SkyATP is a cloud-based solution that provides advanced threat protection for network security. It allows security analysts to update their defense against new attack techniques in real-time and distribute threat intelligence quickly. SkyATP inspects network traffic and blocks devices that have downloaded malware or accessed command and control servers. It also offers configuration and troubleshooting capabilities for administrators.
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Sites Skyatp API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: 'SkyATP is a cloud-based solution that provides advanced threat protection for network security.
It allows security analysts to update their defense against new attack techniques in real-time and distribute threat intelligence quickly.
SkyATP inspects network traffic and blocks devices that have downloaded malware or accessed command and control servers. It also offers configuration and troubleshooting capabilities for administrators.'
name: Sites Skyatp
paths:
/api/v1/sites/{site_id}/skyatp/events/count:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Count by Distinct Attributes of Skyatp Events (WIP)
operationId: countSiteSkyatpEvents
parameters:
- description: 'Field used to group this count response. enum: `device_mac`, `mac`, `threat_level`, `type`'
in: query
name: distinct
schema:
$ref: '#/components/schemas/site_sky_atp_events_count_distinct'
- description: Event type, e.g. cc, fs, mw
in: query
name: type
schema:
type: string
- description: Filter results by MAC address
in: query
name: mac
schema:
type: string
- description: Filter results by device MAC address
in: query
name: device_mac
schema:
type: string
- description: Filter results by threat level
in: query
name: threat_level
schema:
type: integer
- $ref: '#/components/parameters/ip'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
responses:
'200':
$ref: '#/components/responses/Count'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: countSiteSkyatpEvents
tags:
- Sites Skyatp
/api/v1/sites/{site_id}/skyatp/events/search:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: Search Skyatp Events (WIP)
operationId: searchSiteSkyatpEvents
parameters:
- description: Event type, e.g. cc, fs, mw
in: query
name: type
schema:
type: string
- description: Filter results by MAC address
in: query
name: mac
schema:
type: string
- description: Filter results by device MAC address
in: query
name: device_mac
schema:
type: string
- description: Filter results by threat level
in: query
name: threat_level
schema:
type: integer
- $ref: '#/components/parameters/ip'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/sort'
- $ref: '#/components/parameters/search_after'
responses:
'200':
$ref: '#/components/responses/SkyAtpEventsSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: searchSiteSkyatpEvents
tags:
- Sites Skyatp
components:
schemas:
response_events_sky_atp_search_results:
description: Sky ATP event records returned by a search response
items:
$ref: '#/components/schemas/events_skyatp'
type: array
uniqueItems: true
timestamp:
description: Epoch timestamp, in seconds
format: double
readOnly: true
type: number
org_id:
description: Unique identifier of a Mist organization
examples:
- a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
format: uuid
readOnly: true
type: string
response_http401:
additionalProperties: false
description: Standard HTTP 401 authentication error response
properties:
detail:
description: Human-readable explanation of the authentication error
examples:
- Authentication credentials were not provided.
type: string
type: object
response_http429:
additionalProperties: false
description: Standard HTTP 429 rate limit error response
properties:
detail:
description: Human-readable explanation of the rate limit error
examples:
- Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
type: string
type: object
site_sky_atp_events_count_distinct:
default: type
description: 'enum: `device_mac`, `mac`, `threat_level`, `type`'
enum:
- device_mac
- mac
- threat_level
- type
type: string
response_http403:
additionalProperties: false
description: Standard HTTP 403 permission error response
properties:
detail:
description: Human-readable explanation of the permission error
examples:
- You do not have permission to perform this action.
