searchOrgNacClients

MAC address of the AP the client is/was connected to

Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth". Accepts multiple comma-separated values.

Filter by certificate expiry within a specific duration from now (e.g., "7d" for 7 days, "1m" for 1 month). Accepts multiple comma-separated values.

Filters NAC clients that are integrated with EDR providers

EDR provider of the client's organization. enum: crowdstrike, sentinelone

EDR status used to filter NAC clients. enum: sentinelone_healthy, sentinelone_infected, crowdstrike_low, crowdstrike_medium, crowdstrike_high, crowdstrike_critical, crowdstrike_informational

Partial / full Client family (e.g. "Phone/Tablet/Wearable", "Access Point"). Use prefix* for prefix search or *substring* for contains search (e.g. Surveillance* and *urveillance* match Surveillance Camera). Suffix-only wildcards (e.g. *Camera) are not supported. Accepts multiple comma-separated values.

Partial / full Client hostname. Use prefix* for prefix search or *substring* for contains search (e.g. everest* and *rest* match my-everest-client). Suffix-only wildcards (e.g. *everest) are not supported. Accepts multiple comma-separated values.

SSO ID, if present and used

Partial / full Client MAC address. Use a single value; comma-separated values are not supported. Use prefix* for prefix search or *substring* for contains search (e.g. aabbcc* and *bbcc* match aabbccddeeff). Suffix-only wildcards (e.g. *bccddeeff) are not supported

MDM compliance of client i.e "compliant", "not compliant"

MDM provider of client’s organization eg "intune", "jamf"

Filters NAC clients that are managed by MDM providers

Partial / full Client manufacturer (e.g. "apple", "cisco", "juniper"). Use prefix* for prefix search or *substring* for contains search (e.g. Raspberry Pi* and *Pi* match Raspberry Pi Trading Ltd). Suffix-only wildcards (e.g. *Ltd) are not supported. Accepts multiple comma-separated values.

Client model, e.g. "iPhone 12", "MX100"

NAC Policy Rule Name matched

NAC Policy Rule ID, if matched

NAC Policy Rule Matched

Vendor of NAS device

IP address of NAS device. Accepts multiple comma-separated values.

Vendor specific VLAN ID in RADIUS requests

Client OS, e.g. "iOS 18.1", "Android", "Windows", "Linux"

Filter results by SSID

Client connection status used to filter results. enum: permitted, session_started, session_stopped, denied

partial / full MAC address, last_username, device_mac, nas_ip or last_ap

Client type i.e. "wireless", "wired" etc. Accepts multiple comma-separated values.

Labels derived from usermac entry

Filter results by username

Filter results by VLAN ID

Filter results by one site identifier. Use a single value; comma-separated values are not supported

Maximum number of results to return per page

Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w

Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now

Time range duration for the query, using relative units such as 10m, 7d, or 2w

On which field the list should be sorted, -prefix represents DESC order.

Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.