When interacting with the Mist API, it is important to include specific HTTP headers in your requests. These headers ensure proper communication, authentication, and data formatting between your client and the Mist Cloud platform.

Below is a summary of the required and recommended headers, along with explanations for each:

Required HeadersCopy Anchor Link

• Content-Type: application/json (or multipart/form-data for file uploads)

  • Indicates the format of the data in the body of your request.
  • Use application/json for requests with a JSON payload (such as POST, PUT, or PATCH).
  • Use multipart/form-data when uploading files to the API.

• Accept: application/json, application/vnd.api+json

  • Specifies the response format(s) your client can handle.
  • application/json is sufficient for most use cases.
  • It is recommended to also include application/vnd.api+json to enable Mist Cloud to compress large responses, which is especially useful for organizations with many resources.

Conditional HeaderCopy Anchor Link

• Authorization: Token {APITOKEN}

  • Used to authenticate your requests with the Mist API.
  • Replace {APITOKEN} with your actual API token.
  • This header is required for all requests when using API token authentication.
  • Example: Authorization: Token 1234567890abcdef

• X-CSRFToken: {csrftoken_value_from_cookie}

  • Required only if you are authenticating using a username and password (login/password).
  • The value should be taken from the csrftoken cookie provided by the Mist Cloud after login.
  • This header helps protect against Cross-Site Request Forgery (CSRF) attacks.

Example RequestCopy Anchor Link

GET /api/v1/sites HTTP/1.1
Host: api.mist.com
Content-Type: application/json
Accept: application/json, application/vnd.api+json
Authorization: Token {your_api_token}
X-CSRFToken: {csrftoken_value_from_cookie}  # Only if using login/password

NotesCopy Anchor Link

• The Authorization or X-CSRFToken headers are mandatory when using an API token for authentication. Without it, your requests will be rejected.
• If you are using an API token for authentication, the X-CSRFToken header is not required.
• Always ensure your Content-Type and Accept headers are set correctly to avoid errors or unexpected responses.
• Including application/vnd.api+json in the Accept header is recommended for better performance with large datasets.