Mist Orgs Setting API

API Calls to manage the Mist Organization Settings

OpenAPI Specification

mist-orgs-setting-api-openapi.yml Raw ↑
openapi: 3.1.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Admins Orgs Setting API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: API Calls to manage the Mist Organization Settings
  name: Orgs Setting
paths:
  /api/v1/orgs/{org_id}/setting:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: Return organization-wide settings, including feature flags, automatic device assignment rules, management connectivity, packet capture, security controls, and integration configuration.
      operationId: getOrgSettings
      responses:
        '200':
          $ref: '#/components/responses/OrgSetting'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgSettings
      tags:
      - Orgs Setting
    put:
      description: Update organization-wide settings such as automatic device assignment rules, management connectivity, packet capture, password policy, security controls, tags, and integration options.
      operationId: updateOrgSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/org_setting'
        description: Request Body
      responses:
        '200':
          content:
            application/json:
              examples:
                Example:
                  value:
                    auto_device_naming:
                      enable: true
                      rules:
                      - match_device: ap
                        prefix: MIST-
                        src: lldp_port_desc
                    auto_deviceprofile_assignment:
                      enable: true
                      rules:
                      - expression: string
                        model: string
                        prefix: string
                        src: name
                        subnet: string
                        suffix: string
                        value: string
                    auto_site_assignment:
                      enable: true
                      rules:
                      - expression: string
                        model: string
                        prefix: string
                        src: name
                        subnet: string
                        suffix: string
                        value: string
                    cacerts:
                    - string
                    cloudshark:
                      apitoken: string
                      url: string
                    device_cert:
                      cert: string
                      key: string
                    disable_pcap: true
                    installer:
                      allow_all_sites: true
                      extra_site_ids:
                      - b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                      grace_period: 0
                    mgmt:
                      mxtunnel_ids:
                      - b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                      use_mxtunnel: true
                      use_wxtunnel: true
                    modified_time: 0
                    msp_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
                    name: string
                    password_policy:
                      enabled: true
                      expiry_in_days: 365
                      min_length: 8
                      requires_special_char: true
                      requires_two_factor_auth: true
                    pcap:
                      bucket: string
                      max_pkt_len: 0
                    pcap_bucket_verified: true
                    remote_syslog:
                      enabled: true
                      send_to_all_servers: true
                      servers:
                      - facility: change-log
                        host: string
                        port: 0
                        protocol: udp
                        severity: critical
                        tag: string
                    security:
                      disable_local_ssh: true
                      fips_zeroize_password: string
                      limit_ssh_access: true
                    tags:
                    - string
                    ui_idle_timeout: 0
              schema:
                $ref: '#/components/schemas/org_setting'
          description: OK
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateOrgSettings
      tags:
      - Orgs Setting
  /api/v1/orgs/{org_id}/setting/blacklist:
    parameters:
    - $ref: '#/components/parameters/org_id'
    delete:
      description: Clear the organization wireless client blocklist by removing all blocked client MAC addresses.
      operationId: deleteOrgWirelessClientsBlocklist
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: deleteOrgWirelessClientsBlocklist
      tags:
      - Orgs Setting
    post:
      description: Replace the organization wireless client blocklist with the supplied client MAC addresses. The list can contain up to 1000 MAC addresses; retrieve the current list from the `blacklist_url` field in organization settings.
      operationId: createOrgWirelessClientsBlocklist
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  macs:
                  - 18-65-90-de-f4-c6
                  - 84-89-ad-5d-69-0d
            schema:
              $ref: '#/components/schemas/mac_addresses'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/MacsArray'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: createOrgWirelessClientsBlocklist
      tags:
      - Orgs Setting
  /api/v1/orgs/{org_id}/setting/pcap_bucket/setup:
    parameters:
    - $ref: '#/components/parameters/org_id'
    post:
      description: Start custom packet capture bucket setup by saving the bucket name and having Mist write a `MIST_TOKEN` file to the bucket. Complete ownership verification with the verify endpoint by submitting the token contents.
      operationId: setOrgCustomBucket
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  bucket: company-private-pcap
            schema:
              $ref: '#/components/schemas/pcap_bucket'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/PcapBucketConfig'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: setOrgCustomBucket
      tags:
      - Orgs Setting
  /api/v1/orgs/{org_id}/setting/pcap_bucket/verify:
    parameters:
    - $ref: '#/components/parameters/org_id'
    post:
      description: Verify ownership of a custom packet capture bucket by submitting the token read from the `MIST_TOKEN` file. If verification succeeds, Mist creates a `VERIFIED` file in the bucket.
      operationId: verifyOrgCustomBucket
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  bucket: company-private-pcap
                  verify_token: eyJhbGciOiJIUzI1J9.eyJzdWIiOiIxMjM0joiMjgxOG5MDIyfQ.2rzcRvMA3Eg09NnjCAC-1EWMRtxAnFDM
            schema:
              $ref: '#/components/schemas/pcap_bucket_verify'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: verifyOrgCustomBucket
      tags:
      - Orgs Setting
components:
  schemas:
    optic_port_config_port:
      additionalProperties: false
      description: Per-interface optic port override settings
      properties:
        channelized:
          default: false
          description: Whether channelization is enabled on this optic port
          type: boolean
        speed:
          description: Interface speed (e.g. `25g`, `50g`), use the chassis speed by default
          examples:
          - 25g
          type: string
      type: object
    juniper_srx_auto_upgrade_custom_versions:
      additionalProperties:
        description: Firmware version to deploy on the specified SRX hardware
        examples:
        - 23.4R2-S2.1
        type: string
      description: Property key is the SRX Hardware model (e.g. "SRX4600")
      type: object
    org_setting_vpn_options:
      additionalProperties: false
      description: Organization VPN behavior options
      properties:
        as_base:
          description: Base BGP autonomous system number used for generated VPN configurations
          maximum: 2147483647
          minimum: 1
          type: integer
        enable_ipv6:
          default: false
          description: Whether IPv6 is enabled for organization VPN configuration
          type: boolean
        st_subnet:
          default: 10.224.0.0/12
          description: requiring /12 or bigger to support 16 private IPs for 65535 gateways
          type: string
      type: object
    ap_auto_upgrade_custom_versions:
      additionalProperties:
        description: Firmware version or channel to deploy on the specified AP model
        type: string
      description: Per-AP-model firmware versions or channels used for auto-upgrade. Property key is the AP model name (e.g. "AP41"), value is the firmware version or release channel (e.g. `stable`)
      examples:
      - AP21: stable
        AP41: 0.1.5135
        AP61: 0.1.7215
      type: object
    vlan_id_with_variable:
      description: VLAN ID, either numeric or expressed as a template variable string
      oneOf:
      - type: string
      - maximum: 4094
        minimum: 1
        type: integer
    org_setting_junos_shell_access_write:
      default: admin
      description: 'enum: `admin`, `viewer`, `none`'
      enum:
      - admin
      - none
      - viewer
      type: string
    simple_alert_arp_failure:
      additionalProperties: false
      description: Thresholds for ARP failure heuristic alerts
      properties:
        client_count:
          default: 10
          description: Number of distinct clients that must encounter ARP failures before alerting
          type: integer
        duration:
          default: 20
          description: Time window in minutes for evaluating ARP failures
          maximum: 60
          minimum: 5
          type: integer
        incident_count:
          default: 10
          description: Number of ARP failure incidents required within the duration window
          type: integer
      type: object
    switch_auto_upgrade:
      additionalProperties: false
      description: Switch firmware auto-upgrade settings
      properties:
        custom_versions:
          $ref: '#/components/schemas/switch_auto_upgrade_custom_versions'
          description: Per-model switch firmware versions to use for auto-upgrade
        enabled:
          description: Whether switch auto-upgrade is enabled
          type: boolean
        snapshot:
          default: false
          description: Whether to create a recovery snapshot during the upgrade process
          type: boolean
      type: object
    synthetictest_config_vlan_vlan_ids:
      description: VLAN identifiers where deprecated VLAN-based synthetic probes run
      examples:
      - - 10
        - 20
        - '{{vlan}}'
      items:
        $ref: '#/components/schemas/vlan_id_with_variable'
      type: array
    org_setting_auto_site_assignment_rules:
      description: Automatic site assignment rules, or null when automatic assignment is not configured
      items:
        $ref: '#/components/schemas/org_setting_auto_assignment_rule'
      type:
      - array
      - 'null'
    org_setting_mgmt:
      additionalProperties: false
      description: Organization management connectivity settings
      properties:
        mxtunnel_ids:
          $ref: '#/components/schemas/org_setting_mgmt_mxtunnel_ids'
          description: Mist Tunnel IDs selected for management connectivity
        use_mxtunnel:
          default: false
          description: Whether to use Mist Tunnel for mgmt connectivity, this takes precedence over use_wxtunnel
          type: boolean
        use_wxtunnel:
          default: false
          description: Whether to use wxtunnel for mgmt connectivity
          type: boolean
      type: object
    org_setting_wan_pma:
      additionalProperties: false
      description: PMA feature settings for WAN Assurance
      properties:
        enabled:
          default: false
          description: Whether PMA is enabled for WAN Assurance
          type: boolean
      type: object
    id:
      description: Unique ID of the object instance in the Mist Organization
      examples:
      - 53f10664-3ce8-4c27-b382-0ef66432349f
      format: uuid
      readOnly: true
      type: string
    synthetictest_config_wan_speedtest:
      additionalProperties: false
      description: WAN speedtest scheduling settings for synthetic tests
      properties:
        enabled:
          description: Whether scheduled WAN speedtests are enabled
          type: boolean
        time_of_day:
          $ref: '#/components/schemas/time_of_day'
          description: Scheduled time of day for WAN speedtests
      type: object
    synthetictest_config_lan_network:
      additionalProperties: false
      description: configure minis probes to be tested on lan networks of gateways
      properties:
        networks:
          $ref: '#/components/schemas/synthetictest_config_lan_networks_networks'
          description: LAN network names where synthetic probes are run
        probes:
          $ref: '#/components/schemas/synthetictest_config_probes'
          description: Synthetic probe names to run on the listed LAN networks
      type: object
    org_setting_wired_pma:
      additionalProperties: false
      description: PMA feature settings for Wired Assurance
      properties:
        enabled:
          default: false
          description: Whether PMA is enabled for Wired Assurance
          type: boolean
      type: object
    synthetictest_config_aggressiveness:
      default: auto
      description: 'Aggressiveness level for a synthetic test. enum: `auto`, `high`, `med`, `low`'
      enum:
      - auto
      - high
      - med
      - low
      type: string
    juniper_accounts:
      description: Linked Juniper accounts available to the organization
      items:
        $ref: '#/components/schemas/juniper_account'
      type: array
    simple_alert_dns_failure:
      additionalProperties: false
      description: Thresholds for DNS failure heuristic alerts
      properties:
        client_count:
          default: 20
          description: Number of distinct clients that must encounter DNS failures before alerting
          type: integer
        duration:
          default: 10
          description: Time window in minutes for evaluating DNS failures
          maximum: 60
          minimum: 5
          type: integer
        incident_count:
          default: 30
          description: Number of DNS failure incidents required within the duration window
          type: integer
      type: object
    simple_alert_dhcp_failure:
      additionalProperties: false
      description: Thresholds for DHCP failure heuristic alerts
      properties:
        client_count:
          default: 10
          description: Number of distinct clients that must encounter DHCP failures before alerting
          type: integer
        duration:
          default: 10
          description: Time window in minutes for evaluating DHCP failures
          maximum: 60
          minimum: 5
          type: integer
        incident_count:
          default: 20
          description: Number of DHCP failure incidents required within the duration window
          type: integer
      type: object
    response_pcap_bucket_config:
      additionalProperties: false
      description: Result of a custom packet capture bucket setup or verification operation
      properties:
        bucket:
          description: Custom bucket name used for packet capture storage
          type: string
        detail:
          description: Status or error detail returned for the bucket operation
          type: string
      type: object
    switch_auto_upgrade_custom_versions:
      additionalProperties:
        type: string
      description: Custom version to be used. The Property Key is the switch hardware and the property value is the firmware version
      examples:
      - QFX5120-32C: 23.4R2-S2.1
        QFX5130-32CD: 23.4R2-S2.3
      type: object
    org_setting_mist_nac_fingerprinting_wireless_coa:
      description: 'Change of Authorization action sent to wireless clients when fingerprints change. enum: `reauth`, `disconnect`'
      enum:
      - reauth
      - disconnect
      type: string
    site_auto_upgrade_version:
      default: stable
      description: 'desired version. enum: `beta`, `custom`, `stable`'
      enum:
      - beta
      - custom
      - stable
      examples:
      - beta
      type: string
    response_http400:
      additionalProperties: false
      description: Standard HTTP 400 bad request error response
      properties:
        detail:
          description: Human-readable explanation of the bad request error
          examples:
          - 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
          type: string
      type: object
    org_setting_mist_nac_idp_user_realms:
      description: "Which realm should trigger this IDP. User Realm is extracted from:\n  * Username-AVP (`mist.com` from john@mist.com)\n  * Cert CN"
      items:
        examples:
        - abc
        type: string
      type: array
    synthetictest_config_custom_probe_type:
      default: icmp
      description: 'enum: `application`, `curl`, `icmp`, `reachability`, `tcp`'
      enum:
      - application
      - curl
      - icmp
      - reachability
      - tcp
      type: string
    org_setting_gateway_mgmt:
      additionalProperties: false
      description: Organization-level gateway management settings
      properties:
        app_probing:
          $ref: '#/components/schemas/org_setting_gateway_mgmt_app_probing'
          description: Application probing configuration applied to managed gateways
        app_usage:
          description: For SRX only, whether gateway application usage collection is enabled; requires App Track license
          type: boolean
        fips_enabled:
          default: false
          description: Whether FIPS mode is enabled for managed gateways
          type: boolean
        host_in_policies:
          $ref: '#/components/schemas/org_setting_gateway_mgmt_host_in_policies'
          description: Host-in access policies for gateway management services such as ICMP and SNMP
        host_out_policies:
          $ref: '#/components/schemas/org_setting_gateway_mgmt_host_out_policies'
          description: Path preference policies for gateway-originated management traffic
        overlay_ip:
          $ref: '#/components/schemas/org_setting_gateway_mgmt_overlay_ip'
          description: Overlay IP addresses used when gateway management traffic uses the overlay
      type: object
    org_setting_juniper_srx:
      additionalProperties: false
      description: Organization settings for Juniper SRX devices
      properties:
        auto_upgrade:
          $ref: '#/components/schemas/juniper_srx_auto_upgrade'
          description: SRX auto-upgrade settings applied when Juniper SRX devices are first onboarded
      type: object
    nac_coa_type:
      default: reauth
      description: 'CoA type to send. enum: `reauth`, `disconnect`'
      enum:
      - reauth
      - disconnect
      type: string
    org_setting_mgmt_mxtunnel_ids:
      description: Mist Tunnel IDs available for organization management connectivity
      items:
        examples:
        - 08cd7499-5841-51c8-e663-fb16b6f3b45e
        format: uuid
        type: string
      type: array
    org_setting_tags:
      description: Labels associated with these organization settings
      items:
        type: string
      type: array
    pcap_bucket_verify:
      description: Request to verify ownership of a custom packet capture bucket
      properties:
        bucket:
          description: Customer bucket name being verified for packet capture storage
          examples:
          - company-private-pcap
          type: string
        verify_token:
          description: Token read from the MIST_TOKEN file written during bucket setup
          examples:
          - eyJhbGciOiJIUzI1J9.eyJzdWIiOiIxMjM0joiMjgxOG5MDIyfQ.2rzcRvMA3Eg09NnjCAC-1EWMRtxAnFDM
          type: string
      required:
      - bucket
      - verify_token
      type: object
    org_setting_mist_nac_server_cert:
      additionalProperties: false
      description: RADIUS server certificate presented by Mist NAC during EAP-TLS
      properties:
        cert:
          description: PEM-encoded RADIUS server certificate presented during EAP-TLS
          examples:
          - '-----BEGIN CERTIFICATE-----\nMIIFZjCCA06gAwIBAgIIP61/1qm/uDowDQYJKoZIhvcNAQELBQE\n-----END CERTIFICATE-----'
          type: string
        key:
          description: Private key paired with the Mist NAC RADIUS server certificate
          examples:
          - '-----BEGIN PRI...'
          format: password
          type: string
        password:
          description: Optional password for the private key
          format: password
          type: string
      type: object
    org_setting_mist_nac:
      additionalProperties: false
      description: Organization-level Mist NAC configuration
      properties:
        allow_teap_machine_auth_only:
          default: false
          description: allow clients to connect even when the user cert failed. TEAP authenticates both Machine Cert and User Cert. When enabled, clients who only succeed Machine Cert authentication will be accepted.
          type: boolean
        cacerts:
          $ref: '#/components/schemas/cacerts'
          description: CA certificates trusted by Mist NAC for certificate-based authentication
        default_idp_id:
          description: use this IDP when no explicit realm present in the incoming username/CN OR when no IDP is explicitly mapped to the incoming realm.
          type: string
        disable_rsae_algorithms:
          default: false
          description: to disable RSAE_PSS_SHA256, RSAE_PSS_SHA384, RSAE_PSS_SHA512 from server side. see https://www.openssl.org/docs/man3.0/man1/openssl-ciphers.html
          type: boolean
        eap_ssl_security_level:
          default: 2
          description: eap ssl security level, see https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html#DEFAULT-CALLBACK-BEHAVIOUR
          maximum: 4
          minimum: 1
          type: integer
        eu_only:
          default: false
          description: By default, NAC POD failover considers all NAC pods available around the globe, i.e. EU, US, or APAC based, failover happens based on geo IP of the originating site. For strict GDPR compliance NAC POD failover would only happen between the PODs located within the EU environment, and no authentication would take place outside of EU. This is an org setting that is applicable to WLANs, switch templates, Mist Edge clusters that have mist_nac enabled
          type: boolean
        fingerprinting:
          $ref: '#/components/schemas/org_setting_mist_nac_fingerprinting'
          description: Client fingerprinting settings used by Mist NAC
        idp_machine_cert_lookup_field:
          $ref: '#/components/schemas/idp_machine_cert_lookup_field'
          description: Client certificate field used to look up machine groups in identity providers
        idp_user_cert_lookup_field:
          $ref: '#/components/schemas/idp_user_cert_lookup_field'
          description: Client certificate field used to look up user groups in identity providers
        idps:
          $ref: '#/components/schemas/org_setting_mist_nac_idps'
          description: Identity provider mappings used by Mist NAC realm matching
        mdm:
          $ref: '#/components/schemas/org_setting_mist_nac_mdm'
          description: Mobile Device Management CoA settings for Mist NAC
        server_cert:
          $ref: '#/components/schemas/org_setting_mist_nac_server_cert'
          description: RADIUS server certificate presented by Mist NAC during EAP-TLS
        use_ip_version:
          $ref: '#/components/schemas/org_setting_mist_nac_ip_version'
          description: IP version used by NAS devices and Mist Edge proxies to reach Mist NAC
        use_ssl_port:
          default: false
          description: By default, NAS devices (switches/aps) and proxies(mxedge) are configured to use port TCP2083(RadSec) to reach mist-nac. Set `use_ssl_port`==`true` to override that port with TCP43 (ssl), This is an org level setting that is applicable to wlans, switch_templates, and mxedge_clusters that have mist-nac enabled
          type: boolean
        usermac_expiry:
          default: 0
          description: Allow customer to configure an expiry time for usermacs by attaching a Quarantine label to those which have been inactive for the configured period of time (in days). 0 means no expiry
          examples:
          - 30
          maximum: 1095
          minimum: 0
          type: integer
      type: object
    org_setting_auto_device_naming_rule_src:
      description: 'Device attribute used to generate the name. enum: `lldp_port_desc`, `mac`'
      enum:
      - lldp_port_desc
      - mac
      type: string
    org_setting_mist_nac_idp:
      additionalProperties: false
      description: Mist NAC identity provider realm mapping
      properties:
        exclude_realms:
          $ref: '#/components/schemas/org_setting_mist_nac_idp_exclude_realms'
          description: When the IDP is `mxedge_proxy` type, realms excluded from proxying in addition to other valid home realms in this org
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier of the identity provider referenced by this Mist NAC mapping
        user_realms:
          $ref: '#/components/schemas/org_setting_mist_nac_idp_user_realms'
          description: User realms that select this identity provider
      type: object
    gateway_mgmt_host_out_policy_syslog_server:
      additionalProperties: false
      description: Per-syslog-server host-out path policy override
      properties:
        host:
          description: Syslog server hostname or IP address
          examples:
          - 103.35.3.5
          type: string
        path_preference:
          description: Preferred path name used for this syslog server
          examples:
          - dc_only
          type: string
        server_name:
          description: Remote syslog server name referenced by the policy
          examples:
          - dc_syslog_server
          type: string
      type: object
    org_setting_auto_deviceprofile_assignment_rules:
      description: Automatic device profile assignment rules, or null when automatic assignment is not configured
      items:
        $ref: '#/components/schemas/org_setting_auto_assignment_rule'
      type:
      - array
      - 'null'
    msp_id:
      description: Managed service provider identifier
      examples:
      - b9d42c2e-88ee-41f8-b798-f009ce7fe909
      format: uuid
      readOnly: true
      type: string
    org_setting_pcap:
      additionalProperties: false
      description: Packet capture export settings for the organization
      properties:
        bucket:
          description: Storage bucket name used for organization packet capture files
          examples:
          - myorg_pcap
          type: string
        max_pkt_len:
          default: 128
          description: Maximum length of non-management packets to capture, in bytes
          examples:
          - 128
          maximum: 128
          type: integer
      type: object
    org_setting_gateway_mgmt_app_probing:
      additionalProperties: false
      description: Application probing settings for organization gateway management
      properties:
        apps:
          $ref: '#/components/schemas/app_probing_apps'
          description: Predefined application keys to probe from managed gateways
      type: object
    mxedge_mgmt:
      additionalProperties: false
      description: Management settings for a M

# --- truncated at 32 KB (90 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-orgs-setting-api-openapi.yml