Mist Orgs NAC Tags API

openapi: 3.2.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**


    NOTE:

    Some important API changes will be introduced.'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Orgs NAC Tags API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: NAC Tags are the building blocks to compose nacrules.
  name: Orgs NAC Tags
paths:
  /api/v1/orgs/{org_id}/nactags:
    description: "NAC Tags are the building blocks to compose NAC Rules.\n\nThey can either appear in the `matching` / `not_matching` sections of a NAC Rule,\nin which case they play the role of classifiers, or they could appear in the `apply_tags`\nsection of a NAC Rule, in which case they influence the result.\n\nWhen the `type` field of a NAC Tag is `match`, it can be used as a classifier of a NAC Rule:\n  - The `match` field specifies the attribute name and the `values` field specifies the list of\n    attribute values to match on.\n  - When multiple values are specified, they are treated as an OR condition between those values.\n    This behavior can be changed by setting the `match_all` field to `true`, in which case it is\n    treated as an AND condition between those values.\n  - By default an exact match is performed. This behavior can be changed as follows:\n    - Adding `*` at the beginning will perform a suffix match\n      (ex: `*-staff` will match `foo-staff` and `bar-staff`)\n    - Adding `*` at the end will perform a prefix match\n      (ex: `foo-*` will match `foo-staff` and `foo-interns`)\n    - Adding `*` at both ends will perform a substring match\n      (ex: `*printer*` will match `hp-printer-bldg1`, `brother-printer-lab`)\n    - Adding `!` at the beginning will perform a negation of the match\n      (ex: `!ssid-guest` will match any string that is not `ssid-guest`)\n    - Note: when negation should be used along with suffix/substring operation,\n      `!` should always precede `*`\n      (ex: `!*guest` will match any string that is not ending with `guest`)\n  - Prepending the value with the keyword `regex=` followed by a regular expression will\n    evaluate the match as a regex (instead of the wildcard behaviors above: prefix, suffix,\n    substring, or exact match).\n    (ex: `regex=^foo-(staff|interns)$` will match `foo-staff` and `foo-interns`)\n"
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: List organization NAC tags, optionally filtering by tag type, name, or match attribute.
      operationId: listOrgNacTags
      parameters:
      - description: 'Filter results by type. enum: `egress_vlan_names`, `gbp_tag`, `match`, `radius_attrs`, `radius_group`, `radius_vendor_attrs`, `redirect_nacportal_id`, `session_timeout`, `username_attr`, `vlan`. Accepts multiple comma-separated values.'
        example: match,vlan
        in: query
        name: type
        schema:
          type: string
      - description: Filter results by name. Accepts multiple comma-separated values.
        in: query
        name: name
        schema:
          examples:
          - name-a,name-b
          type: string
      - description: 'if `type`==`match`, Type of NAC Tag. enum: `cert_cn`, `cert_eku`, `cert_issuer`, `cert_san`, `cert_serial`, `cert_sub`, `cert_template`, `client_mac`, `edr_status`, `gbp_tag`, `hostname`, `idp_role`, `ingress_vlan`, `mdm_status`, `nas_ip`, `radius_group`, `realm`, `ssid`, `user_name`, `usermac_label`. Accepts multiple comma-separated values.'
        example: ssid,idp_role
        in: query
        name: match
        schema:
          type: string
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/NacTagsArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgNacTags
      tags:
      - Orgs NAC Tags
    post:
      description: Create a NAC tag used either as rule-matching criteria or as a result attribute returned when NAC allows access.
      operationId: createOrgNacTag
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_tag'
      responses:
        '200':
          $ref: '#/components/responses/NacTag'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgNacTag
      tags:
      - Orgs NAC Tags
  /api/v1/orgs/{org_id}/nactags/{nactag_id}:
    parameters:
    - $ref: '#/components/parameters/org_id'
    - $ref: '#/components/parameters/nactag_id'
    delete:
      description: Delete an organization NAC tag by tag ID so it can no longer be used by NAC rules.
      operationId: deleteOrgNacTag
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgNacTag
      tags:
      - Orgs NAC Tags
    get:
      description: Retrieve configuration details for a specific NAC tag, including type, match values, RADIUS attributes, VLAN or session results, and portal redirection settings.
      operationId: getOrgNacTag
      responses:
        '200':
          $ref: '#/components/responses/NacTag'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgNacTag
      tags:
      - Orgs NAC Tags
    put:
      description: Update a NAC tag, including matcher values or result attributes such as RADIUS attributes, VLAN, session timeout, username attribute, or portal redirection.
      operationId: updateOrgNacTag
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/nac_tag'
      responses:
        '200':
          $ref: '#/components/responses/NacTag'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgNacTag
      tags:
      - Orgs NAC Tags
components:
  examples:
    NacTagMatchesClientMac:
      value:
        match: client_mac
        name: cameras
        type: match
        values:
        - '010203040506'
        - abcdef*
    NacTagMatchesRadiusGroup:
      value:
        name: VIP_group
        radius_group: VIP
        type: radius_group
    NacTagMatchesCertSub:
      value:
        match: cert_sub
        name: subject1
        type: match
        values:
        - /C=CN/ST=defy/O=defy/OU=defy/CN=steve
    HTTP429Example:
      value:
        detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    NacTagRadiusAttrs:
      value:
        name: custom_attrs
        radius_attrs:
        - Idle-Timeout=600
        - Termination-Action=RADIUS-Request
        type: radius_attrs
    NacTagMatchesCertSerial:
      value:
        match: cert_serial
        name: serial1
        type: match
        values:
        - 6a524ab782fb468c00c59f51cff00268d95533b8
    NacTagUsernameAttr:
      value:
        allow_usermac_override: true
        name: username_attr
        type: username_attr
        username_attr: automatic
    NacTagMatchesEdrStatus:
      value:
        match: edr_status
        match_all: false
        name: edr_health
        type: match
        values:
        - sentinelone_healthy
        - sentinelone_infected
        - crowdstrike_low
        - crowdstrike_medium
        - crowdstrike_high
        - crowdstrike_critical
        - crowdstrike_informational
        - unknown
    NacTagMatchesCertIssuer:
      value:
        match: cert_issuer
        name: issuer1
        type: match
        values:
        - /C=CN/ST=defy/L=defy/O=defy/OU=defy/CN=defy
    NacTagMatchesVlan:
      value:
        name: guest_vlan
        type: vlan
        vlan: '30'
    NacTagMatchesCertCN:
      value:
        match: cert_cn
        name: staff
        type: match
        values:
        - john
        - staff*
    NacTagMatchesRole:
      value:
        match: idp_role
        name: VIP
        type: match
        values:
        - vip
    NacTagSessionTimeout:
      value:
        name: timeout
        session_timeout: 86400
        type: session_timeout
    NacTagMatchesCertEku:
      value:
        match: cert_eku
        name: EKU-Match
        type: match
        values:
        - 1.3.6.1.4.1.54321.10.1
        - 1.3.6.1.4.1.54321.20.2
    NacTagMatchesCertTemplate:
      value:
        match: cert_template
        name: templ1
        type: match
        values:
        - 1.3.6.1.4.1.311.21.8.4200806.605933.871088.11229391.9863893.29.13545645.4807979
        - 1.3.6.1.4.1.311.21.8.3285427.4093958.2707341.9961608.11572555.6.4903431.2258457
    NacTagMatchesUsername:
      value:
        match: user_name
        name: admins
        type: match
        values:
        - bob
        - steve
    HTTP403Example:
      value:
        detail: You do not have permission to perform this action.
    NacTagMatchesCertSAN:
      value:
        match: cert_san
        name: san1
        type: match
        values:
        - henry1@defy.com
    HTTP401Example:
      value:
        detail: Authentication credentials were not provided.
    NacTagMatchesRealm:
      value:
        match: realm
        name: defy
        type: match
        values:
        - defy.com
    NacTagMatchesHostname:
      value:
        match: hostname
        name: hostname1
        type: match
        values:
        - CP*
        - USR*
    NacTagEgressVlanNames:
      value:
        egress_vlan_names:
        - 1vlan-30
        - 1vlan-20
        - 2vlan10
        name: trunk_ap
        type: egress_vlan_names
    HTTP400Example:
      value:
        detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
    NacTagRadiusVendorAttrs:
      value:
        name: custom_radius_vendor_attrs
        radius_vendor_attrs:
        - PaloAlto-Admin-Role=superuser
        - PaloAlto-Panorama-Admin-Role=administrator
        type: radius_vendor_attrs
  responses:
    NacTag:
      content:
        application/json:
          examples:
            Egress Vlan Names:
              $ref: '#/components/examples/NacTagEgressVlanNames'
            Matches Cert CN:
              $ref: '#/components/examples/NacTagMatchesCertCN'
            Matches Cert EKU:
              $ref: '#/components/examples/NacTagMatchesCertEku'
            Matches Cert Issuer:
              $ref: '#/components/examples/NacTagMatchesCertIssuer'
            Matches Cert SAN:
              $ref: '#/components/examples/NacTagMatchesCertSAN'
            Matches Cert Serial:
              $ref: '#/components/examples/NacTagMatchesCertSerial'
            Matches Cert Sub:
              $ref: '#/components/examples/NacTagMatchesCertSub'
            Matches Cert Template:
              $ref: '#/components/examples/NacTagMatchesCertTemplate'
            Matches Client Mac:
              $ref: '#/components/examples/NacTagMatchesClientMac'
            Matches EDR Status:
              $ref: '#/components/examples/NacTagMatchesEdrStatus'
            Matches Hostname:
              $ref: '#/components/examples/NacTagMatchesHostname'
            Matches Radius Group:
              $ref: '#/components/examples/NacTagMatchesRadiusGroup'
            Matches Realm:
              $ref: '#/components/examples/NacTagMatchesRealm'
            Matches Role:
              $ref: '#/components/examples/NacTagMatchesRole'
            Matches Username:
              $ref: '#/components/examples/NacTagMatchesUsername'
            Matches Vlan:
              $ref: '#/components/examples/NacTagMatchesVlan'
            Radius Attrs:
              $ref: '#/components/examples/NacTagRadiusAttrs'
            Radius Vendor Attrs:
              $ref: '#/components/examples/NacTagRadiusVendorAttrs'
            Session Timeout:
              $ref: '#/components/examples/NacTagSessionTimeout'
            Username Attr:
              $ref: '#/components/examples/NacTagUsernameAttr'
          schema:
            $ref: '#/components/schemas/nac_tag'
        application/vnd.api+json:
          examples:
            Egress Vlan Names:
              $ref: '#/components/examples/NacTagEgressVlanNames'
            Matches Cert CN:
              $ref: '#/components/examples/NacTagMatchesCertCN'
            Matches Cert Issuer:
              $ref: '#/components/examples/NacTagMatchesCertIssuer'
            Matches Cert SAN:
              $ref: '#/components/examples/NacTagMatchesCertSAN'
            Matches Cert Serial:
              $ref: '#/components/examples/NacTagMatchesCertSerial'
            Matches Cert Sub:
              $ref: '#/components/examples/NacTagMatchesCertSub'
            Matches Cert Template:
              $ref: '#/components/examples/NacTagMatchesCertTemplate'
            Matches Client Mac:
              $ref: '#/components/examples/NacTagMatchesClientMac'
            Matches Hostname:
              $ref: '#/components/examples/NacTagMatchesHostname'
            Matches Radius Group:
              $ref: '#/components/examples/NacTagMatchesRadiusGroup'
            Matches Realm:
              $ref: '#/components/examples/NacTagMatchesRealm'
            Matches Role:
              $ref: '#/components/examples/NacTagMatchesRole'
            Matches Username:
              $ref: '#/components/examples/NacTagMatchesUsername'
            Matches Vlan:
              $ref: '#/components/examples/NacTagMatchesVlan'
            Radius Attrs:
              $ref: '#/components/examples/NacTagRadiusAttrs'
            Radius Vendor Attrs:
              $ref: '#/components/examples/NacTagRadiusVendorAttrs'
            Session Timeout:
              $ref: '#/components/examples/NacTagSessionTimeout'
            Username Attr:
              $ref: '#/components/examples/NacTagUsernameAttr'
          schema:
            $ref: '#/components/schemas/nac_tag'
      description: Example response
    OK:
      description: OK
    HTTP401:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP401Example'
          schema:
            $ref: '#/components/schemas/response_http401'
      description: Unauthorized
    HTTP404:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/response_http404'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/response_http404'
      description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
    HTTP400:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP400Example'
          schema:
            $ref: '#/components/schemas/response_http400'
      description: Bad Syntax
    NacTagsArray:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/nac_tags'
        application/vnd.api+json:
          schema:
            $ref: '#/components/schemas/nac_tags'
      description: Example response
    HTTP429:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP429Example'
          schema:
            $ref: '#/components/schemas/response_http429'
      description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
    HTTP403:
      content:
        application/json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
        application/vnd.api+json:
          examples:
            Example:
              $ref: '#/components/examples/HTTP403Example'
          schema:
            $ref: '#/components/schemas/response_http403'
      description: Permission Denied
  schemas:
    nac_tag_type:
      description: 'enum: `egress_vlan_names`, `gbp_tag`, `match`, `radius_attrs`, `radius_group`, `radius_vendor_attrs`, `redirect_nacportal_id`, `session_timeout`, `username_attr`, `vlan`'
      enum:
      - egress_vlan_names
      - gbp_tag
      - match
      - radius_attrs
      - radius_group
      - radius_vendor_attrs
      - redirect_nacportal_id
      - session_timeout
      - username_attr
      - vlan
      minLength: 1
      type: string
    nac_tag_egress_vlan_names:
      description: If `type`==`egress_vlan_names`, list of egress vlans to return
      examples:
      - - 1vlan-30
        - 1vlan-20
        - 2-vlan10
      items:
        type: string
      type: array
    nac_tag_gbp_tag:
      anyOf:
      - maximum: 65535
        minimum: 1
        type: integer
      - type: string
      description: If `type`==`gbp_tag`, GBP tag value returned by the NAC rule
    modified_time:
      description: When the object has been modified for the last time, in epoch
      format: double
      readOnly: true
      type: number
    nac_tag_radius_attrs:
      description: "If `type`==`radius_attrs`, user can specify a list of one or more standard attributes in the field \"radius_attrs\". \nIt is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected.\nNote that it is allowed to have more than one radius_attrs in the result of a given rule."
      examples:
      - - Idle-Timeout=600
        - Termination-Action=RADIUS-Request
      items:
        type: string
      type: array
    nac_tag_match:
      description: 'if `type`==`match`. enum: `cert_cn`, `cert_eku`, `cert_issuer`, `cert_san`, `cert_serial`, `cert_sub`, `cert_template`, `client_mac`, `edr_status`, `gbp_tag`, `hostname`, `idp_role`, `ingress_vlan`, `mdm_status`, `nas_ip`, `radius_group`, `realm`, `ssid`, `user_name`, `usermac_label`'
      enum:
      - cert_cn
      - cert_eku
      - cert_issuer
      - cert_san
      - cert_serial
      - cert_sub
      - cert_template
      - client_mac
      - edr_status
      - gbp_tag
      - hostname
      - idp_role
      - ingress_vlan
      - mdm_status
      - nas_ip
      - radius_group
      - realm
      - ssid
      - user_name
      - usermac_label
      minLength: 1
      type: string
    nac_tag:
      description: NAC tag used as a rule-matching classifier or as a result attribute for allowed users
      properties:
        allow_usermac_override:
          default: false
          description: Whether usermac result values can override this NAC tag when the result type is also supported by usermac
          type: boolean
        created_time:
          $ref: '#/components/schemas/created_time'
          description: Epoch timestamp when the NAC tag was created
        egress_vlan_names:
          $ref: '#/components/schemas/nac_tag_egress_vlan_names'
          description: If `type`==`egress_vlan_names`, list of egress VLAN names returned by the NAC rule
        gbp_tag:
          $ref: '#/components/schemas/nac_tag_gbp_tag'
          description: If `type`==`gbp_tag`, GBP tag value returned by the NAC rule
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier of the NAC tag
        match:
          $ref: '#/components/schemas/nac_tag_match'
          description: If `type`==`match`, client or authentication attribute used for rule matching
        match_all:
          default: false
          description: "This field is applicable only when `type`==`match`\n  * `false`: means it is sufficient to match any of the values (i.e., match-any behavior)\n  * `true`: means all values should be matched (i.e., match-all behavior)\n\n\nCurrently it makes sense to set this field to `true` only if the `match`==`idp_role`, `match`==`usermac_label` and `edr_status`"
          type: boolean
        modified_time:
          $ref: '#/components/schemas/modified_time'
          description: Epoch timestamp when the NAC tag was last modified
        nacportal_id:
          $ref: '#/components/schemas/redirect_nacportal_id'
          description: If `type`==`redirect_nacportal_id`, NAC portal ID used for client redirection
        name:
          description: Human-readable name of the NAC tag
          minLength: 1
          type: string
        org_id:
          $ref: '#/components/schemas/org_id'
          description: Org identifier that owns the NAC tag
        radius_attrs:
          $ref: '#/components/schemas/nac_tag_radius_attrs'
          description: If `type`==`radius_attrs`, standard RADIUS attributes returned by the NAC rule
        radius_group:
          description: If `type`==`radius_group`, RADIUS group value returned by the NAC rule
          type: string
        radius_vendor_attrs:
          $ref: '#/components/schemas/nac_tag_radius_vendor_attrs'
          description: If `type`==`radius_vendor_attrs`, vendor-specific RADIUS attributes returned by the NAC rule
        session_timeout:
          description: If `type`==`session_timeout`, session timeout returned by the NAC rule, in seconds
          examples:
          - 86000
          type: integer
        type:
          $ref: '#/components/schemas/nac_tag_type'
          description: NAC tag type that determines whether the tag is a matcher or a result attribute
        username_attr:
          $ref: '#/components/schemas/nac_tag_username_attr'
          description: If `type`==`username_attr`, attribute used to derive the username returned by the NAC rule
        values:
          $ref: '#/components/schemas/nac_tag_values'
          description: If `type`==`match`, attribute values used by the NAC tag matcher
        vlan:
          description: If `type`==`vlan`, VLAN name or ID returned by the NAC rule
          type: string
      required:
      - name
      - type
      type: object
    response_http404:
      additionalProperties: false
      description: Standard HTTP 404 not found error response
      properties:
        id:
          description: Missing resource identifier, when the API includes one
          type: string
      type: object
    nac_tag_username_attr:
      description: 'enum: `automatic`, `cn`, `dns`, `email`, `upn`'
      enum:
      - automatic
      - cn
      - dns
      - email
      - upn
      type: string
    redirect_nacportal_id:
      description: If `type`==`redirect_nacportal_id`, the ID of the NAC portal to redirect to
      examples:
      - 1e970fec-0a7a-4d73-a472-3ef3b6a456aa
      format: uuid
      type: string
    response_http400:
      additionalProperties: false
      description: Standard HTTP 400 bad request error response
      properties:
        detail:
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    response_http401:
      additionalProperties: false
      description: Standard HTTP 401 authentication error response
      properties:
        detail:
          description: Human-readable explanation of the authentication error
          examples:
          - Authentication credentials were not provided.
          type: string
      type: object
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    created_time:
      description: When the object has been created, in epoch
      format: double
      readOnly: true
      type: number
    nac_tag_values:
      description: If `type`==`match`, attribute values used by the NAC tag matcher
      items:
        type: string
      type: array
    nac_tag_radius_vendor_attrs:
      description: "If `type`==`radius_vendor_attrs`, user can specify a list of one or more vendor-specific attributes in the field \"radius_vendor_attrs\". \nIt is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected.\nNote that it is allowed to have more than one radius_vendor_attrs in the result of a given rule."
      examples:
      - - PaloAlto-Admin-Role=superuser
        - PaloAlto-Panorama-Admin-Role=administrator
      items:
        type: string
      type: array
    nac_tags:
      description: List of NAC tags
      items:
        $ref: '#/components/schemas/nac_tag'
      type: array
    response_http429:
      additionalProperties: false
      description: Standard HTTP 429 rate limit error response
      properties:
        detail:
          description: Human-readable explanation of the rate limit error
          examples:
          - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
          type: string
      type: object
    org_id:
      description: Unique identifier of a Mist organization
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
  parameters:
    page:
      description: Select the page number to return when using page-based pagination; starts at `1`
      in: query
      name: page
      schema:
        default: 1
        minimum: 1
        type: integer
    nactag_id:
      in: path
      name: nactag_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    org_id:
      in: path
      name: org_id
      required: true
      schema:
        examples:
        - 000000ab-00ab-00ab-00ab-0000000000ab
        format: uuid
        type: string
    limit:
      description: Maximum number of results to return per page
      in: query
      name: limit
      schema:
        default: 100
        minimum: 0
        type: integer
  securitySchemes:
    apiToken:
      description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n  `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
      in: header
      name: Authorization
      type: apiKey
    csrfToken:
      description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.


        **Format**:

        ```

        X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx

        ```


        For automation, API Token authentication is preferred.'
      in: header
      name: X-CSRFToken
      type: apiKey