Wxtags are tags or groups that can be created and used within the Org. They are used to classify users and resources and can be applied to Access Points, WLAN configurations or WxRules within that site. Org WxTags are created and managed at the org level and can only be referenced and used within the org level configuration.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs WxTags API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'Wxtags are tags or groups that can be created and used within the Org.
They are used to classify users and resources and can be applied to Access Points, WLAN configurations or WxRules within that site.
Org WxTags are created and managed at the org level and can only be referenced and used within the org level configuration.'
name: Orgs WxTags
paths:
/api/v1/orgs/{org_id}/wxtags:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Get List of Org WxLAN Tags
operationId: listOrgWxTags
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/WxtagArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgWxTags
tags:
- Orgs WxTags
post:
description: Create WxLAN Tag
operationId: createOrgWxTag
requestBody:
content:
application/json:
examples:
app:
value:
match: app
name: match app
type: match
values:
- gmail
- dropbox
client_mac:
value:
match: client_mac
name: file_servers
type: match
values:
- b0c4e7001543
- a0c4e7001543
- 00c4e7001543
hostnames:
value:
match: hostname
name: mist
type: match
values:
- mist.com
ip_range_subnets:
value:
match: ip_range_subnet
name: file_servers
type: match
values:
- 10.1.2.1
- 10.2.3.4/24
- 10.1.2.5-10.2.3.4
ports:
value:
match: port
name: web-ports
type: match
values:
- '80'
- '8000'
- '8080'
psk_name:
value:
match: psk_name
name: VIP
type: match
values:
- test_key1
- test_key2
psk_role:
value:
match: psk_role
name: VIP
type: match
values:
- test_role
radius_group:
value:
match: radius_group
name: VIP
type: match
values:
- vip
radius_username:
value:
match: radius_username
name: VIP
type: match
values:
- john@abc.com
- eric@abc.com
traffic-spec:
value:
name: protocol-subnet-port
specs:
- port_range: '80'
protocol: tcp
subnets:
- 10.1.2.0/24
type: spec
vlan:
value:
name: vlan-assignment
type: vlan
vlan_id: 1055
wlan_id:
value:
match: wlan_id
name: guest-wlan
type: match
values:
- be22bba78e22e1cf5185b880816fe2cf
schema:
$ref: '#/components/schemas/wxlan_tag'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Wxtag'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgWxTag
tags:
- Orgs WxTags
/api/v1/orgs/{org_id}/wxtags/apps:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Get Application List
operationId: getOrgApplicationList
responses:
'200':
$ref: '#/components/responses/WxTagsAppsArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgApplicationList
tags:
- Orgs WxTags
/api/v1/orgs/{org_id}/wxtags/{wxtag_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/wxtag_id'
delete:
description: Delete WxLAN Tag
operationId: deleteOrgWxTag
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgWxTag
tags:
- Orgs WxTags
get:
description: Get WxLAN Tag Details
operationId: getOrgWxTag
responses:
'200':
$ref: '#/components/responses/Wxtag'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgWxTag
tags:
- Orgs WxTags
put:
description: Update WxLAN Tag
operationId: updateOrgWxTag
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/wxlan_tag'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Wxtag'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgWxTag
tags:
- Orgs WxTags
/api/v1/orgs/{org_id}/wxtags/{wxtag_id}/clients:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/wxtag_id'
get:
description: Get Current Matching Clients of a WXLAN Tag
operationId: getOrgCurrentMatchingClientsOfAWxTag
responses:
'200':
$ref: '#/components/responses/WxtagClients'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgCurrentMatchingClientsOfAWxTag
tags:
- Orgs WxTags
components:
schemas:
wxlan_tags:
description: WxLAN tag records returned by a list response
items:
$ref: '#/components/schemas/wxlan_tag'
type: array
wxlan_tag_type:
description: 'enum: `client`, `match`, `resource`, `spec`, `subnet`, `vlan`'
enum:
- client
- match
- resource
- spec
- subnet
- vlan
type: string
wxlan_tag_spec:
additionalProperties: false
description: Traffic match specification used by a WxLAN tag
properties:
port_range:
default: '0'
description: Matched destination port, "0" means any
type: string
protocol:
default: any
description: tcp / udp / icmp / gre / any / ":protocol_number", `protocol_number` is between 1-254
type: string
subnets:
$ref: '#/components/schemas/wxlan_tag_spec_subnets'
description: Destination subnets or IP addresses matched by this WxLAN tag spec
type: object
wxlan_tag:
description: "WxLAN Tag\n * type:\n * client: created manually (e.g. on wireless client table, when they spot a device of interest, they can create a wxlan tag for it\n * resource: created automatically when we discover a network resource\n * subnet: create automatically when a subnet is discovered\n * match:\n * wlan_id, ap_id: values are a list of Wlan / Device ids\n * client_mac: values are a list of MAC addresses\n * radius_group: this is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\n * radius_username: this matches the ATTR-User-Name(1)\n * radius_class: the matches the ATTR-Class(25)\n * radius_attr: the values are [ \"6=1\" , \"26=10.2.3.4\" ], this support other RADIUS attributes where we know the type\n * radius_vendor: the values are [ \"14179.10=1\" , \"14178.16=1.2.3.4\" ], this matches vendor attributes and will be dynamically evaluated"
properties:
created_time:
$ref: '#/components/schemas/created_time'
description: Time when this WxLAN tag was created, in epoch seconds
for_site:
description: Whether this WxLAN tag is scoped to a site
readOnly: true
type: boolean
id:
$ref: '#/components/schemas/id'
description: Unique identifier for this WxLAN tag
last_ips:
$ref: '#/components/schemas/wxlan_tag_last_ips'
description: Most recent IP addresses observed for this WxLAN tag
mac:
description: If `type`==`client`, Client MAC address
type:
- string
- 'null'
match:
$ref: '#/components/schemas/wxlan_tag_match'
description: Required if `type`==`match`; attribute compared against `values`
modified_time:
$ref: '#/components/schemas/modified_time'
description: Time when this WxLAN tag was last modified, in epoch seconds
name:
description: Display name of the WxLAN tag
type: string
op:
$ref: '#/components/schemas/wxlan_tag_operation'
description: Required if `type`==`match`; whether `values` are inclusive or exclusive matches
org_id:
$ref: '#/components/schemas/org_id'
description: Owning organization associated with this WxLAN tag
resource_mac:
description: MAC address of the discovered resource associated with this tag, when applicable
type:
- string
- 'null'
services:
$ref: '#/components/schemas/strings'
description: Names of services associated with this WxLAN tag
site_id:
$ref: '#/components/schemas/site_id'
description: Mist site associated with this WxLAN tag, when site-scoped
specs:
$ref: '#/components/schemas/wxlan_tag_specs'
description: Traffic match specifications used when `type`==`spec`
subnet:
description: CIDR subnet associated with this WxLAN tag when `type`==`subnet`
type: string
type:
$ref: '#/components/schemas/wxlan_tag_type'
description: Kind of WxLAN tag and how it is populated
values:
$ref: '#/components/schemas/wxlan_tag_values'
description: Comparison values for the selected `match` attribute when `type`==`match`
vlan_id:
$ref: '#/components/schemas/wxlan_tag_vlan_id'
description: Identifier of the VLAN associated with this WxLAN tag when `type`==`vlan`
required:
- type
- name
type: object
strings:
description: Unique string values returned or accepted by this schema
items:
type: string
type: array
uniqueItems: true
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
wxtag_clients:
description: Clients associated with a WxLAN tag
items:
$ref: '#/components/schemas/wxtag_client'
type: array
uniqueItems: true
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
search_wxtag_apps:
description: Applications that can be referenced by WxTag rules
items:
$ref: '#/components/schemas/search_wxtag_apps_item'
type: array
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
search_wxtag_apps_item:
additionalProperties: false
description: Application metadata available for WxTag matching
properties:
group:
description: Application category group containing this WxTag app
examples:
- Emails
type: string
key:
description: Stable application key used in WxTag configuration
examples:
- gmail
type: string
name:
description: Display name of the application
examples:
- Gmail - web/app
type: string
required:
- key
- name
- group
type: object
wxlan_tag_match:
description: 'required if `type`==`match`. enum: `ap_id`, `app`, `asset_mac`, `client_mac`, `hostname`, `ip_range_subnet`, `port`, `psk_name`, `psk_role`, `radius_attr`, `radius_class`, `radius_group`, `radius_username`, `sdkclient_uuid`, `wlan_id`'
enum:
- ap_id
- app
- asset_mac
- client_mac
- hostname
- ip_range_subnet
- port
- psk_name
- psk_role
- radius_attr
- radius_class
- radius_group
- radius_username
- sdkclient_uuid
- wlan_id
type: string
wxlan_tag_spec_subnets:
default: []
description: Matched destination subnets and/or IP addresses
examples:
- - 0.0.0.0/0
items:
type: string
type: array
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
wxlan_tag_specs:
description: Traffic match specifications used when `type`==`spec`
items:
$ref: '#/components/schemas/wxlan_tag_spec'
type: array
wxlan_tag_values:
description: "Required if `type`==`match` and\n * `match`==`ap_id`: list of AP IDs\n * `match`==`app`: list of Application Names\n * `match`==`asset_mac`: list of Asset MAC addresses\n * `match`==`client_mac`: list of Client MAC addresses\n * `match`==`hostname`: list of Resources Hostnames\n * `match`==`ip_range_subnet`: list of IP addresses and/or CIDRs\n * `match`==`psk_name`: list of PSK Names\n * `match`==`psk_role`: list of PSK Roles\n * `match`==`port`: list of Ports or Port Ranges\n * `match`==`radius_attr`: list of RADIUS Attributes. The values are [ \"6=1\", \"26=10.2.3.4\" ], this support other RADIUS attributes where we know the type\n * `match`==`radius_class`: list of RADIUS Classes. This matches the ATTR-Class(25)\n * `match`==`radius_group`: list of RADIUS Groups. This is a smart tag that matches RADIUS-Filter-ID, Airespace-ACL-Name (VendorID=14179, VendorType=6) / Aruba-User-Role (VendorID=14823, VendorType=1)\n * `match`==`radius_username`: list of RADIUS Usernames. This matches the ATTR-User-Name(1)\n * `match`==`sdkclient_uuid`: list of SDK UUIDs\n * `match`==`wlan_id`: list of WLAN IDs\n\n**Notes**:\nVariables are not allowed"
items:
type: string
type: array
wxtag_client:
additionalProperties: false
description: Client associated with a WxLAN tag
properties:
mac:
description: Client MAC address associated with the WxLAN tag entry
examples:
- 5684dae9ac8b
type: string
since:
description: Time when the client became associated with the WxLAN tag, in epoch seconds
examples:
- 1428939600
type: number
required:
- mac
- since
type: object
wxlan_tag_operation:
default: in
description: 'required if `type`==`match`, type of tag (inclusive/exclusive). enum: `in`, `not_in`'
enum:
- in
- not_in
type: string
site_id:
description: Unique identifier of a Mist site
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
wxlan_tag_vlan_id:
description: If `type`==`vlan_id`, VLAN ID or variable
examples:
- '1055'
oneOf:
- type: string
- maximum: 4094
minimum: 1
type: integer
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
wxlan_tag_last_ips:
description: Most recent IP addresses observed for a WxLAN tag
items:
type: string
readOnly: true
type: array
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
examples:
WxtagArrayExample:
value:
- created_time: 0
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
last_ips:
- string
mac: string
match: wlan_id
modified_time: 0
name: string
op: in
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
resource_mac: string
services:
- string
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
specs:
- port_range: string
protocol: tcp
subnets:
- string
subnet: string
type: match
values:
- string
WxTagsAppsArrayExample:
value:
- group: Emails
key: gmail
name: Gmail - web/app
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
WxtagExample:
value:
created_time: 0
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
last_ips:
- string
mac: string
match: wlan_id
modified_time: 0
name: string
op: in
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
resource_mac: string
services:
- string
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
specs:
- port_range: string
protocol: tcp
subnets:
- string
subnet: string
type: match
values:
- string
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401Example:
value:
detail: Authentication credentials were not provided.
parameters:
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
wxtag_id:
in: path
name: wxtag_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
page:
description: Select the page number to return when using page-based pagination; starts at `1`
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
responses:
OK:
description: OK
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
WxTagsAppsArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxTagsAppsArrayExample'
schema:
$ref: '#/components/schemas/search_wxtag_apps'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxTagsAppsArrayExample'
schema:
$ref: '#/components/schemas/search_wxtag_apps'
description: List of Applications
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
WxtagArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxtagArrayExample'
schema:
$ref: '#/components/schemas/wxlan_tags'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxtagArrayExample'
schema:
$ref: '#/components/schemas/wxlan_tags'
description: OK
Wxtag:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxtagExample'
schema:
$ref: '#/components/schemas/wxlan_tag'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxtagExample'
schema:
$ref: '#/components/schemas/wxlan_tag'
description: OK
WxtagClients:
content:
application/json:
schema:
$ref: '#/components/schemas/wxtag_clients'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/wxtag_clients'
description: OK
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey