searchSiteNacClients

MAC address of the AP the client is/was connected to

Authentication type, e.g. "eap-tls", "eap-peap", "eap-ttls", "eap-teap", "mab", "psk", "device-auth"

Filter by certificate expiry within a specific duration from now (e.g., "7d" for 7 days, "1m" for 1 month)

Filters NAC clients that are integrated with EDR providers

EDR provider used to filter NAC clients. enum: crowdstrike, sentinelone

EDR status used to filter NAC clients. enum: sentinelone_healthy, sentinelone_infected, crowdstrike_low, crowdstrike_medium, crowdstrike_high, crowdstrike_critical, crowdstrike_informational

Partial / full Client family (e.g. "Phone/Tablet/Wearable", "Access Point"). Use prefix* for prefix search or *substring* for contains search (e.g. Surveillance* and *urveillance* match Surveillance Camera). Suffix-only wildcards (e.g. *Camera) are not supported

Partial / full Client hostname. Use prefix* for prefix search or *substring* for contains search (e.g. everest* and *rest* match my-everest-client). Suffix-only wildcards (e.g. *everest) are not supported

SSO ID, if present and used

Partial / full Client MAC address. Use prefix* for prefix search or *substring* for contains search (e.g. aabbcc* and *bbcc* match aabbccddeeff). Suffix-only wildcards (e.g. *bccddeeff) are not supported

MDM compliance of client i.e "compliant", "not compliant"

MDM provider of client’s organization eg "intune", "jamf"

Filters NAC clients that are managed by MDM providers

Partial / full Client manufacturer (e.g. "apple", "cisco", "juniper"). Use prefix* for prefix search or *substring* for contains search (e.g. Raspberry Pi* and *Pi* match Raspberry Pi Trading Ltd). Suffix-only wildcards (e.g. *Ltd) are not supported

Client model, e.g. "iPhone 12", "MX100"

NAC Policy Rule Name matched

NAC Policy Rule ID, if matched

NAC Policy Rule Matched

Vendor of NAS device

IP address of NAS device

Vendor specific VLAN ID in RADIUS requests

Client OS, e.g. "iOS 18.1", "Android", "Windows", "Linux"

Filter results by SSID

Client connection status used to filter results. enum: permitted, session_started, session_stopped, denied

partial / full MAC address, last_username, device_mac, nas_ip. Use prefix* for prefix search or *substring* for contains search (e.g. aabbcc* and *bbcc* match aabbccddeeff). Suffix-only wildcards (e.g. *bccddeeff) are not supported.

Client type i.e. "wireless", "wired" etc.

Labels derived from usermac entry

Filter results by username

Filter results by VLAN ID

Maximum number of results to return per page

Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w

Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now

Time range duration for the query, using relative units such as 10m, 7d, or 2w

On which field the list should be sorted, -prefix represents DESC order.

Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.