A WxLan Tunnel (WxTunnel) are used to create a secure connection between Juniper Mist Access Points and third-party VPN concentrators using protocols such as L2TPv3 or dmvpn. These tunnels allow for the aggregation of ethernet interfaces on access points, support dynamic or static tunnels, and provide options for IPSec encryption.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Orgs WxTunnels API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'A WxLan Tunnel (WxTunnel) are used to create a secure connection between Juniper Mist Access Points and third-party VPN concentrators using protocols such as L2TPv3 or dmvpn.
These tunnels allow for the aggregation of ethernet interfaces on access points, support dynamic or static tunnels, and provide options for IPSec encryption.'
name: Orgs WxTunnels
paths:
/api/v1/orgs/{org_id}/wxtunnels:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: Get List of Org WxLAN Tunnels
operationId: listOrgWxTunnels
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/WxtunnelArray'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgWxTunnels
tags:
- Orgs WxTunnels
post:
description: Create Org WxAN Tunnel
operationId: createOrgWxTunnel
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/wxlan_tunnel'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Wxtunnel'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: createOrgWxTunnel
tags:
- Orgs WxTunnels
/api/v1/orgs/{org_id}/wxtunnels/{wxtunnel_id}:
parameters:
- $ref: '#/components/parameters/org_id'
- $ref: '#/components/parameters/wxtunnel_id'
delete:
description: Delete Org WxLAN Tunnel
operationId: deleteOrgWxTunnel
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: deleteOrgWxTunnel
tags:
- Orgs WxTunnels
get:
description: Get Org WxLAN Tunnel Details
operationId: getOrgWxTunnel
responses:
'200':
$ref: '#/components/responses/Wxtunnel'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgWxTunnel
tags:
- Orgs WxTunnels
put:
description: Update Org WxLAN Tunnel
operationId: updateOrgWxTunnel
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/wxlan_tunnel'
description: Request Body
responses:
'200':
$ref: '#/components/responses/Wxtunnel'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateOrgWxTunnel
tags:
- Orgs WxTunnels
components:
examples:
WxtunnelExample:
value:
created_time: 0
dmvpn:
enabled: true
holding_time: 0
host_routes:
- string
for_mgmt: true
hello_interval: 1
hello_retries: 3
hostname: string
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
ipsec:
enabled: true
psk: string123
is_static: true
modified_time: 0
mtu: 1500
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
peers:
- string
router_id: string
secret: string
sessions:
- ap_as_session_id: string
comment: string
enable_cookie: true
ethertype: ethernet
local_session_id: 1
pseudo_802.1ad_enabled: true
remote_id: string
remote_session_id: 1
use_ap_as_session_ids: true
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
udp_port: 0
use_udp: true
WxtunnelArrayExample:
value:
- created_time: 0
dmvpn:
enabled: true
holding_time: 0
host_routes:
- string
for_mgmt: true
hello_interval: 1
hello_retries: 3
hostname: string
id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
ipsec:
enabled: true
psk: string123
is_static: true
modified_time: 0
mtu: 1500
name: string
org_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
peers:
- string
router_id: string
secret: string
sessions:
- ap_as_session_id: string
comment: string
enable_cookie: true
ethertype: ethernet
local_session_id: 1
pseudo_802.1ad_enabled: true
remote_id: string
remote_session_id: 1
use_ap_as_session_ids: true
site_id: b069b358-4c97-5319-1f8c-7c5ca64d6ab1
udp_port: 0
use_udp: true
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401Example:
value:
detail: Authentication credentials were not provided.
parameters:
org_id:
in: path
name: org_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
wxtunnel_id:
in: path
name: wxtunnel_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
page:
description: Select the page number to return when using page-based pagination; starts at `1`
in: query
name: page
schema:
default: 1
minimum: 1
type: integer
responses:
OK:
description: OK
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
WxtunnelArray:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxtunnelArrayExample'
schema:
$ref: '#/components/schemas/wxlan_tunnels'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxtunnelArrayExample'
schema:
$ref: '#/components/schemas/wxlan_tunnels'
description: OK
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
Wxtunnel:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/WxtunnelExample'
schema:
$ref: '#/components/schemas/wxlan_tunnel'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/WxtunnelExample'
schema:
$ref: '#/components/schemas/wxlan_tunnel'
description: OK
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
schemas:
wxlan_tunnel_ipsec:
additionalProperties: false
description: IPSec-related configurations; requires DMVPN be enabled
properties:
enabled:
default: false
description: Whether ipsec is enabled, requires DMVPN be enabled
type: boolean
psk:
description: Pre-shared key used for IPsec on this WxLAN tunnel
type: string
required:
- psk
type: object
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
wxlan_tunnel_session:
additionalProperties: false
description: L2TPv3 session established inside a WxLAN tunnel
properties:
ap_as_session_id:
description: If `use_ap_as_session_ids`==`true`, only apmac is supported right now. This is the name WLAN should use for wxtunnel_remote_id
type: string
comment:
description: Optional, user-specified string for display purpose
type: string
enable_cookie:
description: Whether L2TPv3 cookie support is enabled for this session
type: boolean
ethertype:
$ref: '#/components/schemas/wxlan_tunnel_session_ethertype'
description: Frame type carried by this tunnel session
local_session_id:
description: Identifier for the local L2TPv3 session, from 1 to 2147483647
maximum: 2147483647
minimum: 1
type: integer
pseudo_802.1ad_enabled:
default: false
description: Optional. Enables the pseudo 802.1ad QinQ mode where the AP device drops the outer vlan tag (QinQ). This mode is useful when tunneling Mist AP’s to some aggregation routers.
type: boolean
remote_id:
description: Remote-id of the session, has to be unique in the same tunnel
type: string
remote_session_id:
description: Identifier for the remote L2TPv3 session, from 1 to 2147483647
maximum: 2147483647
minimum: 1
type: integer
use_ap_as_session_ids:
default: false
description: Whether to use AP (last 4 bytes of MAC currently) as session ids
type: boolean
type: object
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
wxlan_tunnel_sessions:
description: Sessions to be established with the tunnel. Has to be >= 1 in order for this tunnel to be useful. For management tunnel, it can only have 1
items:
$ref: '#/components/schemas/wxlan_tunnel_session'
type: array
uniqueItems: true
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
created_time:
description: When the object has been created, in epoch
format: double
readOnly: true
type: number
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
wxlan_tunnel_peers:
description: List of remote peers’ IP or hostname
items:
type: string
type: array
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
wxlan_tunnel:
description: WxLAN tunnel configuration for L2TPv3 or DMVPN connectivity
properties:
created_time:
$ref: '#/components/schemas/created_time'
description: Time when this WxLAN tunnel was created, in epoch seconds
dmvpn:
$ref: '#/components/schemas/wxlan_tunnel_dmvpn'
description: Settings for Dynamic Multipoint VPN on this WxLAN tunnel
for_mgmt:
default: false
description: Determined during creation time and cannot be toggled. A management tunnel cannot be used by wxlan rule or by wlan
type: boolean
for_site:
description: Whether this WxLAN tunnel is scoped to a site
readOnly: true
type: boolean
hello_interval:
default: 60
description: In seconds, used as heartbeat to detect if a tunnel is alive. AP will try another peer after missing N hellos specified by hello_retries.
maximum: 300
minimum: 1
type: integer
hello_retries:
default: 7
description: Number of missed hello messages before the AP tries another tunnel peer
maximum: 30
minimum: 2
type: integer
hostname:
description: "Optional, overwrite the hostname in SCCRQ control message, default is or null, %H and %M can be used, which will be replace with corresponding values:\n * %H: name of the ap if provided (and will be stripped so it can be used for hostname) and fallbacks to MAC\n * %M: MAC (e.g. 5c5b350e0060)"
type: string
id:
$ref: '#/components/schemas/id'
description: Unique identifier for this WxLAN tunnel
ipsec:
$ref: '#/components/schemas/wxlan_tunnel_ipsec'
description: Security settings for IPsec on this WxLAN tunnel; requires DMVPN to be enabled
is_static:
default: false
description: Whether it’s static/unmanaged (i.e. no control session). As the session configurations are not compatible, cannot be toggled.
type: boolean
modified_time:
$ref: '#/components/schemas/modified_time'
description: Time when this WxLAN tunnel was last modified, in epoch seconds
mtu:
default: 0
description: 0 to enable PMTU, 552-1500 to start PMTU with a lower MTU
maximum: 1500
minimum: 0
type: integer
name:
description: The name of the tunnel
type: string
org_id:
$ref: '#/components/schemas/org_id'
description: Owning organization associated with this WxLAN tunnel
peers:
$ref: '#/components/schemas/wxlan_tunnel_peers'
description: Remote peer IP addresses or hostnames for this tunnel
router_id:
description: Optional, overwrite the router-id in SCCRQ control message, default is "" or null, can also be an IPv4 address
type: string
secret:
description: Shared secret used for tunnel authentication, ‘’ if no auth is used
type: string
sessions:
$ref: '#/components/schemas/wxlan_tunnel_sessions'
description: L2TPv3 sessions established for this tunnel
site_id:
$ref: '#/components/schemas/site_id'
description: Mist site associated with this WxLAN tunnel, when site-scoped
udp_port:
description: UDP port if `use_udp`==`true`
type: integer
use_udp:
default: false
description: Whether to use UDP instead of IP (proto=115, which is default of L2TPv3)
type: boolean
required:
- name
type: object
wxlan_tunnel_dmvpn:
additionalProperties: false
description: Dynamic Multipoint VPN configurations
properties:
enabled:
default: false
description: Whether DMVPN is enabled
type: boolean
holding_time:
description: Optional; the holding time for NHRP ‘registration requests’ and ‘resolution replies’ sent from the Mist AP (in seconds); default 600
type: integer
host_routes:
$ref: '#/components/schemas/wxlan_tunnel_dmvpn_host_routes'
description: IPv4 DMVPN peer host routes to which traffic is forwarded
type: object
wxlan_tunnels:
description: WxLAN tunnel records returned by a list response
items:
$ref: '#/components/schemas/wxlan_tunnel'
type: array
wxlan_tunnel_session_ethertype:
description: 'Frame type carried by this tunnel session. enum: `ethernet`, `vlan`'
enum:
- ethernet
- vlan
type: string
site_id:
description: Unique identifier of a Mist site
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
modified_time:
description: When the object has been modified for the last time, in epoch
format: double
readOnly: true
type: number
wxlan_tunnel_dmvpn_host_routes:
description: Optional; list of IPv4 DMVPN peer host ip-addresses to which traffic is forwarded
items:
type: string
type: array
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey