VPNs endpoints are used to create the WAN Assurance Overlay configuration between a Hub and one or multiple WAN Edge Gateways. When configuring the Hub and Spokes from the Mist UI, the UI is automatically creating or updating the VPNs objects based on the configuration. When the configuration is directly done with the APIs, the VPN object must be manually managed.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs VPNs API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: "VPNs endpoints are used to create the WAN Assurance Overlay configuration between a Hub and one\nor multiple WAN Edge Gateways.\n\n\nWhen configuring the Hub and Spokes from the Mist UI, the UI is automatically creating or updating\nthe VPNs objects based on the configuration. \nWhen the configuration is directly done with the APIs, the VPN object must be manually managed."
name: Orgs VPNs
paths:
/api/v1/orgs/{org_id}/vpns:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Get List of Org VPNs
operationId: listOrgVpns
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/VpnsArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgVpns
tags:
- Orgs VPNs
post:
description: Create Org VPN
operationId: createOrgVpn
requestBody:
content:
application/json:
examples:
Example:
value:
name: string
paths:
property1:
bfd_profile: broadband
ip: string
property2:
bfd_profile: lte
ip: string
schema:
$ref: '#/components/schemas/vpn'
responses:
'200':
$ref: '#/components/responses/Vpn'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgVpn
tags:
- Orgs VPNs
/api/v1/orgs/{org_id}/vpns/{vpn_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/vpn_id'
delete:
description: Delete Org Vpn
operationId: deleteOrgVpn
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgVpn
tags:
- Orgs VPNs
get:
description: Get Org Vpn
operationId: getOrgVpn
responses:
'200':
$ref: '#/components/responses/Vpn'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgVpn
tags:
- Orgs VPNs
put:
description: Update Org Vpn
operationId: updateOrgVpn
requestBody:
content:
application/json:
examples:
Example:
value:
name: string
paths:
property1:
bfd_profile: broadband
ip: string
property2:
bfd_profile: broadband
ip: string
schema:
$ref: '#/components/schemas/vpn'
responses:
'200':
$ref: '#/components/responses/Vpn'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgVpn
tags:
- Orgs VPNs
components:
schemas:
vpn_path:
additionalProperties: false
description: VPN path settings used by an organization VPN
properties:
bfd_profile:
$ref: '#/components/schemas/vpn_path_bfd_profile'
description: BFD profile used for this VPN path
bfd_use_tunnel_mode:
default: false
description: If `type`==`mesh` and for SSR only, whether to use tunnel mode
type: boolean
ip:
description: Source IP address for this VPN path, if different from the WAN port IP
type: string
peer_paths:
$ref: '#/components/schemas/vpn_path_peer_paths'
description: Peer path preferences used when `type`==`mesh`
pod:
default: 1
description: Grouping index used to place this VPN path into a pod
examples:
- 2
maximum: 128
minimum: 1
type: integer
traffic_shaping:
$ref: '#/components/schemas/vpn_path_traffic_shaping'
description: Traffic shaping settings applied to this VPN path
type: object
vpn_path_peer_paths:
additionalProperties:
$ref: '#/components/schemas/vpn_path_peer_paths_peer'
description: If `type`==`mesh`, property key is the peer interface name
type: object
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
vpn_path_traffic_shaping:
additionalProperties: false
description: Traffic shaping settings for a VPN path
properties:
class_percentage:
$ref: '#/components/schemas/vpn_path_traffic_shaping_class_percentage'
description: Bandwidth percentages for high, medium, low, and best-effort traffic classes
enabled:
description: Whether traffic shaping is enabled for this VPN path
type: boolean
max_tx_kbps:
description: Maximum transmit rate for this VPN path, in Kbps; `null` means no explicit limit
type:
- integer
- 'null'
type: object
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
vpn_path_bfd_profile:
default: broadband
description: 'BFD profile used for this VPN path. enum: `broadband`, `lte`'
enum:
- broadband
- lte
type: string
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
vpn_path_traffic_shaping_class_percentage:
default:
- 80
- 10
- 9
- 1
description: 'percentages for different class of traffic: high / medium / low / best-effort adding up to 100'
items:
type: integer
maxItems: 4
minItems: 4
type: array
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
vpn:
description: Organization VPN overlay configuration
properties:
created_time:
$ref: '#/components/schemas/created_time'
description: Epoch timestamp when the VPN configuration was created
id:
$ref: '#/components/schemas/id'
description: Unique identifier of the VPN configuration
modified_time:
$ref: '#/components/schemas/modified_time'
description: Epoch timestamp when the VPN configuration was last modified
name:
description: Display name of the VPN configuration
minLength: 1
type: string
org_id:
$ref: '#/components/schemas/org_id'
description: Organization that owns the VPN configuration
path_selection:
$ref: '#/components/schemas/vpn_path_selection'
description: Path selection settings used when `type`==`hub_spoke`
paths:
$ref: '#/components/schemas/vpn_paths'
description: VPN path definitions keyed by VPN name for `hub_spoke` mode or interface name for `mesh` mode
type:
$ref: '#/components/schemas/vpn_mode'
description: VPN topology mode for this configuration
required:
- name
- paths
type: object
vpns:
description: VPN records returned by a list response
items:
$ref: '#/components/schemas/vpn'
type: array
vpn_paths:
additionalProperties:
$ref: '#/components/schemas/vpn_path'
description: For `type`==`hub_spoke`, Property key is the VPN name. For `type`==`mesh`, Property key is the Interface name
type: object
vpn_path_selection_strategy:
default: disabled
description: 'enum: `disabled`, `simple`, `manual`'
enum:
- disabled
- simple
- manual
type: string
vpn_path_selection:
additionalProperties: false
description: Only if `type`==`hub_spoke`; path selection behavior for VPN paths
properties:
strategy:
$ref: '#/components/schemas/vpn_path_selection_strategy'
description: Path selection strategy for a hub-and-spoke VPN
type: object
vpn_mode:
default: hub_spoke
description: 'VPN topology mode for this configuration. enum: `hub_spoke`, `mesh`'
enum:
- hub_spoke
- mesh
type: string
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
vpn_path_peer_paths_peer:
additionalProperties: false
description: Peer path preference settings for mesh VPN routing
properties:
preference:
description: Lower numeric value makes this outgoing WAN path more preferred
type: integer
type: object
parameters:
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
page:
description: Select the page number to return when using page-based pagination; starts at `1`
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
vpn_id:
in: path
name: vpn_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
responses:
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
OK:
description: OK
Vpn:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/VpnExample'
schema:
$ref: '#/components/schemas/vpn'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/VpnExample'
schema:
$ref: '#/components/schemas/vpn'
description: Example response
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
VpnsArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/VpnsArrayExample'
schema:
$ref: '#/components/schemas/vpns'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/VpnsArrayExample'
schema:
$ref: '#/components/schemas/vpns'
description: Example response
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
examples:
VpnExample:
value:
created_time: 0
id: 497f6eca-6276-5009-bfeb-53cbbbba6f1b
modified_time: 0
name: string
org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b
paths:
property1:
bfd_profile: broadband
ip: string
property2:
bfd_profile: broadband
ip: string
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
VpnsArrayExample:
value:
- name: string
paths:
property1:
bfd_profile: broadband
ip: string
property2:
bfd_profile: lte
ip: string
HTTP401Example:
value:
detail: Authentication credentials were not provided.
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey