Mist Authentication

generated: '2026-07-20'
method: searched
source: openapi/mist-openapi-original.json
docs: https://www.juniper.net/documentation/us/en/software/mist/automation-integration/topics/task/create-token-for-rest-api.html
notes: >-
  Basic Authentication is deprecated for all Mist API use cases effective
  September 2026; all integrations must use API tokens. Tokens can be scoped to
  an admin or an entire org, and are auto-removed after 90 days of non-use.
summary:
  types:
  - apiKey
  api_key_in:
  - header
schemes:
- name: apiToken
  type: apiKey
  in: header
  parameter: Authorization
  description: |-
    Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.

    **Format**:
      `Authorization: Token {apitoken}`

    **Notes**:
    * An API token generated for a specific admin has the same privileges as that admin
    * An API token is automatically removed if it is not used for more than 90 days
    * SSO admins cannot generate admin API tokens. Use orga
  sources:
  - openapi/mist-openapi-original.json
- name: csrfToken
  type: apiKey
  in: header
  parameter: X-CSRFToken
  description: |-
    Session-based authentication for browser or login/password flows. After a successful [Login](/#operations/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session.

    **Format**:
    ```
    X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx
    ```

    For automation, API Token authentication is preferred.
  sources:
  - openapi/mist-openapi-original.json