Mist

Mist Orgs NAC Portals API

NAC Portals are for onboard Wireless and Wired client with 802.1X The NAC Portal is a web-based interface that allows users to authenticate and gain access to the network. It is typically used for guest access or for devices that do not have a pre-configured certificate for 802.1X authentication. It can also be used to provision certificates for devices that require them with the Mist Application. ### NAC-Based External Guest Portal Authorization / How to implement a External Guest Portal #### Context In the guest portal flow, context such as SSID, guest MAC, AP MAC is required to unique identify the guest, if it's already authorized (e.g. roam to another AP), and used to instruct the AP to stop redirecting/blocking the user traffic #### Redirect Guest Device (or CNA in MacOS/iOS term) will be redirected to, e.g. “?ap_mac=5c5b35001234&ssid=Guest&…” | Name | Type | Description | |------|------|-------------| | ap_mac | string | AP's MAC address | | site_id | string | Site ID | | device_mac | string | Device's MAC address (the device that blocks the traffic) | | ssid | string | for wireless | | port_name | string | for wired (e.g. eth0, ge-0/0/13) | | client_mac | string | Client's MAC address | #### Authorize Once the guest has gone through your portal flow, authorize them by redirect the user to ``` GET https://url_generated_by_portal_authorize_url?jwt= ``` This can be generated by ```python import jwt secret = "EIfPMOykI3lMlDdNPub2WcbqT6dNOtWwmYHAd6bY" # from portal_authorize_jwt_secret above payload = { # for wireless "ap_mac": "5c5b35001234", "wlan_id": "be22bba7-8e22-e1cf-5185-b880816fe2cf", # only for _wireless_ captive portal "client_mac": "d58f6bb4c9d8", # for wired "device_mac": "5c5b35001234", "port_name": "eth0", # only for _wired_ captive portal" "client_mac": "d58f6bb4c9d8", # common # how long should we authorize this session "minutes": 480, "expires": 1768587994, # alternatively # instead of the original URL the user is trying to go to, redirect the user to this URL "forward": "http://www.mist.com", # for testing: if authorize_only=true and authorization is successful, 200 OK will be returned instead of 302 Redirect the user to the `forward` URL "authorize_only": False } encoded_jwt = jwt.encode(payload, secret, algorithm='HS256') ```

GitHub OpenAPI

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-nac-portals-api-openapi.yml

OpenAPI Specification

mist-orgs-nac-portals-api-openapi.yml Raw ↑ 
openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs NAC Portals API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: "NAC Portals are for onboard Wireless and Wired client with 802.1X\n\nThe NAC Portal is a web-based interface that allows users to authenticate and\ngain access to the network. It is typically used for guest access or for devices\nthat do not have a pre-configured certificate for 802.1X authentication.\n\nIt can also be used to provision certificates for devices that require them with the Mist Application.\n\n\n### NAC-Based External Guest Portal Authorization / How to implement a External Guest Portal\n\n#### Context\n\nIn the guest portal flow, context such as SSID, guest MAC, AP MAC is required to unique identify the guest, if it's already authorized (e.g. roam to another AP), and used to instruct the AP to stop redirecting/blocking the user traffic\n\n#### Redirect\n\nGuest Device (or CNA in MacOS/iOS term) will be redirected to, e.g. “?ap_mac=5c5b35001234&ssid=Guest&…”\n\n| Name | Type | Description |\n |------|------|-------------|\n | ap_mac | string | AP's MAC address |\n | site_id | string | Site ID |\n | device_mac | string | Device's MAC address (the device that blocks the traffic) |\n | ssid | string | for wireless |\n | port_name | string | for wired (e.g. eth0, ge-0/0/13) |\n | client_mac | string | Client's MAC address |\n \n\n#### Authorize\n\nOnce the guest has gone through your portal flow, authorize them by redirect the user to\n\n```\nGET https://url_generated_by_portal_authorize_url?jwt=<signature>\n```\n\nThis can be generated by\n\n```python\nimport jwt\n\nsecret = \"EIfPMOykI3lMlDdNPub2WcbqT6dNOtWwmYHAd6bY\"  # from portal_authorize_jwt_secret above \npayload = {\n    # for wireless\n    \"ap_mac\": \"5c5b35001234\",\n    \"wlan_id\": \"be22bba7-8e22-e1cf-5185-b880816fe2cf\",  # only for _wireless_ captive portal\n    \"client_mac\": \"d58f6bb4c9d8\",\n\n    # for wired\n    \"device_mac\": \"5c5b35001234\",\n    \"port_name\": \"eth0\",  # only for _wired_ captive portal\"\n    \"client_mac\": \"d58f6bb4c9d8\",\n\n    # common\n    # how long should we authorize this session\n    \"minutes\": 480,  \n    \"expires\": 1768587994,  # alternatively\n    # instead of the original URL the user is trying to go to, redirect the user to this URL    \n    \"forward\": \"http://www.mist.com\",\n    # for testing: if authorize_only=true and authorization is successful, 200 OK will be returned instead of 302 Redirect the user to the `forward` URL\n    \"authorize_only\": False\n}\n\nencoded_jwt = jwt.encode(payload, secret, algorithm='HS256')\n```\n"
  name: Orgs NAC Portals
paths:
  /api/v1/orgs/{org_id}/nacportals:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: List NAC portal configurations in the organization for guest portal, guest admin, or Marvis Client onboarding workflows.
      operationId: listOrgNacPortals
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/NacPortalArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacPortals
      tags:
      - Orgs NAC Portals
    post:
      description: Create a NAC portal configuration for guest access, guest administration, or Marvis Client certificate onboarding.
      operationId: createOrgNacPortal
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_portal'
      responses:
        '200':
          $ref: '#/components/responses/NacPortal'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgNacPortal
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    delete:
      description: Delete an organization NAC portal configuration by NAC portal ID.
      operationId: deleteOrgNacPortal
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacPortal
      tags:
      - Orgs NAC Portals
    get:
      description: Retrieve configuration details for a specific NAC portal, including portal type, SSID, SSO, guest portal, certificate, and template settings.
      operationId: getOrgNacPortal
      responses:
        '200':
          $ref: '#/components/responses/NacPortal'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacPortal
      tags:
      - Orgs NAC Portals
    put:
      description: Update a NAC portal configuration, including portal type, SSID, SSO, guest portal, certificate, and template settings.
      operationId: updateOrgNacPortal
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_portal'
      responses:
        '200':
          $ref: '#/components/responses/NacPortal'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacPortal
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/failures:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    get:
      description: List recent SAML SSO failures for a NAC portal within a selected time range.
      operationId: listOrgNacPortalSsoLatestFailures
      parameters:
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/SsoLatestFailures'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacPortalSsoLatestFailures
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/portal_image:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    delete:
      description: Delete the custom background image for a NAC portal. If no image is configured, the NAC portal uses the default background image.
      operationId: deleteOrgNacPortalImage
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacPortalImage
      tags:
      - Orgs NAC Portals
    post:
      description: Upload a custom background image for a NAC portal.
      operationId: uploadOrgNacPortalImage
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/psk_portal_image'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: uploadOrgNacPortalImage
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/portal_template:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    put:
      description: Update visual template settings for a NAC portal, including alignment, primary color, logo, and Powered by visibility.
      operationId: updateOrgNacPortalTemplate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_portal_template'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacPortalTemplate
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/saml_metadata:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    get:
      description: Retrieve SAML service provider metadata for a NAC portal, including ACS URL, entity ID, logout URL, and metadata XML.
