Mist Utilities PCAPs API

openapi: 3.2.0
info:
  contact:
    email: tmunzer@juniper.net
    name: Thomas Munzer
  description: '> Version: **2606.1.1**

    >

    > Date: **July 10, 2026**

    <div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>


    ---

    ## Additional Documentation

    * [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)

    * [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)

    * [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)


    ## Helpful Resources

    * [API Sandbox and Exercises](https://api-class.mist.com/)

    * [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)

    * [Python Script Examples](https://github.com/tmunzer/mist_library)

    * [API Demo Apps](https://apps.mist-lab.fr/)

    * [Juniper Blog](https://blogs.juniper.net/)


    ## Mist Web Browser Extension:

    * Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)

    * Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)


    ---'
  license:
    name: MIT
    url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
  title: Mist Utilities PCAPs API
  version: 2606.1.1
  x-logo:
    altText: Juniper-MistAI
    backgroundColor: '#FFFFFF'
    url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
  url: https://api.mist.com
- description: Mist Global 02
  url: https://api.gc1.mist.com
- description: Mist Global 03
  url: https://api.ac2.mist.com
- description: Mist Global 04
  url: https://api.gc2.mist.com
- description: Mist Global 05
  url: https://api.gc4.mist.com
- description: Mist EMEA 01
  url: https://api.eu.mist.com
- description: Mist EMEA 02
  url: https://api.gc3.mist.com
- description: Mist EMEA 03
  url: https://api.ac6.mist.com
- description: Mist EMEA 04
  url: https://api.gc6.mist.com
- description: Mist APAC 01
  url: https://api.ac5.mist.com
- description: Mist APAC 02
  url: https://api.gc5.mist.com
- description: Mist APAC 03
  url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: API Calls to start, stop or managed Packet Captures at the device level
  name: Utilities PCAPs
paths:
  /api/v1/orgs/{org_id}/pcaps:
    parameters:
    - $ref: '#/components/parameters/org_id'
    get:
      description: List organization packet capture sessions and generated capture files for the selected time range.
      operationId: listOrgPacketCaptures
      parameters:
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/PcapsSearch'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listOrgPacketCaptures
      tags:
      - Utilities PCAPs
  /api/v1/orgs/{org_id}/pcaps/capture:
    parameters:
    - $ref: '#/components/parameters/org_id'
    delete:
      description: Stop the currently running organization packet capture and end its websocket output stream.
      operationId: stopOrgPacketCapture
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: stopOrgPacketCapture
      tags:
      - Utilities PCAPs
    get:
      description: Retrieve the current organization packet capture status, including active capture targets and progress.
      operationId: getOrgCapturingStatus
      responses:
        '200':
          $ref: '#/components/responses/PcapStatus'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getOrgCapturingStatus
      tags:
      - Utilities PCAPs
    post:
      description: "Start an organization-level packet capture for org-level Mist Edges\n\n**NOTE**: For packet captures of org level Mist Edges only. Use [Start Site Packet Capture](/#operations/startSitePacketCapture) for site level Mist Edges. \n\nThe output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux.\n\n#### Subscribe to Device Command outputs\n`WS /api-ws/v1/stream`\n\n```json\n{\n    \"subscribe\": \"/orgs/:org_id/pcaps\"\n}\n```\n#### Response (MxEdge)\n```json\n{\n  \"event\": \"data\"\n  \"channel\": \"/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n  \"data\": {\n      \"capture_id\": \"f039b1b4-a23e-48b2-906a-0da40524de73\", \n      \"pcap_dict\": {\n          \"dst_mac\": \"68:ec:c5:09:2e:87\",\n          \"src_mac\": \"8c:3b:ad:e0:47:40\", \n          \"vlan\": 1, \n          \"src_ip\": \"34.224.147.117\", \n          \"dst_ip\": \"192.168.1.55\",\n          \"dst_port\": 51635, \n          \"src_port\": 443,\n          \"protocol\": \"TCP\", \n          \"mxedge_id\": \"00000000-0000-0000-1000-001122334455\",\n          \"direction\": \"tx\", \n          \"timestamp\": 1652247615, \n          \"length\": 159.0, \n          \"lost_messages\": 0,\n          \"interface\": \"port0\",\n          \"info\": \"1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq \\n                    2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\\\n\",\n          }, \n      \"pcap_raw\": \"1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==\"\n    }\n}\n```\n#### Stop Response\n```json\n{\n  \"event\": \"data\"\n  \"channel\": \"/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n  \"data\": {\n      \"capture_id\": \"a2f7374d-6a70-41fd-8a3f-71e42573baaf\",\n      \"pcap_dict\": null\n  }\n}\n```"
      operationId: startOrgPacketCapture
      requestBody:
        content:
          application/json:
            examples:
              MxEdge-Packet-Capture:
                value:
                  duration: 600
                  format: stream
                  max_pkt_len: 1500
                  mxedges:
                    00000000-0000-0000-1000-001122334455:
                      interfaces:
                        port1:
                          tcpdump_expression: udp port 67 or udp port 68
                  num_packets: 100
                  type: mxedge
            schema:
              $ref: '#/components/schemas/capture_org'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/PcapStart'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: startOrgPacketCapture
      tags:
      - Utilities PCAPs
  /api/v1/sites/{site_id}/pcaps:
    parameters:
    - $ref: '#/components/parameters/site_id'
    get:
      description: List packet captures for a site, optionally filtered by client MAC address and time range. Use [List Org Packet Captures](/#operations/listOrgPacketCaptures) to retrieve packet captures across the organization.
      operationId: listSitePacketCaptures
      parameters:
      - description: Optional client mac filter
        in: query
        name: client_mac
        schema:
          type: string
      - $ref: '#/components/parameters/start'
      - $ref: '#/components/parameters/end'
      - $ref: '#/components/parameters/duration'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/page'
      responses:
        '200':
          $ref: '#/components/responses/PcapsSearch'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: listSitePacketCaptures
      tags:
      - Utilities PCAPs
  /api/v1/sites/{site_id}/pcaps/capture:
    parameters:
    - $ref: '#/components/parameters/site_id'
    delete:
      description: Stop current capture
      operationId: stopSitePacketCapture
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: stopSitePacketCapture
      tags:
      - Utilities PCAPs
    get:
      description: Get Capturing status
      operationId: getSiteCapturingStatus
      responses:
        '200':
          $ref: '#/components/responses/PcapStatus'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: getSiteCapturingStatus
      tags:
      - Utilities PCAPs
    post:
      description: "Initiate a Site Packet Capture\n\nThe output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux.\n\n#### Subscribe to Device Command outputs\n`WS /api-ws/v1/stream`\n\n```json\n{\n    \"subscribe\": \"/sites/{site_id}/pcaps\"\n}\n```\n#### Response (MxEdge)\n```json\n{\n    \"event\": \"data\"\n    \"channel\": \"/sites/{site_id}/pcaps\"\n    \"data\": {\n         \"capture_id\": \"6b1be4fb-b239-44d9-9d3b-cb1ff3af1721\",\n     \"lost_messages\": 0\n         \"pcap_dict\": {\n             \"channel_frequency\": 2412,\n             \"channel\": \"1\",\n             \"datarate\": \"1.0 Mbps\",\n             \"rssi\": -75, \n             \"dst\": \"78:bd:bc:ca:0b:0a\",\n             \"src\": \"18:b8:1f:4c:91:c0\",\n             \"bssid\": \"18:b8:1f:4c:91:c0\",\n             \"frame_type\": \"Management\", \n             \"frame_subtype\": \"Probe Response\", \n         \"proto\": \"802.11\", \n             \"ap_mac\": \"d4:20:b0:81:99:2e\", \n             \"direction\": \"tx\", \n             \"timestamp\": 1652246543, \n             \"length\": 416.0,\n             \"interface\": \"radiotap\",\n             \"info\": \"1652246544.467733 1683216786us tsft 1.0 Mb/s 2412 MHz 11g -75dBm signal -82dBm noise antenna 0 Probe Response (ATTKmsWiVS) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] CH: 2, PRIVACY\\\\n\",\n         }, \n        \"pcap_raw\": \"1MOyoQIABAAAAAAAAAAAAP//AAABAAAAEEh7Yh5VBwCgAQAAoAEAAAAAKwBvCADAAQAAAIw7reCS2VNkAAAAABACbAmABLWuAAEAEBgAAwACAABQADoBeL28ygsKGLgfTJHAGLgfTJHAcIZ2WDlBJQAAAGQAERUACkFUVEttc1dpVlMBCIKEi5YkMEhsAwECBwZVUyABCx4gAQAjAhkAKgEEMgQMEhhgMBQBAAAPrAQBAAAPrAQBAAAPrAIMAAsFAQAbAABGBTIIAQAALRqtCR////8AAAAAAAAAAAAAAAAAAAAAAAAAAD0WAggVAAAAAAAAAAAAAAAAAAAAAAAAAH8IBAAIAAAAAEDdkwBQ8gQQSgABEBBEAAECEDsAAQMQRwAQn2481frn3KT+uGod2ERx+RAhAAtBcnJpcywgSW5jLhAjAApCR1cyMTAtNzAwECQACkJHVzIxMC03MDAQQgAKQkdXMjEwLTcwMBBUAAgABgBQ8gQAARARAA5BcnJpcyBXaXJlbGVzcxAIAAIgCBA8AAEBEEkABgA3KgABIN0JABAYAgEQHAAA3RgAUPICAQGEAAOkAAAnpAAAQkNeAGIyLwAzjakr\"\n}\n```\n\n#### Response (Wired)\n```json\n{\n    \"event\": \"data\"\n    \"channel\": \"/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n    \"data\": {\n        \"capture_id\": \"f039b1b4-a23e-48b2-906a-0da40524de73\", \n        \"pcap_dict\": {\n             \"dst_mac\": \"68:ec:c5:09:2e:87\",\n             \"src_mac\": \"8c:3b:ad:e0:47:40\", \n             \"vlan\": 1, \n             \"src_ip\": \"34.224.147.117\", \n             \"dst_ip\": \"192.168.1.55\",\n             \"dst_port\": 51635, \n             \"src_port\": 443,\n             \"proto\": \"TCP\", \n             \"ap_mac\": \"d4:20:b0:81:99:2e\",\n             \"direction\": \"tx\", \n             \"timestamp\": 1652247615, \n             \"length\": 159.0, \n             \"interface\": \"wired\",\n             \"info\": \"1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\\\n\",\n             }, \n        \"pcap_raw\": \"1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==\"\n\n    }\n}\n```\n\n#### Stop Response (Wired/Wireless)\n```json\n{\n    \"event\": \"data\"\n    \"channel\": \"/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n    \"data\": {\n      \"capture_id\": \"a2f7374d-6a70-41fd-8a3f-71e42573baaf\", \n      \"lost_messages\": 0,\n      \"pcap_dict\": null\n    }\n}\n```"
      operationId: startSitePacketCapture
      requestBody:
        content:
          application/json:
            examples:
              AP-New-Wireless-Client-Associations-Packet-Capture:
                value:
                  client_mac: 60a10a773412
                  duration: 600
                  includes_mcast: false
                  max_pkt_len: 128
                  num_packets: 100
                  type: new_assoc
              AP-Radiotap-Packet-Capture:
                value:
                  duration: 600
                  max_pkt_len: 68
                  num_packets: 100
                  type: radiotap
              AP-Radiotap-Packet-Capture-and-Wired-Packet-Capture:
                value:
                  ap_mac: string
                  client_mac: 38f9d3972ff1
                  duration: 600
                  max_pkt_len: 128
                  num_packets: 1024
                  ssid: string
                  type: radiotap,wired
              AP-Scan-radio-Packet-Capture:
                value:
                  ap_mac: null
                  band: '24'
                  bandwidth: 20
                  channel: 1
                  client_mac: 38f9d3972ff1
                  duration: 600
                  format: stream
                  max_pkt_len: 68
                  num_packets: 100
                  tcpdump_expression: tcp port 80
                  type: scan
              AP-Wired-Packet-Capture:
                value:
                  duration: 600
                  max_pkt_len: 68
                  num_packets: 100
                  tcpdump_expression: tcp port 80
                  type: wired
              AP-Wireless-Packet-Capture:
                value:
                  ap_mac: null
                  band: '24'
                  duration: 600
                  max_pkt_len: 128
                  num_packets: 100
                  type: wireless
              Client-Packet-Capture:
                value:
                  client_mac: 60a10a773412
                  duration: 300
                  includes_mcast: false
                  max_pkt_len: 128
                  num_packets: 1000
                  type: client
              SSR-Packet-Capture:
                value:
                  duration: 600
                  format: stream
                  gateways:
                    '001122334455':
                      ports:
                        ge-0/0/0:
                          tcpdump_expression: tcp
                        ge-0/0/1:
                          tcpdump_expression: port 443
                        ge-1/0/0:
                          tcpdump_expression: tcp
                        ge-1/0/1:
                          tcpdump_expression: port 443
                    '001122334466':
                      ports:
                        ge-0/0/0:
                          tcpdump_expression: udp
                        ge-0/0/1:
                          tcpdump_expression: port 32768
                  max_pkt_len: 1500
                  num_packets: 100
                  type: gateway
              Switch-Packet-Capture:
                value:
                  duration: 600
                  format: stream
                  max_pkt_len: 1500
                  num_packets: 100
                  switches:
                    '001122334455':
                      ports:
                        ge-0/0/0:
                          tcpdump_expression: udp
                        ge-0/0/1: {}
                        ge-1/0/0: {}
                        ge-1/0/1: {}
                    '001122334466':
                      ports:
                        ge-0/0/0: {}
                        ge-0/0/1: {}
                  tcpdump_expression: port 443
                  type: switch
            schema:
              $ref: '#/components/schemas/capture_site'
        description: Request Body
      responses:
        '200':
          $ref: '#/components/responses/PcapStart'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: startSitePacketCapture
      tags:
      - Utilities PCAPs
  /api/v1/sites/{site_id}/pcaps/{pcap_id}:
    parameters:
    - $ref: '#/components/parameters/site_id'
    - $ref: '#/components/parameters/pcap_id'
    put:
      description: Update or add notes to a completed packet capture
      operationId: updateSitePacketCapture
      requestBody:
        content:
          application/json:
            examples:
              Example:
                value:
                  notes: wired pcap test
            schema:
              $ref: '#/components/schemas/notes_string'
      responses:
        '200':
          $ref: '#/components/responses/OK'
        '400':
          $ref: '#/components/responses/HTTP400'
        '401':
          $ref: '#/components/responses/HTTP401'
        '403':
          $ref: '#/components/responses/HTTP403'
        '404':
          $ref: '#/components/responses/HTTP404'
        '429':
          $ref: '#/components/responses/HTTP429'
      summary: updateSitePacketCapture
      tags:
      - Utilities PCAPs
components:
  schemas:
    response_pcap_search:
      additionalProperties: false
      description: Paginated response for packet capture search results
      properties:
        end:
          description: Epoch timestamp, in seconds, for the end of the packet capture search window
          type: integer
        limit:
          description: Maximum number of packet capture records returned in this page
          type: integer
        next:
          description: URL for retrieving the next page of packet capture search results
          type: string
        results:
          $ref: '#/components/schemas/response_pcap_search_results'
          description: Packet capture records matching the search filters
        start:
          description: Epoch timestamp, in seconds, for the start of the packet capture search window
          type: integer
        total:
          description: Number of packet capture records matching the search filters across all pages
          type: integer
      required:
      - end
      - limit
      - results
      - start
      type: object
    capture_wired_format:
      default: pcap
      description: 'pcap format. enum: `pcap`, `stream`'
      enum:
      - pcap
      - stream
      type: string
    capture_gateway:
      additionalProperties: false
      description: Initiate a Gateway (SSR/SRX) Packet Capture
      properties:
        duration:
          $ref: '#/components/schemas/capture_duration'
          description: Packet capture duration, in seconds
        format:
          $ref: '#/components/schemas/capture_gateway_format'
          description: Output format for the gateway packet capture
        gateways:
          additionalProperties:
            $ref: '#/components/schemas/capture_gateway_gateways'
          description: List of SSRs. Property key is the SSR MAC
          type: object
        max_pkt_len:
          default: 512
          description: minimum is 64 (SSR) / 68 (SRX) maximum is 10240 (SSR) / 1520 (SRX)
          examples:
          - 128
          maximum: 1520
          minimum: 64
          type:
          - integer
          - 'null'
        num_packets:
          $ref: '#/components/schemas/capture_num_packets'
          description: Maximum number of packets to capture; use 0 for unlimited
        ports:
          $ref: '#/components/schemas/capture_gateway_gateways_ports'
          description: Gateway ports to include in the packet capture
        type:
          $ref: '#/components/schemas/capture_gateway_type'
          description: Packet capture type discriminator for gateway captures
      required:
      - type
      - gateways
      type: object
    org_id:
      description: Unique identifier of a Mist organization
      examples:
      - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61
      format: uuid
      readOnly: true
      type: string
    capture_radiotap_band:
      default: '24'
      description: 'enum: `24`, `24,5,6`, `5`, `6`'
      enum:
      - '24'
      - 24,5,6
      - '5'
      - '6'
      examples:
      - '24'
      type: string
    strings:
      description: Unique string values returned or accepted by this schema
      items:
        type: string
      type: array
      uniqueItems: true
    capture_radiotapwired_band:
      default: '24'
      description: 'only used for radiotap. enum: `24`, `24,5,6`, `5`, `6`'
      enum:
      - '24'
      - 24,5,6
      - '5'
      - '6'
      examples:
      - '24'
      type: string
    capture_switch_ports:
      additionalProperties:
        $ref: '#/components/schemas/capture_switch_ports_tcpdump_expression'
      description: Property key is the port name. 6 ports max per switch supported, or 5 max with irb port auto-included into capture request
      type: object
    response_pcap_start:
      additionalProperties: false
      description: Packet capture session created by a start request
      properties:
        ap_count:
          description: Number of APs targeted by the packet capture
          type: integer
        aps:
          $ref: '#/components/schemas/strings'
          description: AP MAC addresses targeted by the packet capture
        client_mac:
          description: Client MAC address filter applied to the packet capture, or null when no client filter is used
          type:
          - string
          - 'null'
        duration:
          description: Packet capture duration in seconds
          type: number
        enabled:
          description: Whether the packet capture session is enabled after the start request
          type: boolean
        expiry:
          description: Epoch timestamp, in seconds, when the capture session expires
          type: number
        format:
          description: Output format for packet capture data
          type: string
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier for the packet capture session
        include_mcast:
          description: Whether multicast traffic is included in the packet capture
          type: boolean
        max_pkt_len:
          description: Maximum number of bytes captured from each packet
          type: integer
        num_packets:
          description: Maximum number of packets to capture; use 0 for unlimited
          type: integer
        org_id:
          $ref: '#/components/schemas/org_id'
          description: Organization associated with the packet capture session
        raw:
          description: Whether raw packet data is included in the capture output
          type: boolean
        site_id:
          description: Site associated with the packet capture session, when site-scoped
          type:
          - string
          - 'null'
        ssid:
          description: Wireless network SSID filter applied to the packet capture, or null when no SSID filter is used
          type:
          - string
          - 'null'
        tcpdump_parser_expression:
          description: Tcpdump parser expression applied to the packet capture, or null when no parser expression is used
          type:
          - string
          - 'null'
        timestamp:
          $ref: '#/components/schemas/timestamp'
          description: Epoch timestamp, in seconds, when the packet capture session was created
        type:
          description: Packet capture type requested by the start operation
          type: string
      required:
      - timestamp
      - id
      - org_id
      - site_id
      - type
      type: object
    capture_mxedge_format:
      default: stream
      description: "PCAP format. enum: \n    * `stream`: to Mist cloud\n    * `tzsp`: stream packets (over UDP as TZSP packets) to a remote host (typically running Wireshark)"
      enum:
      - stream
      - tzsp
      type: string
    notes_string:
      description: Request body containing notes text
      properties:
        notes:
          description: Text to attach to the target resource as notes
          examples:
          - wired pcap test
          type: string
      type: object
    capture_tcpdump_expression:
      description: tcpdump filter expression applied to packet capture traffic
      examples:
      - tcp port 80
      type:
      - string
      - 'null'
    capture_scan_format:
      default: pcap
      description: 'Output format for the scan radio packet capture. enum: `pcap`, `stream`'
      enum:
      - pcap
      - stream
      examples:
      - stream
      type: string
    capture_mxedge_mxedges_interfaces:
      additionalProperties: false
      description: Property key is the Port name (e.g. "port1", "kni0", "lacp0", "ipsec", "drop", "oobm"), currently limited to specifying one interface per mxedge
      properties:
        tcpdump_expression:
          description: tcpdump expression common for wired,radiotap
          type: string
      type: object
    capture_switch_format:
      default: stream
      description: 'Output format for the switch packet capture. enum: `stream`'
      enum:
      - stream
      type: string
    capture_gateway_gateways_ports:
      additionalProperties:
        $ref: '#/components/schemas/capture_gateway_gateways_port'
      description: Property key is the port ID
      type: object
    response_http403:
      additionalProperties: false
      description: Standard HTTP 403 permission error response
      properties:
        detail:
          description: Human-readable explanation of the permission error
          examples:
          - You do not have permission to perform this action.
          type: string
      type: object
    capture_new_assoc_type:
      description: 'Packet capture type discriminator for new association captures. enum: `new_assoc`'
      enum:
      - new_assoc
      examples:
      - new_assoc
      type: string
    response_pcap_search_item:
      additionalProperties: false
      description: Packet capture record returned by organization or site packet capture search
      properties:
        ap_macs:
          $ref: '#/components/schemas/strings'
          description: AP MAC addresses associated with the packet capture
        aps:
          $ref: '#/components/schemas/response_pcap_search_item_aps'
          description: AP MAC addresses included in the packet capture
        duration:
          description: Packet capture duration in seconds
          examples:
          - 600
          type: number
        format:
          description: Output format requested for the packet capture
          examples:
          - stream
          type: string
        id:
          $ref: '#/components/schemas/id'
          description: Unique identifier for the packet capture
        last_seen:
          description: Last seen timestamp of the capture
          examples:
          - 1693482149.417
          type: number
        max_num_packets:
          description: Maximum number of packets requested for the capture
          examples:
          - 1024
          type: number
        mxedges:
          description: List of Mist Edge IDs included in the capture
          items:
            type: string
          type: array
        org_id:
          $ref: '#/components/schemas/org_id'
          description: Organization associated with the packet capture
        pcap_aps:
          $ref: '#/components/schemas/response_pcap_search_item_pcap_aps'
          description: Per-AP radio capture settings keyed by AP MAC address
        pcap_url:
          description: URL for downloading the generated PCAP file
          type: string
        site_id:
          description: Site associated with the packet capture, when the capture is site-scoped
          type:
          - string
          - 'null'
        termination_reason:
          description: Reason the packet capture session ended
          examples:
          - default
          type: string
        timestamp:
          $ref: '#/components/schemas/timestamp'
          description: Epoch timestamp, in seconds, when the packet capture record was created
        type:
          description: Packet capture type represented by this record
          type: string
        url:
          description: Link for accessing the packet capture output or stream
          type: string
      required:
      - timestamp
      - type
      - url
      type: object
    response_pcap_status_aps:
      description: List of target APs to capture packets
      items:
        type: string
      type: array
    capture_switch_switches:
      additionalProperties: false
      description: Switch-specific packet capture settings keyed under a switch MAC address
      properties:
        ports:
          $ref: '#/components/schemas/capture_switch_ports'
          description: Switch ports to include in the capture, keyed by port ID
      type: object
    capture_mxedge_type:
      description: 'Packet capture type discriminator for Mist Edge captures. enum: `mxedge`'
      enum:
      - mxedge
      examples:
      - mxedge
      type: string
    pcap_type:
      description: 'enum: `client`, `gateway`, `new_assoc`, `radiotap`, `radiotap,wired`, `wired`, `wireless`'
      enum:
      - client
      - gateway
      - new_assoc
      - radiotap
      - radiotap,wired
      - wired
      - wireless
      examples:
      - client
      type: string
    capture_wireless:
      additionalProperties: false
      description: Initiate a Wireless Packet Capture
      properties:
        ap_mac:
          description: AP MAC address used to target the wireless packet capture
          e

# --- truncated at 32 KB (75 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-utilities-pcaps-api-openapi.yml