searchSiteNacClientEvents
Search NAC client events for a site with filters for authentication, NAC rule, identity provider, RADIUS, network, endpoint, and time attributes. Use Search Org NAC Client Events to search NAC client events across the organization.
Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.
Format:
Authorization: Token {apitoken}
Notes:
- An API token generated for a specific admin has the same privileges as that admin
- An API token is automatically removed if it is not used for more than 90 days
- SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.
In: header
Path Parameters
uuidQuery Parameters
NAC Policy Rule ID, if matched
uuidNAC Policy Rule Matched
NAC Policy Dry Run Rule ID, if present and matched
True - if dryrun rule present and matched with priority, False - if not matched or not present
Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"
Filter results by VLAN ID
Vendor of NAS device
Filter results by BSSID
SSO ID, if present and used
uuidIDP returned roles/groups for the user
Username presented to the Identity Provider
RADIUS attributes returned by NAC to NAS Devive
Filter results by SSID
Filter results by username
Filter results by AP MAC address
Filter results by whether the client is using a randomized MAC address
Filter results by MAC address
Labels derived from usermac entry
Partial / full MAC address, username, device_mac or ap. Use prefix* for prefix search or *substring* for contains search (e.g. aabbcc* and *bbcc* match aabbccddeeff). Suffix-only wildcards (e.g. *bccddeeff) are not supported
IP address of NAS device
Vendor specific VLAN ID in RADIUS requests
Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w
Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now
Time range duration for the query, using relative units such as 10m, 7d, or 2w
"1d"Maximum number of results to return per page
0 <= value100On which field the list should be sorted, -prefix represents DESC order.
"wxid"Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.
Response Body
curl -X GET "https://example.com/api/v1/sites/000000ab-00ab-00ab-00ab-0000000000ab/nac_clients/events/search"{ "end": 1513176951, "limit": 10, "results": [ { "ap": "5c5b35513227", "auth_type": "eap-ttls", "bssid": "5c5b355fafcc", "dryrun_nacrule_id": "32f27e7d-ff26-4a9b-b3d1-ff9bcb264012", "dryrun_nacrule_matched": true, "idp_id": "912ef72e-2239-4996-b81e-469e87a27cd6", "idp_role": [ "itsuperusers", "vip" ], "mac": "ac3eb179e535", "nacrule_id": "32f27e7d-ff26-4a9b-b3d1-ff9bcb264c62", "nacrule_matched": true, "nas_vendor": "juniper-mist", "org_id": "27547ac2-d114-4e04-beb1-f3f1e6e81ec6", "random_mac": "false", "resp_attrs": [ "Tunnel-Type=VLAN", "Tunnel-Medium-Type=IEEE-802", "Tunnel-Private-Group-Id=750", "User-Name=anonymous" ], "site_id": "441a1214-6928-442a-8e92-e1d34b8ec6a6", "ssid": "mist_nac", "timestamp": 1691512031.358188, "type": "NAC_CLIENT_PERMIT", "username": "user@deaflyz.net", "vlan": "750" } ], "start": 1512572151, "total": 1}countSiteNacClients GET
Count NAC clients for a site, optionally grouped by the `distinct` field and filtered by authentication, identity, endpoint, network, and time attributes. Use [Count Org NAC Clients](/api/mist/orgs/orgs-clients/orgs-clients---nac/countOrgNacClients) to count NAC clients across the organization.
searchSiteNacClients GET
Search NAC clients for a site with filters for authentication, endpoint posture, identity, network, NAC rule, and time attributes. Use [Search Org NAC Clients](/api/mist/orgs/orgs-clients/orgs-clients---nac/searchOrgNacClients) to search NAC clients across the organization.