Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Juniper Mist Provider
  4. API Docs
  5. org
  6. getNactags
Viewing docs for Juniper Mist v0.11.2
published on Saturday, Jul 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-junipermist

junipermist.org.getNactags

junipermist logo
Viewing docs for Juniper Mist v0.11.2
published on Saturday, Jul 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-junipermist

    This data source provides the list of NAC Tags (Auth Policy Labels).

    The NAC Tags can be used in the NAC Rules to define the matching criteria or the returned RADIUS Attributes

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as junipermist from "@pulumi/juniper-mist";

const nactags = junipermist.org.getNactags({
    orgId: "15fca2ac-b1a6-47cc-9953-cc6906281550",
    type: "match",
    match: "cert_issuer",
});

    import pulumi
import pulumi_junipermist as junipermist

nactags = junipermist.org.get_nactags(org_id="15fca2ac-b1a6-47cc-9953-cc6906281550",
    type="match",
    match="cert_issuer")

    package main

import (
	"github.com/pulumi/pulumi-junipermist/sdk/go/junipermist/org"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := org.GetNactags(ctx, &org.GetNactagsArgs{
			OrgId: "15fca2ac-b1a6-47cc-9953-cc6906281550",
			Type:  pulumi.StringRef("match"),
			Match: pulumi.StringRef("cert_issuer"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using JuniperMist = Pulumi.JuniperMist;

return await Deployment.RunAsync(() => 
{
    var nactags = JuniperMist.Org.GetNactags.Invoke(new()
    {
        OrgId = "15fca2ac-b1a6-47cc-9953-cc6906281550",
        Type = "match",
        Match = "cert_issuer",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.junipermist.org.OrgFunctions;
import com.pulumi.junipermist.org.inputs.GetNactagsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var nactags = OrgFunctions.getNactags(GetNactagsArgs.builder()
            .orgId("15fca2ac-b1a6-47cc-9953-cc6906281550")
            .type("match")
            .match("cert_issuer")
            .build());

    }
}

    variables:
  nactags:
    fn::invoke:
      function: junipermist:org:getNactags
      arguments:
        orgId: 15fca2ac-b1a6-47cc-9953-cc6906281550
        type: match
        match: cert_issuer

    pulumi {
  required_providers {
    junipermist = {
      source = "pulumi/junipermist"
    }
  }
}

data "junipermist_org_getnactags" "nactags" {
  org_id = "15fca2ac-b1a6-47cc-9953-cc6906281550"
  type   = "match"
  match  = "cert_issuer"
}

    Using getNactags

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getNactags(args: GetNactagsArgs, opts?: InvokeOptions): Promise<GetNactagsResult>
function getNactagsOutput(args: GetNactagsOutputArgs, opts?: InvokeOptions): Output<GetNactagsResult>
    def get_nactags(match: Optional[str] = None,
                name: Optional[str] = None,
                org_id: Optional[str] = None,
                type: Optional[str] = None,
                opts: Optional[InvokeOptions] = None) -> GetNactagsResult
def get_nactags_output(match: pulumi.Input[Optional[str]] = None,
                name: pulumi.Input[Optional[str]] = None,
                org_id: pulumi.Input[Optional[str]] = None,
                type: pulumi.Input[Optional[str]] = None,
                opts: Optional[InvokeOptions] = None) -> Output[GetNactagsResult]
    func GetNactags(ctx *Context, args *GetNactagsArgs, opts ...InvokeOption) (*GetNactagsResult, error)
func GetNactagsOutput(ctx *Context, args *GetNactagsOutputArgs, opts ...InvokeOption) GetNactagsResultOutput

    > Note: This function is named GetNactags in the Go SDK.

    public static class GetNactags 
{
    public static Task<GetNactagsResult> InvokeAsync(GetNactagsArgs args, InvokeOptions? opts = null)
    public static Output<GetNactagsResult> Invoke(GetNactagsInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetNactagsResult> getNactags(GetNactagsArgs args, InvokeOptions options)
public static Output<GetNactagsResult> getNactags(GetNactagsArgs args, InvokeOptions options)

    fn::invoke:
  function: junipermist:org/getNactags:getNactags
  arguments:
    # arguments dictionary
    data "junipermist_org_getnactags" "name" {
    # arguments
}

    The following arguments are supported:

    OrgId string
    Match string
    Name string
    Type string
    OrgId string
    Match string
    Name string
    Type string
    org_id string
    match string
    name string
    type string
    orgId String
    match String
    name String
    type String
    orgId string
    match string
    name string
    type string
    org_id str
    match str
    name str
    type str
    orgId String
    match String
    name String
    type String

    getNactags Result

    The following output properties are available:

    Id string
    The provider-assigned unique ID for this managed resource.
    OrgId string
    OrgNactags List<Pulumi.JuniperMist.Org.Outputs.GetNactagsOrgNactag>
    Match string
    Name string
    Type string
    Id string
    The provider-assigned unique ID for this managed resource.
    OrgId string
    OrgNactags []GetNactagsOrgNactag
    Match string
    Name string
    Type string
    id string
    The provider-assigned unique ID for this managed resource.
    org_id string
    org_nactags list(object)
    match string
    name string
    type string
    id String
    The provider-assigned unique ID for this managed resource.
    orgId String
    orgNactags List<GetNactagsOrgNactag>
    match String
    name String
    type String
    id string
    The provider-assigned unique ID for this managed resource.
    orgId string
    orgNactags GetNactagsOrgNactag[]
    match string
    name string
    type string
    id str
    The provider-assigned unique ID for this managed resource.
    org_id str
    org_nactags Sequence[GetNactagsOrgNactag]
    match str
    name str
    type str
    id String
    The provider-assigned unique ID for this managed resource.
    orgId String
    orgNactags List<Property Map>
    match String
    name String
    type String

    Supporting Types

    GetNactagsOrgNactag

    AllowUsermacOverride bool
    Can be set to true to allow the override by usermac result
    CreatedTime double
    When the object has been created, in epoch
    EgressVlanNames List<string>
    If type==egressVlanNames, list of egress vlans to return
    GbpTag string
    Id string
    Unique ID of the object instance in the Mist Organization
    Match string
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    MatchAll bool

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    ModifiedTime double
    When the object has been modified for the last time, in epoch
    NacportalId string
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    Name string
    OrgId string
    RadiusAttrs List<string>
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    RadiusGroup string
    If type==radiusGroup
    RadiusVendorAttrs List<string>
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    SessionTimeout int
    If type==`session_timeout, in seconds
    Type string
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    UsernameAttr string
    enum: automatic, cn, dns, email, upn
    Values List<string>
    If type==match
    Vlan string
    If type==vlan
    AllowUsermacOverride bool
    Can be set to true to allow the override by usermac result
    CreatedTime float64
    When the object has been created, in epoch
    EgressVlanNames []string
    If type==egressVlanNames, list of egress vlans to return
    GbpTag string
    Id string
    Unique ID of the object instance in the Mist Organization
    Match string
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    MatchAll bool

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    ModifiedTime float64
    When the object has been modified for the last time, in epoch
    NacportalId string
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    Name string
    OrgId string
    RadiusAttrs []string
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    RadiusGroup string
    If type==radiusGroup
    RadiusVendorAttrs []string
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    SessionTimeout int
    If type==`session_timeout, in seconds
    Type string
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    UsernameAttr string
    enum: automatic, cn, dns, email, upn
    Values []string
    If type==match
    Vlan string
    If type==vlan
    allow_usermac_override bool
    Can be set to true to allow the override by usermac result
    created_time number
    When the object has been created, in epoch
    egress_vlan_names list(string)
    If type==egressVlanNames, list of egress vlans to return
    gbp_tag string
    id string
    Unique ID of the object instance in the Mist Organization
    match string
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    match_all bool

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    modified_time number
    When the object has been modified for the last time, in epoch
    nacportal_id string
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    name string
    org_id string
    radius_attrs list(string)
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    radius_group string
    If type==radiusGroup
    radius_vendor_attrs list(string)
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    session_timeout number
    If type==`session_timeout, in seconds
    type string
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    username_attr string
    enum: automatic, cn, dns, email, upn
    values list(string)
    If type==match
    vlan string
    If type==vlan
    allowUsermacOverride Boolean
    Can be set to true to allow the override by usermac result
    createdTime Double
    When the object has been created, in epoch
    egressVlanNames List<String>
    If type==egressVlanNames, list of egress vlans to return
    gbpTag String
    id String
    Unique ID of the object instance in the Mist Organization
    match String
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    matchAll Boolean

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    modifiedTime Double
    When the object has been modified for the last time, in epoch
    nacportalId String
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    name String
    orgId String
    radiusAttrs List<String>
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    radiusGroup String
    If type==radiusGroup
    radiusVendorAttrs List<String>
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    sessionTimeout Integer
    If type==`session_timeout, in seconds
    type String
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    usernameAttr String
    enum: automatic, cn, dns, email, upn
    values List<String>
    If type==match
    vlan String
    If type==vlan
    allowUsermacOverride boolean
    Can be set to true to allow the override by usermac result
    createdTime number
    When the object has been created, in epoch
    egressVlanNames string[]
    If type==egressVlanNames, list of egress vlans to return
    gbpTag string
    id string
    Unique ID of the object instance in the Mist Organization
    match string
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    matchAll boolean

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    modifiedTime number
    When the object has been modified for the last time, in epoch
    nacportalId string
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    name string
    orgId string
    radiusAttrs string[]
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    radiusGroup string
    If type==radiusGroup
    radiusVendorAttrs string[]
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    sessionTimeout number
    If type==`session_timeout, in seconds
    type string
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    usernameAttr string
    enum: automatic, cn, dns, email, upn
    values string[]
    If type==match
    vlan string
    If type==vlan
    allow_usermac_override bool
    Can be set to true to allow the override by usermac result
    created_time float
    When the object has been created, in epoch
    egress_vlan_names Sequence[str]
    If type==egressVlanNames, list of egress vlans to return
    gbp_tag str
    id str
    Unique ID of the object instance in the Mist Organization
    match str
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    match_all bool

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    modified_time float
    When the object has been modified for the last time, in epoch
    nacportal_id str
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    name str
    org_id str
    radius_attrs Sequence[str]
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    radius_group str
    If type==radiusGroup
    radius_vendor_attrs Sequence[str]
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    session_timeout int
    If type==`session_timeout, in seconds
    type str
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    username_attr str
    enum: automatic, cn, dns, email, upn
    values Sequence[str]
    If type==match
    vlan str
    If type==vlan
    allowUsermacOverride Boolean
    Can be set to true to allow the override by usermac result
    createdTime Number
    When the object has been created, in epoch
    egressVlanNames List<String>
    If type==egressVlanNames, list of egress vlans to return
    gbpTag String
    id String
    Unique ID of the object instance in the Mist Organization
    match String
    if type==match. enum: certCn, certEku, certIssuer, certSan, certSerial, certSub, certTemplate, clientMac, edrStatus, gbpTag, hostname, idpRole, ingressVlan, mdmStatus, nasIp, radiusGroup, realm, ssid, userName, usermacLabel
    matchAll Boolean

    This field is applicable only when type==match

    • false: means it is sufficient to match any of the values (i.e., match-any behavior)
    • true: means all values should be matched (i.e., match-all behavior)

    Currently it makes sense to set this field to true only if the match==idpRole, match==usermacLabel and edrStatus

    modifiedTime Number
    When the object has been modified for the last time, in epoch
    nacportalId String
    If type==redirectNacportalId, the ID of the NAC portal to redirect to
    name String
    orgId String
    radiusAttrs List<String>
    If type==radiusAttrs, user can specify a list of one or more standard attributes in the field "radiusAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusAttrs in the result of a given rule.
    radiusGroup String
    If type==radiusGroup
    radiusVendorAttrs List<String>
    If type==radiusVendorAttrs, user can specify a list of one or more vendor-specific attributes in the field "radiusVendorAttrs". It is the responsibility of the user to provide a syntactically correct string, otherwise it may not work as expected. Note that it is allowed to have more than one radiusVendorAttrs in the result of a given rule.
    sessionTimeout Number
    If type==`session_timeout, in seconds
    type String
    enum: egressVlanNames, gbpTag, match, radiusAttrs, radiusGroup, radiusVendorAttrs, redirectNacportalId, sessionTimeout, usernameAttr, vlan
    usernameAttr String
    enum: automatic, cn, dns, email, upn
    values List<String>
    If type==match
    vlan String
    If type==vlan

    Package Details

    Repository
    junipermist pulumi/pulumi-junipermist
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the mist Terraform Provider.
    junipermist logo
    Viewing docs for Juniper Mist v0.11.2
    published on Saturday, Jul 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-junipermist

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial