How to Use the Cisco Meraki Dashboard API

Generate an API key from the API & Webhooks page 

1. Log in to the Meraki dashboard. 

2. Go to Organization > Configure > API & Webhooks. 

3. Select the API keys and access tab. 

4. Select Generate API Key. 

The three tabs on the API & Webhooks page are: 

• API analytics 
• API keys and access 
• Webhooks 

Generate an API key from the My Profile page (alternative method) 

1. Select the avatar icon in the top right-hand corner of the dashboard to open the My Profile page. 

2. Generate your API key from the API Access section.
   

3. Copy and store your key safely.

Authorization: Bearer <secret key>

https://api.meraki.com/api/v1/<resource>

API verbs 

Verbs in the API follow the usual REST conventions: 

• GET returns the value of a resource or a list of resources, depending on whether an identifier is specified. 
  • GET of /v1/organizations returns a list of organizations. 
  • GET of /v1/organizations/<org_id> returns a particular organization. 
• POST adds a new resource and performs other non-idempotent changes. 
  • POST to /v1/organizations/<org_id>/admins. 
• PUT updates a resource. PUT is idempotent; it updates a resource but does not create one if it does not already exist, which differs from RFC 9110. Specify all the fields of a resource, because omitted fields have no changes made to their value. 
• DELETE removes a resource. 

Note: Call volume is limited to ten calls per second, per organization. 

Stricter rate limit for claim endpoints 

The following endpoints are subject to a stricter rate limit of 10 requests over a 5-minute period, per IP address: 

• POST /api/v1/organizations/{organizationId}/inventory/claim 
• POST /api/v1/organizations/{organizationId}/claim 
• POST /api/v1/networks/{networkId}/devices/claim 

When this rate limit is reached, the API returns an HTTP 429 error and sets the Retry-After response header to the number of seconds you must wait before accessing the endpoint again. 

Handle identifiers 

Identifiers in the API are opaque strings. A <network_id>, for example, might be the string "126043", whereas an <order_id> might contain characters, such as "4S1234567". Do not parse identifiers as numbers. Even identifiers that look like numbers might be too long to encode without loss of precision in Javascript, where the only numeric type is IEEE 754 floating point. 

Organizations 

Retrieve the list of organizations for the API key specified in the authorization header:

GET https://api.meraki.com/api/v1/organizations
Response code: 200
Response body: [{"id":"<org_id>","name":"<org_name>" }]

A 302 response code may occur on any API call, including those that modify state such as DELETE, POST, and PUT. When a GET is redirected, the status code is 302. When a non-GET is redirected, the status code is 307 for Postman or 308 for any other client. Client applications must follow these redirects. The host issuing the redirect takes no action, so even non-idempotent requests are safe to retry on the new host. 

Most HTTP libraries and clients only follow a redirect with the HTTP verb GET. If you use other HTTP verbs, they may still follow the redirect but substitute GET for the other verb. As a result, a redirect on DELETE, POST, or PUT may look as though a GET was requested. To avoid this: 

1. Perform a GET on the organization you are working with. 

2. Store the URL you are working with. 

3. Use the URL for subsequent requests, particularly those that modify state. 

Retrieve metadata about a specific organization: 

 

GET https://api.meraki.com/api/v1/organizations
Response code: 200
Response body: [ {“id”: <org_id>, “name”: “Test Organization” } ]

Create a new organization:

POST https://api.meraki.com/api/v1/organizations
Request body: { “name”: “Second Test Organization” }
Response code: 201 
Response body: { "id": <new_org_id>, name: "Second Test Organization" }

The new organization is unconfigured. The admin who created it has full organization write access. Clients of the API can add additional admins and then remove the creating admin from the new organization if desired. 

