Mist API Reference
Mist Automation Guide
HomeSDKsAPI ReferenceContext Plugin
UtilitiesLAN

searchSiteDeviceFlowRecords

GET
/api/v1/sites/{site_id}/devices/{device_id}/flow_records/search

Search network flow records for a specific device within a site. Note: Only supported for switch devices. The device must be manageable. The device_mac is automatically scoped to the device in the URL path and cannot be overridden by query parameter.

Authorization

Authorization<token>

Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.

Format: Authorization: Token {apitoken}

Notes:

  • An API token generated for a specific admin has the same privileges as that admin
  • An API token is automatically removed if it is not used for more than 90 days
  • SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.

In: header

Path Parameters

site_id*string
Formatuuid
device_id*string
Formatuuid

Query Parameters

start?string

Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w

end?string

Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now

limit?integer

Maximum number of results to return per page

Range0 <= value
Default100
sort?string

On which field the list should be sorted, -prefix represents DESC order

Default"timestamp"
src_ip?string

Source IP address

dst_ip?string

Destination IP address

src_port?string

Source port

dst_port?string

Destination port

protocol?string

Protocol (e.g. tcp, udp, icmp)

state?string

Flow state

direction?string

Flow direction

search_after?string

Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.

Response Body

curl -X GET "https://example.com/api/v1/sites/000000ab-00ab-00ab-00ab-0000000000ab/devices/000000ab-00ab-00ab-00ab-0000000000ab/flow_records/search"
{  "end": 1775003600,  "limit": 1000,  "results": [    {      "device_mac": "5c5b350e020a",      "direction": "ingress",      "dst_ip": "8.8.8.8",      "dst_port": 443,      "duration": 60,      "end_time": 1775000060,      "flow_id": 12345,      "org_id": "2818e386-8dec-2562-9ede-5b8a0fbbdc71",      "protocol": "tcp",      "sampling_percentage": 0.1,      "site_id": "4ac1dcf4-9d8b-7211-65c4-057819f0862b",      "src_ip": "10.0.0.1",      "src_port": 54321,      "start_time": 1775000000,      "state": "aged-out",      "timestamp": 1775000060,      "total_bytes": 150000,      "total_pkts": 100    }  ],  "start": 1775000000,  "total": 1}

restoreSiteMultipleDeviceBackupVersion POST

Restore device backup fw version (Available on Junos OS EX4000-, EX4100-, EX4400- devices)

showSiteDeviceArpTable POST

Get ARP Table from the Device. The output will be available through websocket. As there can be multiple commands issued against the same device at the same time and the output all goes through the same websocket stream, `session` is introduced for demux. #### Subscribe to Device Command outputs `WS /api-ws/v1/stream` ```json { "subscribe": "/sites/{site_id}/devices/{device_id}/cmd" } ```