Automation, REST API, Webhooks, and Third-Party Integration
Automation, REST API, Webhooks, and Third-Party Integration
This domain tests programmatic control of Mist and event delivery to other systems. Expect API authentication, endpoint scope, webhook topics, delivery troubleshooting, and native integrations.
Core rules
- The Mist REST API base is https://api.mist.com/api/v1. Authenticate with an API token in the Authorization header using the Token scheme, not Bearer. Tokens are created in organization settings and carry privileges; a read-only token cannot create a WLAN.
- Match the endpoint to the scope: org endpoints for inventory, subscriptions, and org webhooks; site endpoints for site WLANs, site devices, and site settings. Using a site ID where an org ID is required returns errors.
- Handle pagination and rate limits in automation. Do not assume a single GET returns every object.
- Webhooks send HTTP POST JSON for subscribed topics such as alarms, device events, client sessions, and audits. Configure them at the appropriate org or site scope, use HTTPS, and check delivery logs when events do not arrive.
- Third-party integrations such as Slack, PagerDuty, ServiceNow, or Splunk consume Mist webhooks or API data; the integration is only as good as the topic and payload mapping.
Worked example
An alarm webhook to a ticketing system stops creating tickets. Reasoning: the webhook exists and the receiver is up, but the topic filter was changed to device events only. Correct the topic to include alarms, re-enable the webhook, and send a test event. If the receiver returns 401, fix receiver authentication rather than recreating the webhook.
Traps
- Using Bearer instead of Token in the Authorization header.
- Calling a site endpoint with an org ID.
- Assuming webhooks are instantaneous or never retry.
- Forgetting that API tokens carry limited privileges.
- Ignoring pagination and rate limits in scripts.