type: string
type: object
count_results:
description: List of count result rows
items:
$ref: '#/components/schemas/count_result'
type: array
uniqueItems: true
response_http400:
additionalProperties: false
description: Standard HTTP 400 bad request error response
properties:
detail:
description: Human-readable explanation of the bad request error
examples:
- 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
type: string
type: object
count_result:
additionalProperties:
type: string
description: Count result row with the matching distinct field values
properties:
count:
description: Number of matching items for the distinct value or values in this result
type: integer
required:
- count
type: object
response_count:
additionalProperties: false
description: Distinct count response for time-bounded search results
properties:
distinct:
description: Field used to group the count results
type: string
end:
description: Search window end timestamp for the count request, in epoch seconds
type: integer
limit:
description: Maximum number of distinct count results requested
type: integer
results:
$ref: '#/components/schemas/count_results'
description: Count results grouped by the distinct field
start:
description: Search window start timestamp for the count request, in epoch seconds
type: integer
total:
description: Number of distinct result buckets returned
type: integer
required:
- distinct
- end
- limit
- results
- start
- total
type: object
response_events_sky_atp_search:
additionalProperties: false
description: Paginated response for Sky ATP event search results
properties:
end:
description: Epoch timestamp for the end of the Sky ATP event search window
type: integer
limit:
description: Maximum number of Sky ATP event records returned in this page
type: integer
next:
description: Pagination cursor or URL for retrieving the next page of Sky ATP event records
type: string
results:
$ref: '#/components/schemas/response_events_sky_atp_search_results'
description: Sky ATP event records matching the search filters
start:
description: Epoch timestamp for the start of the Sky ATP event search window
type: integer
total:
description: Number of Sky ATP event records matching the search filters across all pages
type: integer
required:
- end
- limit
- results
- start
- total
type: object
site_id:
description: Unique identifier of a Mist site
examples:
- 441a1214-6928-442a-8e92-e1d34b8ec6a6
format: uuid
readOnly: true
type: string
response_http404:
additionalProperties: false
description: Standard HTTP 404 not found error response
properties:
id:
description: Missing resource identifier, when the API includes one
type: string
type: object
events_skyatp:
additionalProperties: false
description: SkyATP threat event returned by SkyATP event search APIs
properties:
device_mac:
description: Network device MAC address that reported the SkyATP event
readOnly: true
type: string
for_site:
description: Whether the SkyATP event is scoped to a site rather than only the organization
readOnly: true
type: boolean
ip:
description: Client IP address associated with the SkyATP event
readOnly: true
type: string
mac:
description: Client MAC address associated with the SkyATP event
readOnly: true
type: string
org_id:
$ref: '#/components/schemas/org_id'
description: Organization that contains the SkyATP event
site_id:
$ref: '#/components/schemas/site_id'
description: Site where the SkyATP event occurred
threat_level:
description: Numeric SkyATP threat level reported for the event
readOnly: true
type: integer
timestamp:
$ref: '#/components/schemas/timestamp'
description: Time when the SkyATP event occurred
type:
description: SkyATP event type, such as `cc`, `fs`, or `mw`
readOnly: true
type: string
required:
- mac
- threat_level
- device_mac
- timestamp
- org_id
- site_id
- type
- ip
type: object
responses:
SkyAtpEventsSearch:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/SkyAtpEventsSearchExample'
schema:
$ref: '#/components/schemas/response_events_sky_atp_search'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/SkyAtpEventsSearchExample'
schema:
$ref: '#/components/schemas/response_events_sky_atp_search'
description: OK
Count:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/CountExample'
schema:
$ref: '#/components/schemas/response_count'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/CountExample'
schema:
$ref: '#/components/schemas/response_count'
description: Result of Count
HTTP400:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP400Example'
schema:
$ref: '#/components/schemas/response_http400'
description: Bad Syntax
HTTP403:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP403Example'
schema:
$ref: '#/components/schemas/response_http403'
description: Permission Denied
HTTP404:
content:
application/json:
schema:
$ref: '#/components/schemas/response_http404'
application/vnd.api+json:
schema:
$ref: '#/components/schemas/response_http404'
description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist
HTTP429:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP429Example'
schema:
$ref: '#/components/schemas/response_http429'
description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
HTTP401:
content:
application/json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
application/vnd.api+json:
examples:
Example:
$ref: '#/components/examples/HTTP401Example'
schema:
$ref: '#/components/schemas/response_http401'
description: Unauthorized
parameters:
start:
description: Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d` or `-1w`
in: query
name: start
schema:
type: string
sort:
description: On which field the list should be sorted, -prefix represents DESC order
in: query
name: sort
schema:
default: timestamp
examples:
- -site_id
type: string
duration:
description: Time range duration for the query, using relative units such as `10m`, `7d`, or `2w`
in: query
name: duration
schema:
default: 1d
examples:
- 10m
type: string
limit:
description: Maximum number of results to return per page
in: query
name: limit
schema:
default: 100
minimum: 0
type: integer
ip:
description: Filter results by IPv4 address
in: query
name: ip
schema:
examples:
- 192.168.1.1
format: ipv4
type: string
site_id:
in: path
name: site_id
required: true
schema:
examples:
- 000000ab-00ab-00ab-00ab-0000000000ab
format: uuid
type: string
end:
description: Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as `-1d`, `-2h`, or `now`
in: query
name: end
schema:
type: string
search_after:
description: Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the `next` URL from the previous response and should not be manually constructed.
in: query
name: search_after
schema:
type: string
examples:
CountExample:
value:
distinct: string
end: 0
limit: 0
results:
- count: 0
property: string
start: 0
total: 0
HTTP403Example:
value:
detail: You do not have permission to perform this action.
HTTP400Example:
value:
detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)'
HTTP429Example:
value:
detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold
SkyAtpEventsSearchExample:
value:
end: 1513176951
limit: 10
results:
- device_mac: 658279bb1fa4
ip: 172.16.0.11
mac: b019c66c8348
org_id: 3139f2c2-fac6-11e5-8156-0242ac110006
site_id: 70e0f468-fc13-11e5-85ad-0242ac110008
threat_level: 7
timestamp: 1592524478
type: cc
start: 1512572151
total: 1
HTTP401Example:
value:
detail: Authentication credentials were not provided.
securitySchemes:
apiToken:
description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed."
in: header
name: Authorization
type: apiKey
csrfToken:
description: 'Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.
**Format**:
```
X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
```
For automation, API Token authentication is preferred.'
in: header
name: X-CSRFToken
type: apiKey