Mist Orgs Setting API

openapi: 3.2.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Orgs Setting API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: API Calls to manage the Mist Organization Settings
  name: Orgs Setting
paths:
  /api/v1/orgs/{org_id}/setting:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Return organization-wide settings, including feature flags, automatic device assignment rules, management connectivity, packet capture, security controls, and integration configuration.
      operationId: getOrgSettings
      responses:
        '200':
          $ref: '#/components/responses/OrgSetting'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSettings
      tags:
      - Orgs Setting
    put:
      description: Update organization-wide settings such as automatic device assignment rules, management connectivity, packet capture, password policy, security controls, tags, and integration options.
      operationId: updateOrgSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/org_setting'
        description: Request Body
      responses:
        '200':
          content:
            application/json:
              examples:
                Example:
                  value:
                    auto_device_naming:
                      enable: true
                      rules:
                      - match_device: ap
                        prefix: MIST-
                        src: lldp_port_desc
                    auto_deviceprofile_assignment:
                      enable: true
                      rules:
                      - expression: string
                        model: string
                        prefix: string
                        src: name
                        subnet: string
                        suffix: string
                        value: string
                    auto_site_assignment:
                      enable: true
                      rules:
                      - expression: string
                        model: string
                        prefix: string
                        src: name
                        subnet: string
                        suffix: string
                        value: string
                    cacerts:
                    - string
                    cloudshark:
                      apitoken: string
                      url: string
                    device_cert:
                      cert: string
                      key: string
                    disable_pcap: true
                    installer:
                      allow_all_sites: true
                      extra_site_ids:
                      - b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                      grace_period: 0
                    mgmt:
                      mxtunnel_ids:
                      - b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                      use_mxtunnel: true
                      use_wxtunnel: true
                    modified_time: 0
                    msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                    name: string
                    password_policy:
                      enabled: true
                      expiry_in_days: 365
                      min_length: 8
                      requires_special_char: true
                      requires_two_factor_auth: true
                    pcap:
                      bucket: string
                      max_pkt_len: 0
                    pcap_bucket_verified: true
                    remote_syslog:
                      enabled: true
                      send_to_all_servers: true
                      servers:
                      - facility: change-log
                        host: string
                        port: 0
                        protocol: udp
                        severity: critical
                        tag: string
                    security:
                      disable_local_ssh: true
                      fips_zeroize_password: string
                      limit_ssh_access: true
                    tags:
                    - string
                    ui_idle_timeout: 0
              schema:
                $ref: '#/components/schemas/org_setting'
          description: OK
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgSettings
      tags:
      - Orgs Setting
  /api/v1/orgs/{org_id}/setting/blacklist:
    parameters:
    - $ref: '#/components/parameters/org_id'
    delete:
      description: Clear the organization wireless client blocklist by removing all blocked client MAC addresses.
      operationId: deleteOrgWirelessClientsBlocklist
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgWirelessClientsBlocklist
      tags:
      - Orgs Setting
    post:
      description: Replace the organization wireless client blocklist with the supplied client MAC addresses. The list can contain up to 1000 MAC addresses; retrieve the current list from the `blacklist_url` field in organization settings.
      operationId: createOrgWirelessClientsBlocklist
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  macs:
                  - 18-65-90-de-f4-c6
                  - 84-89-ad-5d-69-0d
            schema:
              $ref: '#/components/schemas/mac_addresses'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/MacsArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgWirelessClientsBlocklist
      tags:
      - Orgs Setting
  /api/v1/orgs/{org_id}/setting/pcap_bucket/setup:
    parameters:
    - $ref: '#/components/parameters/org_id'
    post:
      description: Start custom packet capture bucket setup by saving the bucket name and having Mist write a `MIST_TOKEN` file to the bucket. Complete ownership verification with the verify endpoint by submitting the token contents.
      operationId: setOrgCustomBucket
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  bucket: company-private-pcap
            schema:
              $ref: '#/components/schemas/pcap_bucket'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/PcapBucketConfig'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: setOrgCustomBucket
      tags:
      - Orgs Setting
  /api/v1/orgs/{org_id}/setting/pcap_bucket/verify:
    parameters:
    - $ref: '#/components/parameters/org_id'
    post:
      description: Verify ownership of a custom packet capture bucket by submitting the token read from the `MIST_TOKEN` file. If verification succeeds, Mist creates a `VERIFIED` file in the bucket.
      operationId: verifyOrgCustomBucket
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  bucket: company-private-pcap
                  verify_token: eyJhbGciOiJIUzI1J9.eyJzdWIiOiIxMjM0joiMjgxOG5MDIyfQ.2rzcRvMA3Eg09NnjCAC-1EWMRtxAnFDM
            schema:
              $ref: '#/components/schemas/pcap_bucket_verify'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: verifyOrgCustomBucket
      tags:
      - Orgs Setting
components:
  schemas:
    pcap_bucket_verify:
      description: Request to verify ownership of a custom packet capture bucket
      properties:
        bucket:
          description: Customer bucket name being verified for packet capture storage
          examples:
          - company-private-pcap
          type: string
        verify_token:
          description: Token read from the MIST_TOKEN file written during bucket setup
          examples:
          - eyJhbGciOiJIUzI1J9.eyJzdWIiOiIxMjM0joiMjgxOG5MDIyfQ.2rzcRvMA3Eg09NnjCAC-1EWMRtxAnFDM
          type: string
      required:
      - bucket
      - verify_token
      type: object
    setting_ssr:
      additionalProperties: false
      description: SSR management settings for device onboarding and connectivity
      properties:
        auto_upgrade:
          $ref: '#/components/schemas/setting_ssr_auto_upgrade'
          description: Automatic SSR firmware upgrade settings for newly onboarded devices
        conductor_hosts:
          $ref: '#/components/schemas/setting_ssr_conductor_hosts'
          description: IP addresses or hostnames of conductors used by SSR devices
        conductor_token:
          description: Registration token used by SSR devices to connect to the conductor
          type: string
        disable_stats:
          description: Whether stats collection is disabled on SSR devices
          type: boolean
        proxy:
          $ref: '#/components/schemas/ssr_proxy'
          description: Network proxy settings used by SSR devices to reach Mist
      type: object
    synthetictest_config_probes:
      description: app name comes from `custom_probes` above or /const/synthetic_test_probes
      items:
        type: string
      type: array
    org_id:
      description: Unique identifier of a Mist organization
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    org_setting_mist_nac_fingerprinting:
      additionalProperties: false
      description: Client fingerprinting settings used for Mist NAC policy enforcement
      properties:
        enabled:
          default: false
          description: enable/disable writes to NAC DDB fingerprint table
          type: boolean
        generate_coa:
          default: false
          description: enable/disable CoA triggers on fingerprint change for wired clients, always port-bounce
          type: boolean
        generate_wireless_coa:
          default: false
          description: enable/disable CoA triggers on fingerprint change for wireless clients
          type: boolean
        wireless_coa_type:
          $ref: '#/components/schemas/org_setting_mist_nac_fingerprinting_wireless_coa'
          description: Change of Authorization action sent to wireless clients when fingerprints change
      type: object
    simple_alert_dns_failure:
      additionalProperties: false
      description: Thresholds for DNS failure heuristic alerts
      properties:
        client_count:
          default: 20
          description: Number of distinct clients that must encounter DNS failures before alerting
          type: integer
        duration:
          default: 10
          description: Time window in minutes for evaluating DNS failures
          maximum: 60
          minimum: 5
          type: integer
        incident_count:
          default: 30
          description: Number of DNS failure incidents required within the duration window
          type: integer
      type: object
    time_of_day:
      default: any
      description: '`any` / HH:MM (24-hour format)'
      examples:
      - '12:00'
      type: string
    org_setting_gateway_mgmt_host_out_policies:
      additionalProperties: false
      description: Optional path preferences for gateway-originated management traffic; ECMP is used across available paths when no preference is specified
      properties:
        dns:
          $ref: '#/components/schemas/gateway_mgmt_host_out_policy'
          description: Path preference policy for gateway-originated DNS traffic
        ntp:
          $ref: '#/components/schemas/gateway_mgmt_host_out_policy'
          description: Path preference policy for gateway-originated NTP traffic
        syslog:
          $ref: '#/components/schemas/gateway_mgmt_host_out_policy_syslog'
          description: Path preference policy for gateway-originated syslog traffic
      type: object
    setting_ssr_conductor_hosts:
      description: Conductor IP addresses or hostnames used by SSR devices
      items:
        type: string
      type: array
    org_setting_auto_assignment_rule:
      additionalProperties: false
      description: Automatic assignment rule used by org settings
      properties:
        create_new_site_if_needed:
          default: false
          description: If `src`==`geoip`. By default, a claimed device only gets assigned if the site exists to auto-create the site, enable this
          type: boolean
        expression:
          description: "If `src`==`name`, `src`==`lldp_system_name`, `src`==`dns_suffix`  \n      \"[0:3]\"            // \"abcdef\" -> \"abc\"  \n      \"split(.)[1]\"      // \"a.b.c\" -> \"b\"  \n      \"split(-)[1][0:3]\" // \"a1234-b5678-c90\" -> \"b56\"'"
          examples:
          - split(.)[1]
          type:
          - string
          - 'null'
        gatewaytemplate_id:
          description: If `src`==`geoip` and `create_new_site_if_needed`==`true`. If a gateway template is desired for this newly created site
          type: string
        match_country:
          description: If `src`==`geoip`, country or region value that must match the device location
          type: string
        match_device_type:
          $ref: '#/components/schemas/device_type_default_ap'
          description: Device type filter that limits which claimed devices this rule applies to
        match_model:
          description: Optional additional device model filter for this assignment rule
          type: string
        model:
          description: If `src`==`model`, device model value to match
          type: string
        prefix:
          description: If `src`==`name`, prefix that must be present in the device name
          examples:
          - XX-
          type:
          - string
          - 'null'
        src:
          $ref: '#/components/schemas/org_setting_auto_site_assignment_src'
          description: Source attribute used to evaluate the automatic assignment rule
        subnet:
          description: If `src`==`subnet` or `ext_ip`==`ext_ip`
          type: string
        suffix:
          description: If `src`==`name`, suffix that must be present in the device name
          examples:
          - -YY
          type:
          - string
          - 'null'
        value:
          description: "If \n  * `src`==`ext_ip`, `src`==`subnet` or `src`==`model`, the site name\n  * `src`==`geoip`: site name for the device to be assigned to (\\\"city\\\" / \\\"city+country\\\" / ...)\""
          type: string
      required:
      - src
      type: object
    strings:
      description: Unique string values returned or accepted by this schema
      items:
        type: string
      type: array
      uniqueItems: true
    mxedge_mgmt_oob_ip_type6:
      default: autoconf
      description: 'enum: `autoconf`, `dhcp`, `disabled`, `static`'
      enum:
      - autoconf
      - dhcp
      - disabled
      - static
      type: string
    switch_auto_upgrade_custom_versions:
      additionalProperties:
        type: string
      description: Custom version to be used. The Property Key is the switch hardware and the property value is the firmware version
      examples:
      - QFX5120-32C: 23.4R2-S2.1
        QFX5130-32CD: 23.4R2-S2.3
      type: object
    org_setting_mist_nac_idps:
      description: Identity provider realm mappings used by Mist NAC
      items:
        $ref: '#/components/schemas/org_setting_mist_nac_idp'
      type: array
    synthetictest_config_lan_network:
      additionalProperties: false
      description: configure minis probes to be tested on lan networks of gateways
      properties:
        networks:
          $ref: '#/components/schemas/synthetictest_config_lan_networks_networks'
          description: LAN network names where synthetic probes are run
        probes:
          $ref: '#/components/schemas/synthetictest_config_probes'
          description: Synthetic probe names to run on the listed LAN networks
      type: object
    msp_id:
      description: Managed service provider identifier
      examples:
      - b9d42c2e-88ee-41f8-b798-f009ce7fe909
      format: uuid
      readOnly: true
      type: string
    org_setting_mist_nac_idp_user_realms:
      description: "Which realm should trigger this IDP. User Realm is extracted from:\n  * Username-AVP (`mist.com` from john@mist.com)\n  * Cert CN"
      items:
        examples:
        - abc
        type: string
      type: array
    org_setting_auto_device_naming_rules:
      description: Automatic device naming rules, or null when automatic naming is not configured
      items:
        $ref: '#/components/schemas/org_setting_auto_device_naming_rule'
      type:
      - array
      - 'null'
    org_setting_installer_extra_site_ids:
      description: Additional site IDs that installers may access
      items:
        examples:
        - 4ac1dcf4-9d8b-7211-65c4-057819f0862b
        format: uuid
        type: string
      type: array
    marvis_self_driving:
      additionalProperties: false
      description: Self-driving network automation settings per domain
      properties:
        wan:
          $ref: '#/components/schemas/marvis_self_driving_domain'
          description: Self-driving automation settings for the WAN domain
        wired:
          $ref: '#/components/schemas/marvis_self_driving_domain'
          description: Self-driving automation settings for the wired domain
        wireless:
          $ref: '#/components/schemas/marvis_self_driving_domain'
          description: Self-driving automation settings for the wireless domain
      type: object
    org_setting_marvis:
      additionalProperties: false
      description: Organization settings for Marvis automation
      properties:
        disable_proactive_monitoring:
          default: false
          description: 'Disable proactive monitoring in Marvis. NOTE: support access must be enabled for the org (`allow_mist`=`true`) for proactive monitoring to function.'
          type: boolean
        self_driving:
          $ref: '#/components/schemas/marvis_self_driving'
          description: Self-driving network automation settings by domain
      type: object
    ssr_proxy:
      additionalProperties: false
      description: SSR proxy configuration to talk to Mist
      properties:
        disabled:
          default: false
          description: Whether the SSR proxy configuration is disabled
          examples:
          - true
          type: boolean
        url:
          description: Proxy URL that SSR devices use to reach Mist
          examples:
          - https://proxy.corp.com:8080/
          type: string
      type: object
    synthetictest_config_custom_probe:
      additionalProperties: false
      description: Custom probe definition for synthetic tests
      properties:
        aggressiveness:
          $ref: '#/components/schemas/synthetictest_config_aggressiveness'
          description: Probe aggressiveness level for this custom synthetic probe
        target:
          description: Can be URL (e.g. http://x.com, https://x.com:8080/path/to/resource), IP address, or IP:port combination
          examples:
          - 10.3.5.3:8080
          type: string
        threshold:
          description: Response-time threshold for this custom probe, in milliseconds
          examples:
          - 100
          type: integer
        type:
          $ref: '#/components/schemas/synthetictest_config_custom_probe_type'
          description: Probe type used by this custom synthetic probe
      type: object
    idp_machine_cert_lookup_field:
      default: automatic
      description: 'allow customer to choose the EAP-TLS client certificate''s field to use for IDP Machine Groups lookup. enum: `automatic`, `cn`, `dns`'
      enum:
      - automatic
      - cn
      - dns
      type: string
    simple_alert_dhcp_failure:
      additionalProperties: false
      description: Thresholds for DHCP failure heuristic alerts
      properties:
        client_count:
          default: 10
          description: Number of distinct clients that must encounter DHCP failures before alerting
          type: integer
        duration:
          default: 10
          description: Time window in minutes for evaluating DHCP failures
          maximum: 60
          minimum: 5
          type: integer
        incident_count:
          default: 20
          description: Number of DHCP failure incidents required within the duration window
          type: integer
      type: object
    gateway_mgmt_host_out_policy_syslog_servers:
      description: Per-server host-out path policies for gateway syslog traffic
      items:
        $ref: '#/components/schemas/gateway_mgmt_host_out_policy_syslog_server'
      type: array
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    org_setting_password_policy:
      additionalProperties: false
      description: Admin credential policy settings for the organization
      properties:
        enabled:
          default: false
          description: Whether the policy is enabled
          type: boolean
        expiry_in_days:
          description: Password expiry in days. Password Expiry Notice banner will display in the UI 14 days before expiration
          examples:
          - 60
          maximum: 365
          minimum: 1
          type: integer
        min_length:
          default: 8
          description: Minimum number of characters required for passwords
          type: integer
        requires_special_char:
          default: false
          description: Whether to require special character
          type: boolean
        requires_two_factor_auth:
          default: false
          description: Whether to require two-factor auth
          type: boolean
      type: object
    org_setting_mist_nac:
      additionalProperties: false
      description: Organization-level Mist NAC configuration
      properties:
        allow_teap_machine_auth_only:
          default: false
          description: allow clients to connect even when the user cert failed. TEAP authenticates both Machine Cert and User Cert. When enabled, clients who only succeed Machine Cert authentication will be accepted.
          type: boolean
        cacerts:
          $ref: '#/components/schemas/cacerts'
          description: CA certificates trusted by Mist NAC for certificate-based authentication
        default_idp_id:
          description: use this IDP when no explicit realm present in the incoming username/CN OR when no IDP is explicitly mapped to the incoming realm.
          type: string
        disable_rsae_algorithms:
          default: false
          description: to disable RSAE_PSS_SHA256, RSAE_PSS_SHA384, RSAE_PSS_SHA512 from server side. see https://www.openssl.org/docs/man3.0/man1/openssl-ciphers.html
          type: boolean
        eap_ssl_security_level:
          default: 2
          description: eap ssl security level, see https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html#DEFAULT-CALLBACK-BEHAVIOUR
          maximum: 4
          minimum: 1
          type: integer
        eu_only:
          default: false
          description: By default, NAC POD failover considers all NAC pods available around the globe, i.e. EU, US, or APAC based, failover happens based on geo IP of the originating site. For strict GDPR compliance NAC POD failover would only happen between the PODs located within the EU environment, and no authentication would take place outside of EU. This is an org setting that is applicable to WLANs, switch templates, Mist Edge clusters that have mist_nac enabled
          type: boolean
        fingerprinting:
          $ref: '#/components/schemas/org_setting_mist_nac_fingerprinting'
          description: Client fingerprinting settings used by Mist NAC
        idp_machine_cert_lookup_field:
          $ref: '#/components/schemas/idp_machine_cert_lookup_field'
          description: Client certificate field used to look up machine groups in identity providers
        idp_user_cert_lookup_field:
          $ref: '#/components/schemas/idp_user_cert_lookup_field'
          description: Client certificate field used to look up user groups in identity providers
        idps:
          $ref: '#/components/schemas/org_setting_mist_nac_idps'
          description: Identity provider mappings used by Mist NAC realm matching
        mdm:
          $ref: '#/components/schemas/org_setting_mist_nac_mdm'
          description: Mobile Device Management CoA settings for Mist NAC
        server_cert:
          $ref: '#/components/schemas/org_setting_mist_nac_server_cert'
          description: RADIUS server certificate presented by Mist NAC during EAP-TLS
        use_ip_version:
          $ref: '#/components/schemas/org_setting_mist_nac_ip_version'
          description: IP version used by NAS devices and Mist Edge proxies to reach Mist NAC
        use_ssl_port:
          default: false
          description: By default, NAS devices (switches/aps) and proxies(mxedge) are configured to use port TCP2083(RadSec) to reach mist-nac. Set `use_ssl_port`==`true` to override that port with TCP43 (ssl), This is an org level setting that is applicable to wlans, switch_templates, and mxedge_clusters that have mist-nac enabled
          type: boolean
        usermac_expiry:
          default: 0
          description: Allow customer to configure an expiry time for usermacs by attaching a Quarantine label to those which have been inactive for the configured period of time (in days). 0 means no expiry
          examples:
          - 30
          maximum: 1095
          minimum: 0
          type: integer
      type: object
    org_setting_mgmt:
      additionalProperties: false
      description: Organization management connectivity settings
      properties:
        mxtunnel_ids:
          $ref: '#/components/schemas/org_setting_mgmt_mxtunnel_ids'
          description: Mist Tunnel IDs selected for management connectivity
        use_mxtunnel:
          default: false
          description: Whether to use Mist Tunnel for mgmt connectivity, this takes precedence over use_wxtunnel
          type: boolean
        use_wxtunnel:
          default: false
          description: Whether to use wxtunnel for mgmt connectivity
          type: boolean
      type: object
    org_setting_wan_pma:
      additionalProperties: false
      description: PMA feature settings for WAN Assurance
      properties:
        enabled:
          default: false
          description: Whether PMA is enabled for WAN Assurance
          type: boolean
      type: object
    mxedge_mgmt:
      additionalProperties: false
      description: Management settings for a Mist Edge appliance
      properties:
        config_auto_revert:
          default: false
          description: Whether the Mist Edge automatically reverts configuration changes if connectivity is lost
          type: boolean
        fips_enabled:
          default: false
          description: Whether FIPS mode is enabled on the Mist Edge
          type: boolean
        mist_password:
          description: Password for the Mist service account on the Mist Edge
          examples:
          - MIST_PASSWORD
          type: string
        oob_ip_type:
          $ref: '#/components/schemas/mxedge_mgmt_oob_ip_type'
          description: IPv4 address assignment mode for out-of-band management
        oob_ip_type6:
          $ref: '#/components/schemas/mxedge_mgmt_oob_ip_type6'
          description: IPv6 address assignment mode for out-of-band management
        root_password:
          description: Root account password for the Mist Edge
          examples:
          - ROOT_PASSWORD
          format: password
          type: string
      type: object
    juniper_account:
      additionalProperties: false
      description: Linked Juniper account available to the organization
      properties:
        linked_by:
          description: User who linked this Juniper account
          examples:
          - John Smith (john@abccorp.com)
          readOnly: true
          type: string
        name:
          description: 

# --- truncated at 32 KB (90 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-setting-api-openapi.yml