      operationId: getOrgNacPortalSamlMetadata
      responses:
        '200':
          $ref: '#/components/responses/SamlMetadata'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacPortalSamlMetadata
      tags:
      - Orgs NAC Portals
  /api/v1/orgs/{org_id}/nacportals/{nacportal_id}/saml_metadata.xml:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacportal_id'
    get:
      description: "Download NAC portal SAML service provider metadata as an XML document.\n\nExample of metadata.xml:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\"?><md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" validUntil=\"2027-10-12T21:59:01Z\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n    <md:SPSSODescriptor AuthnRequestsSigned=\"false\" WantAssertionsSigned=\"true\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n        <md:SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/logout\" />\n        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n        <md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://api.mist.com/api/v1/saml/5hdF5g/login\" index=\"0\" isDefault=\"true\"/>\n        <md:AttributeConsumingService index=\"0\">\n            <md:ServiceName xml:lang=\"en-US\">Mist</md:ServiceName>\n            <md:RequestedAttribute Name=\"Role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"true\"/>\n            <md:RequestedAttribute Name=\"FirstName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n            <md:RequestedAttribute Name=\"LastName\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:basic\" isRequired=\"false\"/>\n        </md:AttributeConsumingService>\n    </md:SPSSODescriptor>\n</md:EntityDescriptor>\n```"
      operationId: downloadOrgNacPortalSamlMetadata
      responses:
        '200':
          $ref: '#/components/responses/File'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: downloadOrgNacPortalSamlMetadata
      tags:
      - Orgs NAC Portals
components:
  schemas:
    portal_template_alignment:
      default: center
      description: 'defines alignment on portal. enum: `center`, `left`, `right`'
      enum:
      - center
      - left
      - right
      type: string
    nac_portal_sso:
      additionalProperties: false
      description: SAML SSO configuration for a NAC portal
      properties:
        idp_cert:
          description: Identity provider certificate used to verify signed SAML responses
          examples:
          - '-----BEGIN CERTIFICATE-----\n<redacted>\n-----END CERTIFICATE-----'
          type: string
        idp_sign_algo:
          $ref: '#/components/schemas/nac_portal_sso_idp_sign_algo'
          description: Signing algorithm expected for SAML assertions from the identity provider
        idp_sso_url:
          description: Identity provider Single Sign-On URL for SAML authentication
          examples:
          - https://yourorg.onelogin.com/trust/saml2/http-post/sso/138130
          type: string
        issuer:
          description: Identity provider issuer URL for SAML authentication
          examples:
          - https://app.onelogin.com/saml/metadata/138130
          type: string
        nameid_format:
          description: SAML NameID format expected from the identity provider
          examples:
          - email
          type: string
        sso_role_matching:
          $ref: '#/components/schemas/nac_portal_sso_role_matchings'
          description: Rules that map SSO role values from the identity provider to NAC portal roles
        use_sso_role_for_cert:
          description: Whether to include the matched SSO role in the issued certificate subject for later policy matching
          type: boolean
      type: object
    nac_portal_sso_role_matching:
      additionalProperties: false
      description: Mapping rule from an SSO role claim value to a NAC portal role
      properties:
        assigned:
          description: NAC portal role assigned when the SSO role value matches
          examples:
          - user
          type: string
        match:
          description: SSO role value to match from the SAML assertion
          examples:
          - Student
          type: string
      type: object
    timestamp:
      description: Epoch timestamp, in seconds
      format: double
      readOnly: true
      type: number
    response_sso_failure_search_results:
      description: SSO authentication failure records returned by the request
      items:
        $ref: '#/components/schemas/response_sso_failure_search_item'
      type: array
      uniqueItems: true
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    nac_portal_template:
      description: Visual template settings for a NAC portal
      properties:
        alignment:
          $ref: '#/components/schemas/portal_template_alignment'
          description: Text and content alignment for the NAC portal page
        color:
          default: '#1074bc'
          description: Primary color used by the NAC portal template
          type: string
        logo:
          description: Custom logo custom logo with "data:image/png;base64," format. default null, uses Juniper Mist Logo.
