searchOrgNacClientEvents
Search NAC client authentication event records across the organization with filters for authentication, NAC rule, identity provider, RADIUS, network, endpoint, site, and time attributes.
Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.
Format:
Authorization: Token {apitoken}
Notes:
- An API token generated for a specific admin has the same privileges as that admin
- An API token is automatically removed if it is not used for more than 90 days
- SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.
In: header
Path Parameters
uuidQuery Parameters
See List Device Events Definitions. Accepts multiple comma-separated values.
NAC Policy Rule ID, if matched. Accepts multiple comma-separated values.
uuidNAC Policy Rule Matched
NAC Policy Dry Run Rule ID, if present and matched
True - if dryrun rule present and matched with priority, False - if not matched or not present
Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth". Accepts multiple comma-separated values.
Filter results by VLAN ID. Accepts multiple comma-separated integer values.
Vendor of NAS device
Filter results by BSSID
SSO ID, if present and used
uuidIDP returned roles/groups for the user
Username presented to the Identity Provider
RADIUS attributes returned by NAC to NAS derive
Filter results by SSID
Filter results by username. Accepts multiple comma-separated values.
Filter results by one site identifier. Use a single value; comma-separated values are not supported
Filter results by AP MAC address
Filter results by whether the client is using a randomized MAC address. Accepts multiple comma-separated boolean values.
Filter results by one MAC address. Use a single value; comma-separated values are not supported
Labels derived from usermac entry
Partial / full MAC address, username, device_mac or ap
IP address of NAS device. Accepts multiple comma-separated values.
Vendor specific VLAN ID in RADIUS requests
Maximum number of results to return per page
0 <= value100Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w
Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now
Time range duration for the query, using relative units such as 10m, 7d, or 2w
"1d"On which field the list should be sorted, -prefix represents DESC order.
"wxid"Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.
Response Body
curl -X GET "https://example.com/api/v1/orgs/000000ab-00ab-00ab-00ab-0000000000ab/nac_clients/events/search"{ "end": 1513176951, "limit": 10, "results": [ { "ap": "5c5b35513227", "auth_type": "eap-ttls", "bssid": "5c5b355fafcc", "dryrun_nacrule_id": "32f27e7d-ff26-4a9b-b3d1-ff9bcb264012", "dryrun_nacrule_matched": true, "idp_id": "912ef72e-2239-4996-b81e-469e87a27cd6", "idp_role": [ "itsuperusers", "vip" ], "mac": "ac3eb179e535", "nacrule_id": "32f27e7d-ff26-4a9b-b3d1-ff9bcb264c62", "nacrule_matched": true, "nas_vendor": "juniper-mist", "org_id": "27547ac2-d114-4e04-beb1-f3f1e6e81ec6", "random_mac": "false", "resp_attrs": [ "Tunnel-Type=VLAN", "Tunnel-Medium-Type=IEEE-802", "Tunnel-Private-Group-Id=750", "User-Name=anonymous" ], "site_id": "441a1214-6928-442a-8e92-e1d34b8ec6a6", "ssid": "mist_nac", "timestamp": 1691512031.358188, "type": "NAC_CLIENT_PERMIT", "username": "user@deaflyz.net", "vlan": "750" } ], "start": 1512572151, "total": 1}countOrgNacClients GET
Count NAC clients across the organization, optionally grouped by `distinct` and filtered by authentication, identity, endpoint, network, site, and time attributes.
searchOrgNacClients GET
Search NAC client records across the organization with filters for authentication, endpoint posture, identity, network, NAC rule, site, and time attributes.