Networks 

List the networks in an organization: 

GET https://api.meraki.com/api/v1/organizations/<new_org_id>/networks
Response code: 200
Response body: [ { "id": <network_id>, "name": "Test Network", "organization_id": <new_org_id>, "type": "wireless",
   "timeZone": "America/Los_Angeles", "tags": " test "}]

Create a new network:

POST https://api.meraki.com/api/v1/organizations/<org_id>/networks
Request body: { “name”: “Test Network 2”, “organizationId”: <org_id>, “type”: “appliance”}
Response code: 201
Response body: { “id”: <network_id>, “name”: “Test Network 2”, “organization_id”: <org_id>, “type”: “appliance”, “tags”: null }

Valid network types are appliance, switch, wireless, systemsManager, or camera. Use a combination of these to create a combined network. For example, "type": "appliance wireless". 

Licenses and devices 

Claim a device, license key, or order into an organization. When you claim by order, all devices and licenses in the order are claimed. Licenses are added to the organization, and devices are placed in the organization's inventory. These three claim types are mutually exclusive and cannot be performed in one request. 

The licenseMode parameter can be either renew or addDevices. addDevices increases the license limit, while renew extends the amount of time until expiration. This parameter is required when claiming by licenseKey. For more information, refer to this article.

POST https://api.meraki.com/api/v1/organizations/<org_id>/ claim
Request body: { "order": "4CXXXXXXX" }
Response code: 200
Response body: <empty>

SNMP settings 

Set the SNMP settings for an organization. The community string for SNMPv2 is in the response and can also be retrieved via a GET to this same URL

GET https://api.meraki.com/api/v1/organizations/<org_id>/snmp
Request body: { "v2cEnabled": true, "v3Enabled": true, "v3AuthMode": "SHA", "v3AuthPass", <secret>, "v3PrivMode": "AES128", "v3PrivPass": <secret>, "allowedIPs": ["5.6.7.8"] }
Response code: 200
Response body: { "v2Enabled": true, “v2CommunityString”: <secret>, "v3Enabled": true, "authMode": "SHA", "authPass", <secret>, "privMode": "AES128", "privPass": <secret>, "allowedIPs": ["5.6.7.8"] }

Administrators 

List the administrators for an organization:

GET https://api.meraki.com/api/v1/organizations/<org_id>/admins
Response code: 200
Response body: [ { "name": "Jane Doe", "email": "jane@doe.com", "orgAccess": "full","id": <admin_id> } ]

Organization access can be full, read-only, or none.

Add a new administrator with rights to only one network:

POST https://api.meraki.com/api/v1/organizations/<org_id>/admins/
Request body: { "name": "John Doe", "email": "john@doe.com", "orgAccess": "none", "networks": [{ "id": <network_id>, "access": "full" }
Response code: 201
Response body: { “id”: <admin_id>, "name": "John Doe", "email": "john@doe.com", "orgAccess": "none", "networks": [{ "id": <network_id>, "access": "full" }]

Valid access levels for networks are full, read-only, monitor-only, and guest-ambassador. Clients can also give administrators access by tag by substituting the networks field for tags such as:

"tags": [{ "tag": "foo", "access": "read-only" }],

Valid access levels for tags are the same as for networks. Clients can update administrators using PUT and specifying an admin_id.

Delete an administrator:

DELETE https://api.meraki.com/api/v1/organizations/<org_id>/admins/<admin_id>
Response code: 204
Response body: <empty>

Access API Analytics 

1. Log in to the Meraki dashboard and hover over Organization on the left navigation. 

2. Under Configure, select API & Webhooks. API analytics is the first tab you land on. 

Review the modules 

The page has three modules (sections) that help you monitor your organization's API consumption: 

• Overview Cards
• Trends Graph
• Metrics Table

Download detailed logs (CSV export) 

To dive deeper into the data, download the full request history logs. Download generates a CSV file with API consumption data for your own analysis. Common use cases include troubleshooting failed API requests, analyzing usage trends to optimize performance, auditing API access for suspicious activity, and debugging custom apps/scripts. 

1. Make your data filter selections. 

2. Select Download detailed logs at the top right of the page. 

The CSV export contains the following data columns: 

• Admin ID 
• Admin Name 
• Admin Email 
• HTTP Method 
• Host 
• Path 
• Query String 
• User Agent 
• Time stamp 
• HTTP Response Code 
• Source IP 
• API Version 
• Operation ID