SitesClientsNAC

searchSiteNacClientEvents

GET
/api/v1/sites/{site_id}/nac_clients/events/search

Search NAC client events for a site with filters for authentication, NAC rule, identity provider, RADIUS, network, endpoint, and time attributes. Use Search Org NAC Client Events to search NAC client events across the organization.

Authorization

Authorization<token>

Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.

Format: Authorization: Token {apitoken}

Notes:

  • An API token generated for a specific admin has the same privileges as that admin
  • An API token is automatically removed if it is not used for more than 90 days
  • SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.

In: header

Path Parameters

site_id*string
Formatuuid

Query Parameters

type?string
nacrule_id?string

NAC Policy Rule ID, if matched

Formatuuid
nacrule_matched?boolean

NAC Policy Rule Matched

dryrun_nacrule_id?string

NAC Policy Dry Run Rule ID, if present and matched

dryrun_nacrule_matched?boolean

True - if dryrun rule present and matched with priority, False - if not matched or not present

auth_type?string

Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"

vlan?integer

Filter results by VLAN ID

nas_vendor?string

Vendor of NAS device

bssid?string

Filter results by BSSID

idp_id?string

SSO ID, if present and used

Formatuuid
idp_role?string

IDP returned roles/groups for the user

idp_username?string

Username presented to the Identity Provider

resp_attrs?array<string>

RADIUS attributes returned by NAC to NAS Devive

ssid?string

Filter results by SSID

username?string

Filter results by username

ap?string

Filter results by AP MAC address

random_mac?boolean

Filter results by whether the client is using a randomized MAC address

mac?string

Filter results by MAC address

usermac_label?string

Labels derived from usermac entry

text?string

Partial / full MAC address, username, device_mac or ap. Use prefix* for prefix search or *substring* for contains search (e.g. aabbcc* and *bbcc* match aabbccddeeff). Suffix-only wildcards (e.g. *bccddeeff) are not supported

nas_ip?string

IP address of NAS device

ingress_vlan?string

Vendor specific VLAN ID in RADIUS requests

start?string

Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w

end?string

Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now

duration?string

Time range duration for the query, using relative units such as 10m, 7d, or 2w

Default"1d"
limit?integer

Maximum number of results to return per page

Range0 <= value
Default100
sort?string

On which field the list should be sorted, -prefix represents DESC order.

Default"wxid"
search_after?string

Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.

Response Body

curl -X GET "https://example.com/api/v1/sites/000000ab-00ab-00ab-00ab-0000000000ab/nac_clients/events/search"
{  "end": 1513176951,  "limit": 10,  "results": [    {      "ap": "5c5b35513227",      "auth_type": "eap-ttls",      "bssid": "5c5b355fafcc",      "dryrun_nacrule_id": "32f27e7d-ff26-4a9b-b3d1-ff9bcb264012",      "dryrun_nacrule_matched": true,      "idp_id": "912ef72e-2239-4996-b81e-469e87a27cd6",      "idp_role": [        "itsuperusers",        "vip"      ],      "mac": "ac3eb179e535",      "nacrule_id": "32f27e7d-ff26-4a9b-b3d1-ff9bcb264c62",      "nacrule_matched": true,      "nas_vendor": "juniper-mist",      "org_id": "27547ac2-d114-4e04-beb1-f3f1e6e81ec6",      "random_mac": "false",      "resp_attrs": [        "Tunnel-Type=VLAN",        "Tunnel-Medium-Type=IEEE-802",        "Tunnel-Private-Group-Id=750",        "User-Name=anonymous"      ],      "site_id": "441a1214-6928-442a-8e92-e1d34b8ec6a6",      "ssid": "mist_nac",      "timestamp": 1691512031.358188,      "type": "NAC_CLIENT_PERMIT",      "username": "user@deaflyz.net",      "vlan": "750"    }  ],  "start": 1512572151,  "total": 1}