          type: string
        poweredBy:
          default: false
          description: Whether to hide "Powered by Juniper Mist" and email footers
          type: boolean
      type: object
    psk_portal_image:
      additionalProperties: false
      description: PSK portal image upload payload
      properties:
        file:
          contentMediaType: application/octet-stream
          description: Image binary payload to upload for the PSK portal
          type: string
        json:
          description: Metadata JSON string describing the PSK portal image upload
          type: string
      type: object
    response_http429:
      additionalProperties: false
      description: Standard HTTP 429 rate limit error response
      properties:
        detail:
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    org_id:
      description: Unique identifier of a Mist organization
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    response_http401:
      additionalProperties: false
      description: Standard HTTP 401 authentication error response
      properties:
        detail:
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    nac_portal_guest_portal:
      additionalProperties: false
      description: "Guest portal configuration when `type`==`guest_portal`. If \n  * `auth`==`none`, the user is presented with a terms of service and can click and continue.\n  * `auth`==`external`, the user is redirected to an external URL for authentication.\n  * `auth`==`multi`, the user is presented with a choice of authentication methods:\n    - social logins: facebook / google / amazon / microsoft / azure\n    - sponsor\n    - sms: supported provider: twillio\n    - email\n    - sso\n    - userpass: pre created guest list\n"
      properties:
        auth:
          $ref: '#/components/schemas/nac_portal_guest_portal_auth'
          description: Mode presented by the NAC guest portal for user authentication
        expire:
          description: If `auth`==`none` or `auth`==`multi`, whether to expire the guest after a certain time
          examples:
          - 1440
          type: integer
        external_portal_url:
          description: If `auth`==`external`, the URL to redirect the user to for authentication
          examples:
          - https://yourorg.com/external-guest-portal
          type: string
        force_reconnect:
          description: Disconnect client (workaround for reauth issues)
          type: boolean
        forward:
          description: If `auth`==`none` or `auth`==`multi`, whether to forward the user to the guest portal after authentication
          examples:
          - true
          type: boolean
        forward_url:
          description: If `auth`==`none` or `auth`==`multi`, URL to forward the user to after authentication
          examples:
          - https://yourorg.com/guest-portal-redirect
          type: string
        max_num_devices:
          default: 0
          description: Maximum number of clients allowed per guest. 0 (default, unlimited), 1-100 range
          examples:
          - 10
          maximum: 100
          minimum: 0
          type: integer
        privacy:
          description: If `auth`==`none` or `auth`==`multi`, whether to show the privacy policy
          examples:
          - true
          type: boolean
      type: object
    response_sso_failure_search_item:
      additionalProperties: false
      description: SSO authentication failure record
      properties:
        detail:
          description: Failure details reported for the SSO authentication attempt
          type: string
        saml_assertion_xml:
          description: SAML assertion XML captured for the failed SSO authentication attempt
          type: string
        timestamp:
          $ref: '#/components/schemas/timestamp'
          description: Epoch timestamp, in seconds, when the SSO authentication failure occurred
      required:
      - timestamp
      - detail
      - saml_assertion_xml
      type: object
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    nac_portal_sso_role_matchings:
      description: List of SSO role mapping rules for the NAC portal
      items:
        $ref: '#/components/schemas/nac_portal_sso_role_matching'
      type: array
    response_http400:
      additionalProperties: false
      description: Standard HTTP 400 bad request error response
      properties:
        detail:
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    nac_portal_additional_cacerts:
      description: Optional list of additional CA certificates to be used
      examples:
      - - '-----BEGIN CERTIFICATE-----\<redacted>\n-----END CERTIFICATE-----'
      items:
        type: string
      type: array
    nac_portal_sso_idp_sign_algo:
      default: sha256
      description: 'Signing algorithm for SAML Assertion. enum: `sha1`, `sha256`, `sha384`, `sha512`.'
      enum:
      - sha1
      - sha256
      - sha384
      - sha512
      type: string
    nac_portal_guest_portal_auth:
      description: 'Guest portal authentication type. enum: `external`, `multi`, `none`'
      enum:
      - external
      - multi
      - none
      type: string
    nac_portal_eap_type:
      default: wpa2
      description: 'EAP mode used when onboarding wireless clients through the NAC portal. enum: `wpa2`, `wpa3`'
      enum:
      - wpa2
      - wpa3
      type: string
    nac_portals:
      description: List of NAC portal configurations
      items:
        $ref: '#/components/schemas/nac_portal'
      type: array
    response_sso_failure_search:
      additionalProperties: false
      description: Response containing recent SSO authentication failure records
      properties:
        results:
          $ref: '#/components/schemas/response_sso_failure_search_results'
          description: SSO authentication failure records returned by the request
      required:
      - results
      type: object
    nac_portal_type:
      description: "enum: \n  * `guest_admin`: NAC-Based Portal Admin for Pre Created Guest Authentication\n  * `guest_portal`: NAC-Based Guest Portal\n  * `marvis_client`\n"
      enum:
      - guest_admin
      - guest_portal
      - marvis_client
      type: string
    nac_portal:
      description: NAC portal configuration for 802.1X onboarding, guest access, or Marvis client certificate provisioning
      properties:
        access_type:
          $ref: '#/components/schemas/nac_portal_access_type'
          description: If `type`==`marvis_client`, whether onboarding applies to wireless clients or both wireless and wired clients
        additional_cacerts:
          $ref: '#/components/schemas/nac_portal_additional_cacerts'
          description: Additional CA certificates trusted during NAC portal certificate onboarding
        additional_nac_server_name:
          description: Optional list of additional NAC server names
          examples:
          - - nac1.corp.com
            - nac2.corp.com
          items:
            type: string
          type: array
        bg_image_url:
          description: URL of the NAC portal background image
          type: string
        cert_expire_time:
          description: Validity duration for portal-issued client certificates, in days
          examples:
          - 365
          type: integer
        eap_type:
          $ref: '#/components/schemas/nac_portal_eap_type'
          description: EAP mode used when onboarding wireless clients through the NAC portal
        enable_telemetry:
          description: Model, version, fingering, events (connecting, disconnect, roaming), which ap
          type: boolean
        expiry_notification_time:
          description: Number of days before certificate expiration to start sending reminder notifications
          type: integer
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier of the NAC portal
        name:
          description: Human-readable name of the NAC portal
          examples:
          - get-wifi
          type: string
        notify_expiry:
          description: Whether to send reminder notifications before portal-issued certificates expire
          type: boolean
        org_id:
          $ref: '#/components/schemas/org_id'
          description: Organization that owns this NAC portal
        portal:
          $ref: '#/components/schemas/nac_portal_guest_portal'
          description: Guest portal settings used when `type`==`guest_portal`
        portal_authorize_jwt_secret:
          description: If `type`==`guest_portal` and `auth`==`external`, the `portal_authorize_jwt_secret` will be generated
          examples:
          - 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
          readOnly: true
          type: string
        portal_authorize_url:
          description: If `type`==`guest_portal` and `auth`==`external`, the `portal_authorize_url` will be generated
          examples:
          - https://guest-mistnac.mist.com/callback/be22bba7-8e22-e1cf-5185-b880816fe2cf/authorize
          readOnly: true
          type: string
        portal_sso_url:
          description: If `type`==`guest_portal` or `type`==`guest_admin` and ans SSO is enabled, the `portal_sso_url` will be generated (which needs to be configured in your IDP
          examples:
          - https://guest-mistnac.mist.com/callback/be22bba7-8e22-e1cf-5185-b880816fe2cf/acs
          readOnly: true
          type: string
        ssid:
          description: Wireless SSID associated with the NAC portal
          examples:
          - Corp
          type: string
        sso:
          $ref: '#/components/schemas/nac_portal_sso'
          description: SAML SSO settings for NAC portal authentication and role mapping
        template_url:
          description: URL for the NAC portal template customization resource
          type: string
        thumbnail_url:
          description: Read-only URL of the NAC portal background image thumbnail
          readOnly: true
          type: string
        tos:
          description: Terms of service text shown in the NAC portal
          type: string
        type:
          $ref: '#/components/schemas/nac_portal_type'
          description: NAC portal mode, such as guest admin, guest portal, or Marvis client onboarding
        ui_url:
          description: If `auth`==`guest_admin`, the URL to the guest admin portal
          examples:
          - https://guest-mistnac.mist.com/admin/51908ea7-dea7-4581-a578-f7320c4d5216/login
          readOnly: true
          type: string
      type: object
    response_http404:
      additionalProperties: false
      description: Standard HTTP 404 not found error response
      properties:
        id:
          description: Missing resource identifier, when the API includes one
          type: string
      type: object
    saml_metadata:
      additionalProperties: false
      description: Read-only SAML and SCIM metadata generated for an SSO configuration
      properties:
        acs_url:
          description: If `idp_type`==`saml`, Assertion Consumer Service URL that receives SAML responses for this Mist SSO configuration
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/login
          readOnly: true
          type: string
        entity_id:
          description: If `idp_type`==`saml`, service provider entity ID for this Mist SSO configuration
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/login
          readOnly: true
          type: string
        logout_url:
          description: If `idp_type`==`saml`, Single Logout URL used by the identity provider to end the Mist SSO session
          examples:
          - https://api.mist.com/api/v1/saml/llDfa13f/logout
          readOnly: true
          type: string
        metadata:
          description: If `idp_type`==`saml`, service provider metadata XML for configuring the identity provider
          examples:
          - <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://api.mist.com/api/v1/saml/llDfa13f/login" validUntil="2027-10-12T21:59:01Z" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https:/

# --- truncated at 32 KB (42 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-nac-portals-api-openapi.yml