tunnel traffic. enum: `ip`, `udp`'
enum:
- ip
- udp
type: string
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
day_of_week:
description: 'enum: `any`, `fri`, `mon`, `sat`, `sun`, `thu`, `tue`, `wed`'
enum:
- any
- fri
- mon
- sat
- sun
- thu
- tue
- wed
type: string
examples:
MxtunnelsArrayExample:
value:
- hello_interval: 60
hello_retries: 3
ipsec:
dns_servers:
- 172.16.0.8
enabled: true
extra_routes:
- dest: 172.16.0.0/12
next_hop: 172.16.0.1
split_tunnel: true
mxcluster_ids:
- 572586b7-f97b-a22b-526c-8b97a3f609c4
name: HQ
protocol: udp
vlan_ids:
- 3
- 4
- 5
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
MxtunnelExample:
value:
cluster_ids:
- string
created_time: 0
for_site: true
hello_interval: 60
hello_retries: 7
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
ipsec:
dns_servers:
- string
enabled: true
extra_routes:
- dest: string
next_hop: 192.168.0.1
split_tunnel: true
use_mxedge: true
modified_time: 0
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
vlan_ids:
- 0
HTTP401Example:
value:
detail: Authentication credentials were not provided.
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey