Mist Orgs NAC Rules API

openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs NAC Rules API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'The NAC Rules (or Auth Policies) are a set of rules that devices and users must fulfill in order to gain access to the network and use network resources.


    Juniper Mist Access Assurance evaluates authentication requests based on the specified policy conditions. If a user or device satisfies the conditions, Mist Access Assurance applies actions that either allow or deny access to the user or device.


    These actions can also apply attributes such as VLAN and role to the allowed users. Mist Access Assurance uses "NAC Tags" (or Auth Policy Labels) as the policy matching criteria and as a policy action for allowed users. NAC Tags can be managed with the [Orgs NAC Tags API Calls]($h/Orgs%20NAC%20Tags/_overview)'
  name: Orgs NAC Rules
paths:
  /api/v1/orgs/{org_id}/nacrules:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: List organization NAC authentication policy rules with evaluation order.
      operationId: listOrgNacRules
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/NacRulesArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacRules
      tags:
      - Orgs NAC Rules
    post:
      description: Create a NAC authentication policy rule with match and not-match criteria, an allow or block action, optional result tags, and rule priority.
      operationId: createOrgNacRule
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  action: allow
                  apply_tags:
                  - c049dfcd-0c73-5014-1c64-062e9903f1e5"
                  matching:
                    auth_type: eap-tls
                    nactags:
                    - 041d5d36-716c-4cfb-4988-3857c6aa14a2
                    - a809a97f-d599-f812-eb8c-c3f84aabf6ba
                    port_types:
                    - wired
                    site_ids:
                    - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
                    - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
                    sitegroup_ids:
                    - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
                    - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
                  name: name1
                  not_matching: {}
                  order: 1
            schema:
              $ref: '#/components/schemas/nac_rule'
      responses:
        '200':
          $ref: '#/components/responses/NacRule'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgNacRule
      tags:
      - Orgs NAC Rules
  /api/v1/orgs/{org_id}/nacrules/{nacrule_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nacrule_id'
    delete:
      description: Delete an organization NAC authentication policy rule by rule ID.
      operationId: deleteOrgNacRule
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacRule
      tags:
      - Orgs NAC Rules
    get:
      description: Retrieve configuration details for a specific NAC authentication policy rule, including action, matching criteria, dry-run state, and priority.
      operationId: getOrgNacRule
      responses:
        '200':
          $ref: '#/components/responses/NacRule'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacRule
      tags:
      - Orgs NAC Rules
    put:
      description: Update a NAC authentication policy rule, including match and not-match criteria, action, result tags, dry-run state, and priority.
      operationId: updateOrgNacRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_rule'
      responses:
        '200':
          $ref: '#/components/responses/NacRule'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacRule
      tags:
      - Orgs NAC Rules
components:
  schemas:
    nac_rule_matching:
      additionalProperties: false
      description: Criteria used to include or exclude a NAC authentication request from a rule
      properties:
        auth_type:
          $ref: '#/components/schemas/nac_auth_type'
          description: NAC authentication method that must match the request
        family:
          $ref: '#/components/schemas/nac_rule_matching_family'
          description: Client device family values that must match the request
        mfg:
          $ref: '#/components/schemas/nac_rule_matching_model'
          description: Client device manufacturer values that must match the request
        model:
          $ref: '#/components/schemas/nac_rule_matching_mfg'
          description: Client device model values that must match the request
        nactags:
          $ref: '#/components/schemas/nac_rule_matching_nactags'
          description: NAC tag IDs whose match criteria must be satisfied by the request
        os_type:
          $ref: '#/components/schemas/nac_rule_matching_os_type'
          description: Client OS type values that must match the request
        port_types:
          $ref: '#/components/schemas/nac_rule_matching_port_types'
          description: Wired or wireless access types that must match the request
        site_ids:
          $ref: '#/components/schemas/nac_rule_matching_site_ids'
          description: Site IDs where the rule criteria apply
        sitegroup_ids:
          $ref: '#/components/schemas/nac_rule_matching_sitegroup_ids'
          description: Site group IDs where the rule criteria apply
        vendor:
          $ref: '#/components/schemas/nac_rule_matching_vendor'
          description: Client device vendor values that must match the request
      type: object
    nac_rule_matching_site_ids:
      description: List of site ids to match
      examples:
      - - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
        - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
      items:
        format: uuid
        type: string
      type: array
    nac_rule_apply_tags:
      description: All optional, this goes into Access-Accept
      examples:
      - - c049dfcd-0c73-5014-1c64-062e9903f1e5
      items:
        type: string
      type: array
    nac_rule_matching_os_type:
      description: List of client device os types to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed os_type values
      items:
        type: string
      type: array
    nac_rules:
      description: List of NAC authentication policy rules
      items:
        $ref: '#/components/schemas/nac_rule'
      type: array
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    org_id:
      description: Unique identifier of a Mist organization
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    response_http401:
      additionalProperties: false
      description: Standard HTTP 401 authentication error response
      properties:
        detail:
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    response_http429:
      additionalProperties: false
      description: Standard HTTP 429 rate limit error response
      properties:
        detail:
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
    nac_rule_matching_model:
      description: List of client device models to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed model values
      items:
        type: string
      type: array
    nac_rule_matching_nactags:
      description: NAC tag identifiers used as rule-matching criteria
      examples:
      - - 041d5d36-716c-4cfb-4988-3857c6aa14a2
        - a809a97f-d599-f812-eb8c-c3f84aabf6ba
      items:
        type: string
      type: array
    nac_rule_matching_port_type:
      description: 'Port attachment type matched by a NAC rule. enum: `wired`, `wireless`'
      enum:
      - wired
      - wireless
      type: string
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    nac_auth_type:
      description: 'enum: `cert`, `device-auth`, `eap-teap`, `eap-tls`, `eap-ttls`, `idp`, `mab`, `eap-peap`'
      enum:
      - cert
      - device-auth
      - eap-teap
      - eap-tls
      - eap-ttls
      - idp
      - mab
      - eap-peap
      examples:
      - eap-tls
      type: string
    nac_rule_action:
      description: 'Allow or block decision applied when the NAC rule matches. enum: `allow`, `block`'
      enum:
      - allow
      - block
      examples:
      - allow
      type: string
    nac_rule:
      description: NAC authentication policy rule that matches request criteria and applies an allow or block action
      properties:
        action:
          $ref: '#/components/schemas/nac_rule_action'
          description: Allow or block decision applied when the NAC rule matches
        apply_tags:
          $ref: '#/components/schemas/nac_rule_apply_tags'
          description: NAC tag IDs to include in the Access-Accept when the rule allows access
        created_time:
          $ref: '#/components/schemas/created_time'
          description: Epoch timestamp when the NAC rule was created
        dry_run:
          description: Whether the NAC rule is in dry-run mode, where matches are logged but the action is not enforced
          type: boolean
        enabled:
          default: true
          description: Whether the NAC rule is evaluated during policy matching
          type: boolean
        guest_auth_state:
          $ref: '#/components/schemas/nac_rule_guest_auth_state'
          description: Guest portal authorization state condition for the rule
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier of the NAC rule
        matching:
          $ref: '#/components/schemas/nac_rule_matching'
          description: Criteria that must match for the NAC rule to apply
        modified_time:
          $ref: '#/components/schemas/modified_time'
          description: Epoch timestamp when the NAC rule was last modified
        name:
          description: Human-readable name of the NAC rule
          type: string
        not_matching:
          $ref: '#/components/schemas/nac_rule_matching'
          description: Criteria that must not match for the NAC rule to apply
        order:
          description: Rule priority; lower values are evaluated with higher priority
          examples:
          - 1
          minimum: 0
          type: integer
        org_id:
          $ref: '#/components/schemas/org_id'
          description: Org identifier that owns the NAC rule
      required:
      - action
      - name
      type: object
    response_http400:
      additionalProperties: false
      description: Standard HTTP 400 bad request error response
      properties:
        detail:
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    nac_rule_matching_port_types:
      description: Wired or wireless access types used as NAC rule-matching criteria
      examples:
      - - wired
      items:
        $ref: '#/components/schemas/nac_rule_matching_port_type'
      type: array
    nac_rule_matching_sitegroup_ids:
      description: List of sitegroup ids to match
      examples:
      - - bb19fc3e-4124-4b57-80d9-c3f6edce47c4
        - bb19fc3e-6564-4b57-80d9-c3f6edce47c1
      items:
        format: uuid
        type: string
      type: array
    nac_rule_matching_mfg:
      description: List of client device manufacturers to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed mfg values
      items:
        type: string
      type: array
    nac_rule_matching_vendor:
      description: List of vendors to match
      items:
        examples:
        - cisc
        type: string
      type: array
    nac_rule_matching_family:
      description: List of client device families to match. Refer to [List Fingerprint Types]](/#operations/listFingerprintTypes) for allowed family values
      items:
        type: string
      type: array
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    response_http404:
      additionalProperties: false
      description: Standard HTTP 404 not found error response
      properties:
        id:
          description: Missing resource identifier, when the API includes one
          type: string
      type: object
    nac_rule_guest_auth_state:
      description: 'Guest portal authorization state. enum: `authorized`, `unknown`'
      enum:
      - authorized
      - unknown
      examples:
      - authorized
      type: string
  parameters:
    nacrule_id:
      in: path
      name: nacrule_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      description: Maximum number of results to return per page
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
    page:
      description: Select the page number to return when using page-based pagination; starts at `1`
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
  responses:
    OK:
      description: OK
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
    NacRule:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/nac_rule'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/nac_rule'
      description: Example response
    NacRulesArray:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/NacRulesArrayExample'
          schema:
            $ref: '#/components/schemas/nac_rules'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/NacRulesArrayExample'
          schema:
            $ref: '#/components/schemas/nac_rules'
      description: Example response
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
  examples:
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    NacRulesArrayExample:
      value:
      - action: allow
        apply_tags:
        - string
        created_time: 0
        id: 455f6eca-6276-4993-bfeb-53cbbbba6208
        matching:
          auth_type: eap-tls
          nactags:
          - string
          port_types:
          - wireless
          site_ids:
          - 454f6eca-6276-4993-bfeb-53cbbbba6308
          sitegroup_ids:
          - 453f6eca-6276-4993-bfeb-53cbbbba6408
        modified_time: 0
        name: string
        not_matching:
          auth_type: eap-tls
          nactags:
          - string
          port_types:
          - wireless
          site_ids:
          - 452f6eca-6276-4993-bfeb-53cbbbba6508
          sitegroup_ids:
          - 451f6eca-6276-4993-bfeb-53cbbbba6608
        order: 1
        org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
  securitySchemes:
    apiToken:
      description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n  `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
      in: header
      name: Authorization
      type: apiKey
    csrfToken:
      description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.


        **Format**:

        ```

        X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx

        ```


        For automation, API Token authentication is preferred.'
      in: header
      name: X-CSRFToken
      type: apiKey