Rogues are unauthorized wireless access points that are installed on a network without authorization. They can be connected to the LAN via an ethernet cable, similar to a pc, and are typically set up by individuals with malicious intent or by employees trying to cover a dead spot with their own wi-fi hotspot.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Sites Rogues API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'Rogues are unauthorized wireless access points that are installed on a network without authorization.
They can be connected to the LAN via an ethernet cable, similar to a pc, and are typically set up by individuals with malicious intent or by employees trying to cover a dead spot with their own wi-fi hotspot.'
name: Sites Rogues
paths:
/api/v1/sites/{site_id}/insights/rogues:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Get List of Site Rogue/Neighbor APs
operationId: listSiteRogueAPs
parameters:
- $ref: '#/components/parameters/rogue_type'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/interval'
responses:
'200':
$ref: '#/components/responses/InsightRogue'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listSiteRogueAPs
tags:
- Sites Rogues
/api/v1/sites/{site_id}/insights/rogues/clients:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Get List of Site Rogue Clients
operationId: listSiteRogueClients
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/interval'
responses:
'200':
$ref: '#/components/responses/InsightRogueClients'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listSiteRogueClients
tags:
- Sites Rogues
/api/v1/sites/{site_id}/rogues/events/count:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Count by Distinct Attributes of Rogue Events
operationId: countSiteRogueEvents
parameters:
- description: 'Field used to group this count response. enum: `ap`, `bssid`, `ssid`, `type`'
in: query
name: distinct
schema:
$ref: '#/components/schemas/site_rogue_events_count_distinct'
- $ref: '#/components/parameters/rogue_type'
- description: Filter results by SSID
in: query
name: ssid
schema:
type: string
- description: Filter results by BSSID
in: query
name: bssid
schema:
type: string
- description: MAC of the device that had strongest signal strength for ssid/bssid pair
in: query
name: ap_mac
schema:
type: string
- description: Filter results by channel
in: query
name: channel
schema:
type: string
- description: Whether the reporting AP see a wireless client (on LAN) connecting to it
in: query
name: seen_on_lan
schema:
type: boolean
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
responses:
'200':
$ref: '#/components/responses/Count'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: countSiteRogueEvents
tags:
- Sites Rogues
/api/v1/sites/{site_id}/rogues/events/search:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Search Rogue Events
operationId: searchSiteRogueEvents
parameters:
- $ref: '#/components/parameters/rogue_type'
- description: Filter results by SSID
in: query
name: ssid
schema:
type: string
- description: Filter results by BSSID
in: query
name: bssid
schema:
type: string
- description: MAC of the device that had strongest signal strength for ssid/bssid pair
in: query
name: ap_mac
schema:
type: string
- description: Filter results by channel
in: query
name: channel
schema:
type: integer
- description: Whether the reporting AP see a wireless client (on LAN) connecting to it
in: query
name: seen_on_lan
schema:
type: boolean
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/sort'
- $ref: '#/components/parameters/search_after'
responses:
'200':
$ref: '#/components/responses/RogueEventsSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: searchSiteRogueEvents
tags:
- Sites Rogues
/api/v1/sites/{site_id}/rogues/{rogue_bssid}:
parameters:
- $ref: '#/components/parameters/site_id'
- $ref: '#/components/parameters/rogue_bssid'
get:
description: Get Rogue AP Details
operationId: getSiteRogueAP
responses:
'200':
$ref: '#/components/responses/RogueDetails'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getSiteRogueAP
tags:
- Sites Rogues
components:
responses:
InsightRogue:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/InsightRogueExample'
schema:
$ref: '#/components/schemas/response_insight_rogue'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/InsightRogueExample'
schema:
$ref: '#/components/schemas/response_insight_rogue'
description: OK
Count:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/CountExample'
schema:
$ref: '#/components/schemas/response_count'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/CountExample'
schema:
$ref: '#/components/schemas/response_count'
description: Result of Count
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
RogueEventsSearch:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/RogueEventsSearchExample'
schema:
$ref: '#/components/schemas/response_events_rogue_search'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/RogueEventsSearchExample'
schema:
$ref: '#/components/schemas/response_events_rogue_search'
description: OK
InsightRogueClients:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/InsightRogueClientsExample'
schema:
$ref: '#/components/schemas/response_insight_rogue_client'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/InsightRogueClientsExample'
schema:
$ref: '#/components/schemas/response_insight_rogue_client'
description: OK
RogueDetails:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/RogueDetailsExample'
schema:
$ref: '#/components/schemas/rogue_details'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/RogueDetailsExample'
schema:
$ref: '#/components/schemas/rogue_details'
description: OK
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
parameters:
rogue_bssid:
in: path
name: rogue_bssid
required: true
schema:
examples:
- 0000000000ab
pattern: ^[0-9a-fA-F]{12}$
type: string
start:
description: Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d` or `-1w`
in: query
name: start
schema:
type: string
sort:
description: On which field the list should be sorted, -prefix represents DESC order
in: query
name: sort
schema:
default: timestamp
examples:
- -site_id
type: string
duration:
description: Time range duration for the query, using relative units such as `10m`, `7d`, or `2w`
in: query
name: duration
schema:
default: 1d
examples:
- 10m
type: string
rogue_type:
description: 'Rogue classification used to filter the results. enum: `honeypot`, `lan`, `others`, `spoof`'
in: query
name: type
schema:
$ref: '#/components/schemas/rogue_type'
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
site_id:
in: path
name: site_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
end:
description: Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d`, `-2h`, or `now`
in: query
name: end
schema:
type: string
search_after:
description: Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the `next` URL from the previous response and should not be manually constructed.
in: query
name: search_after
schema:
type: string
interval:
description: Aggregation works by giving a time range plus interval (e.g. 1d, 1h, 10m) where aggregation function would be applied to.
in: query
name: interval
schema:
examples:
- 10m
type: string
schemas:
insight_rogue_client:
additionalProperties: false
description: Rogue client observation returned by site insights
properties:
annotation:
description: Rogue client annotation or classification
type: string
ap_mac:
description: Reporting AP MAC address that observed the rogue client
type: string
avg_rssi:
description: Average RSSI for the rogue client as heard by reporting APs
type: number
band:
description: Radio band on which the rogue client was observed
type: string
bssid:
description: Rogue BSSID associated with the client
type: string
client_mac:
description: Observed client MAC address on the rogue BSSID
type: string
num_aps:
description: Number of APs that observed the rogue client
type: integer
required:
- bssid
- ap_mac
- client_mac
- num_aps
- band
- avg_rssi
- annotation
type: object
insight_rogue_ap:
additionalProperties: false
description: Rogue or neighbor AP observation returned by site insights
properties:
ap_mac:
description: Reporting AP MAC address with the strongest signal for the SSID/BSSID pair
type: string
avg_rssi:
description: Average RSSI for the SSID/BSSID pair as heard by the reporting AP
type: number
bssid:
description: Rogue or neighbor BSSID detected as a threat
type: string
channel:
description: Radio channel where the reporting AP heard the SSID/BSSID pair
type: string
delta_x:
description: X position relative to the reporting AP (`ap_mac`)
type: number
delta_y:
description: Y position relative to the reporting AP (`ap_mac`)
type: number
num_aps:
description: Number of APs that heard the SSID/BSSID pair
type: integer
seen_on_lan:
description: Whether the reporting AP sees a LAN-side client associated with the BSSID
type: boolean
ssid:
description: Wireless SSID detected for the rogue or neighbor BSSID
type: string
times_heard:
description: Represents number of times the pair was heard in the interval. Each count roughly corresponds to a minute.
type: integer
required:
- ap_mac
- avg_rssi
- bssid
- channel
- num_aps
type: object
rogue_type:
description: 'enum: `honeypot`, `lan`, `others`, `spoof`'
enum:
- honeypot
- lan
- others
- spoof
type: string
timestamp:
description: Epoch timestamp, in seconds
format: double
readOnly: true
type: number
events_rogue:
additionalProperties: false
description: Rogue wireless network event detected by a site AP
properties:
ap:
description: Access point MAC address that detected the rogue BSSID
type: string
bssid:
description: Rogue BSSID observed by the AP
type: string
channel:
description: Radio channel where the rogue BSSID was observed
type: integer
rssi:
description: Received signal strength of the rogue BSSID, in dBm
type: integer
ssid:
description: Wireless network SSID advertised by the rogue BSSID
type: string
timestamp:
$ref: '#/components/schemas/timestamp'
description: Time when the rogue event was observed
required:
- ssid
- bssid
- timestamp
- ap
- rssi
- channel
type: object
rogue_details:
additionalProperties: false
description: Rogue AP detail response
properties:
manufacture:
description: Vendor or manufacturer name reported for the rogue AP
type: string
seen_as_client:
description: Whether this rogue AP was also observed as a client
type: boolean
required:
- seen_as_client
- manufacture
type: object
response_events_rogue_search_results:
description: Rogue AP event records returned by a search response
items:
$ref: '#/components/schemas/events_rogue'
type: array
uniqueItems: true
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
response_insight_rogue_client:
additionalProperties: false
description: Paginated response for rogue client insight results
properties:
end:
description: Epoch timestamp for the end of the rogue client insight window
type: integer
limit:
description: Maximum number of rogue client observations returned in this page
type: integer
next:
description: Pagination cursor or URL for retrieving the next page of rogue client observations
type: string
results:
$ref: '#/components/schemas/response_insight_rogue_client_results'
description: Rogue client observations returned for the site insight query
start:
description: Epoch timestamp for the start of the rogue client insight window
type: integer
required:
- start
- end
- limit
- results
type: object
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
response_insight_rogue_results:
description: Rogue or neighbor AP insight observations returned by a query
items:
$ref: '#/components/schemas/insight_rogue_ap'
type: array
uniqueItems: true
response_insight_rogue:
additionalProperties: false
description: Paginated response for rogue or neighbor AP insight results
properties:
end:
description: Epoch timestamp for the end of the rogue AP insight window
type: integer
limit:
description: Maximum number of rogue or neighbor AP observations returned in this page
type: integer
next:
description: Pagination cursor or URL for retrieving the next page of rogue or neighbor AP observations; null when no next page exists
type: string
results:
$ref: '#/components/schemas/response_insight_rogue_results'
description: Rogue or neighbor AP observations returned for the site insight query
start:
description: Epoch timestamp for the start of the rogue AP insight window
type: integer
required:
- end
- limit
- results
- start
type: object
count_results:
description: List of count result rows
items:
$ref: '#/components/schemas/count_result'
type: array
uniqueItems: true
response_events_rogue_search:
additionalProperties: false
description: Paginated response for rogue AP event search results
properties:
end:
description: Epoch timestamp for the end of the rogue AP event search window
type: integer
limit:
description: Maximum number of rogue AP event records returned in this page
type: integer
next:
description: Pagination cursor or URL for retrieving the next page of rogue AP event records
type: string
results:
$ref: '#/components/schemas/response_events_rogue_search_results'
description: Rogue AP event records matching the search filters
start:
description: Epoch timestamp for the start of the rogue AP event search window
type: integer
total:
description: Number of rogue AP event records matching the search filters across all pages
type: integer
required:
- end
- limit
- results
- start
- total
type: object
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
response_insight_rogue_client_results:
description: Rogue client insight observations returned by a query
items:
$ref: '#/components/schemas/insight_rogue_client'
type: array
uniqueItems: true
site_rogue_events_count_distinct:
default: bssid
description: 'enum: `ap`, `bssid`, `ssid`, `type`'
enum:
- ap
- bssid
- ssid
- type
type: string
count_result:
additionalProperties:
type: string
description: Count result row with the matching distinct field values
properties:
count:
description: Number of matching items for the distinct value or values in this result
type: integer
required:
- count
type: object
response_count:
additionalProperties: false
description: Distinct count response for time-bounded search results
properties:
distinct:
description: Field used to group the count results
type: string
end:
description: Search window end timestamp for the count request, in epoch seconds
type: integer
limit:
description: Maximum number of distinct count results requested
type: integer
results:
$ref: '#/components/schemas/count_results'
description: Count results grouped by the distinct field
start:
description: Search window start timestamp for the count request, in epoch seconds
type: integer
total:
description: Number of distinct result buckets returned
type: integer
required:
- distinct
- end
- limit
- results
- start
- total
type: object
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
examples:
RogueEventsSearchExample:
value:
end: 1538074800
limit: 10
results:
- ap: 5c5b350e10030
bssid: 38ff363c8c4c
channel: 136
rssi: -54
ssid: MyHomeNetwork
timestamp: 1538074612
- ap: 5c5b350e10030
bssid: 60d02c2394cc
channel: 11
rssi: -59
ssid: Home-Office
timestamp: 1538074612
start: 1538071200
total: 2
CountExample:
value:
distinct: string
end: 0
limit: 0
results:
- count: 0
property: string
start: 0
total: 0
HTTP403Example:
value:
detail: You do not have permission to perform this action.
RogueDetailsExample:
value:
manufacture: Intel Corporate
seen_as_client: true
InsightRogueClientsExample:
value:
end: 1428954000
limit: 100
next: /api/v1/sites/a3eda150-ab3f-11e4-aa18-13e21dd250cc/rogues/clients?start=1498482000&end=1498485600&limit=10&interval=1h
results:
- annotation: whitelist
ap_mac: 5c-5b-35-0e-02-1c
avg_rssi: -63.9
band: '5'
bssid: d8-97-ba-76-b5-aa
client_mac: 34-f8-32-13-57-c2
num_aps: 2
start: 1428939600
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
InsightRogueExample:
value:
end: 1428954000
limit: 100
next: /api/v1/sites/a3eda150-ab3f-11e4-aa18-13e21dd250cc/rogues?start=1498482000&end=1498485600&limit=10&interval=1h&type=others
results:
- ap_mac: 5c5b350e021c
avg_rssi: -72
bssid: d8-97-ba-76-b5-aa
channel: '11'
num_aps: 4
ssid: xfinitywifi
times_heard: 8
start: 1428939600
HTTP401Example:
value:
detail: Authentication credentials were not provided.
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey