Differences from the real API

Where the emulator behaves differently from the real API, and the values the spec doesn't settle. The educated guesses are tracked in #19 until someone checks them against the real API.

General

• Only the operations in ENDPOINTS.md exist. Other paths return 404, and other methods on a known path return 405.
• Writes live in memory and are gone after a restart or a reset.
• No redirects to regional shard hosts.
• Error messages are close to Meraki's but not always word for word.
• Rate limits are per API key rather than per organization, plus the per-device limits on live tools.
• The API request log lives in memory, holds the last 10,000 calls and starts empty on each run.
• Syslog roles other than applianceEventLog, applianceUrlLog and wirelessEventLog, and the vMX model names, follow Meraki's naming but haven't been checked against the real API. The same goes for the SSID EAP timer defaults, which come from Cisco's Nexus-as-Code data model.

Organizations

• Only serials in the organization's inventory can be claimed into a network. The real API also claims devices straight from an order. Inventory claim only knows the seeded unclaimed orders and devices released from inventory.
• Order claims know one seeded order: two shipped CW9166I APs, a Secure Router still pending and a subscription of its own. Its claim ID is in the world (world.unclaimed.orders). Claiming it puts the shipped devices in the organization's inventory, as inventory claim does, and claims only the subscriptions the body lists. Preview always answers sync_order_claim with subscription selection supported. Device descriptions and SKUs (the model plus -HW) are educated guesses.
• No organization starts on subscription licensing. Subscriptions wait for a claim key (two seeded, one starting a month after boot) and can only be claimed into an organization that already uses subscriptions or a new, empty one, which then switches to it; Acme Corporation and Acme Test Lab answer 400. A subscription organization's licenses overview answers 400. The entitlement catalog is a fixed list of LIC- SKUs by product class (MS by series, MX by size, Secure Routers as MX Large), with add-ons left out of unified. Seats are worked out on read: each device in a bound network takes one of its class, from the subscription's entitlements in order, and enrolled Systems Manager devices take SM seats. A shortfall makes the subscription out_of_compliance and is listed by class with the essentials SKU, its grace period ending 30 days after the subscription last changed. Binding refuses networks that need seats the subscription can't give (validate lists the shortfall instead); a shortfall already there doesn't block it, and a network is bound to one subscription at a time, so binding moves it. Every part of a split network stays bound, a combined network keeps one binding (the combined network's, or else the first bound network's in the list), and a network moved to another organization leaves its subscription. Copies and cloned organizations take no subscriptions. Subscription IDs, claim keys, the smart account, type termed and these rules are educated guesses.
• Acme Corporation's co-term licenses are one per order, with counts that match its devices, so the licenses overview counts what the licenses cover, and its status turns to License Required when an organization holds more devices than that. Claiming a license with addDevices adds its counts, and renew pushes the co-term date out by its term. Moving counts invalidates the license and makes a new one in each organization, a remainder only when counts are left. License terms, the edition names, the license model names (MR Enterprise, MX250 Enterprise, MV, the switch model), the key format, the License Required status and the renewal math are educated guesses.
• Per-device licenses assigned to a device that already has one are queued behind it and start when it runs out. A license taken off its device after it started keeps running as unusedActive. Neither organization has Systems Manager seats, so the seat endpoints always answer 400. An organization created through the API with nothing in it takes on per-device licensing when licenses are moved into it. These rules are educated guesses, as are the queue's place in permanentlyQueuedLicenses.
• Network moves happen at once, so a move is completed or failed as soon as it's made, and a simulated move isn't kept. A move needs both organizations on the same licensing model and a free network name. A network belongs to one group at most, and a group's overall status is its worst device status. The failure reasons, the ID formats and these rules are educated guesses.
• Organizations start with no config templates. A template copied from a network gets a switch profile for each switch model in it, with that model's default port settings, and one copied from a template gets its profiles and port settings. A template made from scratch covers appliance, switch and wireless, and takes its settings from the first network bound to it. A template copied from a network keeps that network's settings as they were. Template IDs don't work as network IDs, so a template's settings can only change through its switch profile ports. A network can only bind to a template that covers all its product types, and a template with bound networks can't be deleted. The switch profiles made on copy, their names, the ID formats, which settings writes a bound network refuses, and the error wording are educated guesses.
• Only network policy objects (CIDRs and domain names) go in groups, and only in NetworkObjectGroups. MX L3, inbound, cellular and inbound cellular firewall rules and the organization's VPN firewall rules take them in srcCidr and destCidr as OBJ(id) and GRP(id). An unknown or adaptive policy reference is refused, an object or group a rule names can't be deleted, and a network whose rules name them can't move to another organization. An object's networkIds lists the networks whose rules name it or one of its groups, and deleting an object takes it out of its groups. The deprecated ipAndMask type is refused. These rules, the 7 digit IDs counting up from a seeded start and the limits (5,000 objects, 1,000 groups, 150 objects per group) are educated guesses.
• Every organization starts with two adaptive policy groups, Infrastructure (SGT 2, only its SGT can change) and Unknown (SGT 0, can't change), and neither can be deleted. Custom groups take a unique name and an SGT from 1 to 65519 that no other group uses, and their policy objects must be adaptive policy objects, which can't be deleted while a group names them. Groups, ACLs and policies name each other by ID, name or SGT; there is one policy per source and destination group, deleting a group drops its policies and deleting an ACL takes it out of policies. ACL rules default to any port, take ports only with TCP or UDP, and tcpEstablished only on an allow TCP rule. Switch ports, MX ports (sgt.id) and SSIDs can name a group, switch ports show the group's name, peer SGT is refused on access ports, deleting a group clears it from them, and a network using a group can't move to another organization. The settings list networks with switches, APs or appliances; splitting an enabled network leaves it on for each part with switches, APs or an appliance, and a deleted network drops out. The overview counts what exists, with policies counted as deny or allow by their last entry rule. The default group descriptions, the ID formats (4 digit groups, 8 digit ACLs, 3 digit policies counting up from a seeded start), the SGT range, the limits (60 custom groups, 16 rules per ACL, 7 ACLs per policy) and the error wording are educated guesses.
• Organization-wide firewall rulesets and rules are configuration only: no simulated traffic is filtered by them. A rule without a priority goes last in its ruleset, and one given a taken priority moves the rules from there down by one. Deleting a ruleset deletes its rules. Match types the request has no criteria field for (countries, fqdns, siteSpecificVlans) are refused, and application categories come back with their ID only. Policy assignments by client list clients seen in the window with an Allowed, Blocked or group policy, including the Guest policy guest SSID clients get by default; a client with no name shows its MAC.
• Organization-wide group policies get group numbers counting up from 100 that are never handed out again. An adaptive policy group or appliance VLAN belongs to one policy at a time: assigning it to another is refused, assigning it again is a no-op, and removing one the policy doesn't hold is refused. VLANs are named by the interface ID the VLAN list gives them or as <networkId>_vlan_<vlanId>, and always come back in the second form. Networks bound to one config template, or copied from one network, share their VLANs' interface IDs, so those VLANs have to be named the second way; a deleted VLAN drops out of the assignments, and VLANs by policy lists every appliance VLAN in the organization with a null policy when none holds it. A firewall ruleset is assigned to a policy once, priorities from 1 to 100000 may repeat, and deleting a policy, group or ruleset drops its assignments. The ID formats (3 digit IDs counting up from a seeded start) and the limit of 1,000 policies are educated guesses.
• Login security, SAML and organization SNMP are stored settings: nothing is enforced, so restricting API keys or Dashboard logins to IP ranges never locks out the emulator's callers. Login security starts with nothing enforced (90 day expiry, 3 previous passwords, 12 characters, 3 attempts and a 30 minute idle timeout when turned on), and turning on IP ranges needs at least one. SAML starts off. IdP consumer URLs sit on the organization's Dashboard host, the IdP used for SP-initiated SSO can't be deleted and a subdomain belongs to one organization. SAML role IDs and IdP IDs have 13 digits, with up to 100 roles and 20 IdPs. Organization SNMP starts with v2c and v3 off and answers snmp.meraki.com port 16100. The community string and the v3 user are the same o/ name per organization, v3 needs both passphrases, and the passphrases are kept but never returned. These are educated guesses.
• Cloning an organization copies its networks (names, product types, tags, time zones and settings), its policy objects and groups, adaptive policy groups, ACLs and policies, splash themes, login security and SNMP settings. Devices, clients, licenses, inventory, config templates and everything else stay behind; a network bound to a template gets the template's settings and isn't bound. No provisioning pipelines run, so both pipeline views are empty. The OpenAPI document lists the operations the emulator serves, with their path parameters and request bodies, not Meraki's full spec.
• Branding policies are stored only, since the emulator has no Dashboard to brand. Their answers carry a brandingPolicyId the spec leaves out, which is also what the priorities list and the item routes use. The list is kept in priority order (later wins), a new policy goes last, and a new priority order must name every policy once. A policy starts enabled with every help setting at default or inherit, values must be given for the three ... choices of appliesTo and only for those, admins, networks and templates that leave the organization drop out of it, and smForums can't be changed since there are no Systems Manager networks. A custom logo is kept as a hash, so its preview URL points at a file that doesn't exist and expires an hour after each read. Early access features are a made-up list of six; an organization opts in to each one once, features scoped to the whole organization refuse networks, and the opt-in list answers a list though the spec shows one object. Networks in an opt-in follow a split and drop out when deleted. Splash themes start with three read-only system themes (Modern, Classic, Minimal); a custom theme starts empty or with copies of its baseTheme's assets, and asset content is base64, answered in 60 character lines. An asset with the name of one the theme has replaces it and keeps its ID, and themeIdentifier takes a theme's ID or name. System themes and their assets can't be changed or deleted, an SSID's splash settings can only name a theme of the organization, a theme in use can't be deleted, and a network using a custom theme can't move to another organization. The feature list, the system themes and their files, these defaults and rules, the limits (50 policies, 50 themes, 25 assets each, 5 MB of assets per organization) and the ID formats are educated guesses.
• Every API key acts as the same admin, API Integration, in both organizations. Its keys are every key that has authenticated this run plus the ones generated through the API, so the list shows a suffix for each. A generated key is 40 hex characters and works alongside --api-key. Revoking a suffix revokes every key ending in it, and a revoked key answers 401 until the emulator restarts, a reset included. There is no limit of two keys per admin, and lastUsedDashboardAt is the time of the last API call.
• Action batches allow 100 actions, 20 in a synchronous batch, and 5 running batches per organization. An asynchronous batch runs 2 seconds after it's confirmed plus a tenth of a second per action, on the first request after that, and batches run in the order they finish. A running batch can't be deleted or changed, and each organization keeps its newest 1,000 batches. Live tools, reboots, webhook tests, camera snapshots, action batches themselves and the identity routes can't go in a batch. A callback POSTs the finished batch the same way live tool callbacks do, with an HTTP server from any network in the organization; a callback by URL can only use the included payload templates. The 18 digit ID format, the error wording, the run time and the limits other than 20 synchronous actions are educated guesses.
• Integrations deployable to an organization are a fixed list of ten, one per type the spec names. Secure Access and Cisco Spaces stop being deployable once deployed, and XDR needs a network with a security appliance. Deployed integrations are worked out from the Secure Access integration, networks with XDR on and the Cisco Spaces link, so they can't disagree with those endpoints. XDR lists every network with the appliance product; one whose security appliance was removed isn't eligible. Moving a network to another organization turns XDR off for it. Acme Test Lab is linked to a Cisco Spaces account and Acme Corporation isn't; nothing can link one through the API, and removing the link answers status: false when there is none.

Networks

• Firmware is configuration only. A scheduled upgrade or rollback shows as done once its time passes, but device firmware strings never change. Each product has three releases (the previous one, the one networks run, and a beta). A staged upgrade stage takes an hour from its start time. Networks start with no staged upgrade groups or event. Stage status names, the time an upgrade gets when you leave it out (the next upgrade window), the ID formats and what the staged event endpoint answers before there is an event are educated guesses.
• Organization firmware upgrades list each network's upgrade per product, including the one every network got about two weeks after its current release, plus scheduled and canceled ones. Outside a staged event an upgrade takes no time, so every phase of it shows the upgrade's time. Status names other than Completed and Cancelled (and the device statuses), completedAt's format and the ID formats are educated guesses.
• Floor plans keep the image's MD5 and aspect ratio, not the image, so imageUrl points at floorplans.example.com and can't be downloaded. Networks start with no floor plans. A plan placed by its center is 100 m wide, and positions use a flat local grid, which is accurate at building scale.
• AP auto locate jobs run on the clock: 10 minutes with a GNSS and ranging refresh, 1 minute without. A plan with fewer than two APs ends in error with no neighbors. The real feature needs APs that support it; here every AP takes part. A job scheduled in the past keeps its time, so with a frozen --now, schedule one at least 10 minutes back to get a finished job you can publish. Publishing with no devices moves each AP to a calculated spot on its plan. The run times, the default width, the ID formats, the image URL's 30 minute expiry and leaving out refresh meaning no refresh are educated guesses.
• AP auto locate devices list the APs on a floor plan. A position saved as an anchor is the user one; otherwise the plan's latest job gives a suggested position once it finishes, calculated once it's published, and null before that.
• Packet captures run on the clock for their duration, or until stopped, and the organization keeps the newest 10. A capture takes one switch or security appliance, or several APs from one network. Packet counts and file sizes are made up, and the download link points at pcap.example.com. Schedules show their next run and conflicts but never take captures. Capture defaults (60 seconds, interface wan1, wired or wireless), the fields of each devices entry, the ID formats and the conflict warning's wording are educated guesses.
• Network alert history lists what the alert settings would have sent for things the sim records: devices down past the alert's timeout, failovers, VPN peer changes, blocked malware and settings changes. Alerts go out when they happen (down alerts after the timeout), and only email, push (all admins), SMS and webhooks that are set up show as destinations. The alert type IDs other than settings_changed and stopped_reporting, the titles, alertData and the 31 day window are educated guesses.
• Meraki authentication users are kept per network. 802.1X users need an SSID using 8021x-meraki, guest users an SSID with the Meraki RADIUS splash page, and client VPN users a network with an MX; a Dashboard administrator signs on with their own name. Passwords are kept but never returned and nothing is emailed. Deleting a user removes it from the network whatever delete says. Splash login attempts come from client sessions on enabled SSIDs whose splash page asks for a sign-on, so the seed, whose guest SSIDs use click-through pages, starts with none; on a Meraki RADIUS splash page clients sign on as the guest users authorized there. The default timespan is one day. NetFlow starts off and needs a collector when on, and Encrypted Traffic Analytics needs NetFlow. Traffic analysis starts in detailed mode and is configuration only, like NetFlow. VLAN profiles start with a Default profile (VLAN 1 named default) that can't be deleted, and a profile still assigned to a device can't be either. Reassigning a stack assigns every member, and no iname puts devices back on the default. Combining networks keeps the switch network's VLAN profiles and adds the wireless network's other inames, and is refused while a wireless user and a client VPN user share an email, since the email is the user's ID. These defaults, the limits (1,000 users, 100 profiles, 100 pie chart items) and the error wording are educated guesses.

Alerts and webhooks

• Webhook payload templates render Liquid output tags ({{ name }}, dotted paths and the jsonify filter) but leave {% %} tags as they are. Only the IDs of the included templates and the names of wpt_00001 and wpt_00005 come from the spec; the other names and every included body are educated guesses, as are refusing to change included templates or delete one an HTTP server uses. Webhook alert types cover the alert history's types plus power_supply_down. A test retries twice, half a second and then a second apart, waits 5 seconds for an answer, doesn't follow redirects, and logs a try that got no answer with responseCode 0. These numbers, the test ID format and the User-Agent are educated guesses.
• A request with a callback records it under callback statuses as running and POSTs the finished job to the URL or HTTP server when the job ends, as alertData with alertType API callback, using the Callback (included) template unless another is named. It becomes completed on a 2xx answer and failed otherwise. A URL needs its sharedSecret. The payload's other fields and the error wording are educated guesses.
• Organization-wide alert configs are stored but never fire. A config needs the threshold for its type (bit_rate_bps, latency_ms, loss_ratio, jitter_ms or mos), keeps only that one, and its webhook recipients have to be HTTP servers in the organization. Those checks are educated guesses.
• The alert taxonomy only lists the alert types the emulator raises. Alert profiles accept every type in the spec but never send anything.

Security appliance (MX)

• Content filtering category IDs, and most layer 7 category and application IDs, are stand-ins. The names follow the Dashboard, and the firewall rules, traffic analysis and event log all use the same lists. MX and SSID L7 rules take an application or category as an object with its id (a bare ID works too) and answer with its name, a null name for an ID the lists don't have, and the country types take a list of two-letter codes.
• MX traffic shaping settings are configuration only: moving the default uplink or setting bandwidth limits doesn't change the simulated traffic. Uplink selection starts with wan1 as the default uplink, load balancing, active-active AutoVPN and immediate failover off, and no preference rules, matching the sim, where wan2 stands by. Uplink limits start at 1000/1000 Mbps on fiber, 50/500 Mbps up and down on cable and 20/100 Mbps on DSL, with no limit on an unused WAN port and 51200 Kbps on cellular. SD-WAN internet policies write the same WAN preference rules uplink selection shows. A custom performance class in use by a rule can't be deleted. No organization has VRFs, and no network is a template, so rules can't use VLANs, hosts or network IDs. The uplink limit defaults, the custom class defaults (100 ms, 100 ms, 5%) and ranges, the DSCP descriptions, the VPN exclusion application IDs other than Office 365 Sharepoint, the 18 digit ID format and the error wording are educated guesses.
• MX firewall settings start with IP source spoofing protection on block, cellular and inbound cellular rules with only the default rule, and no 1:many NAT or multicast forwarding rules. No MX has a cellular uplink, so the cellular rules are never used. Uplink NAT starts on for wan1 and wan2. Connectivity monitoring starts with 8.8.8.8, the address the uplink loss and latency are measured against, and changing the list doesn't change those numbers. Multicast forwarding takes 224.0.0.0/4 addresses on the network's own VLANs (VLAN 1 on a single LAN), and the organization view lists every MX network, with or without rules. Warm spare needs a second MX of the same model in the network (the seeded order has an MX250 for HQ). Enabling it without uplinkMode uses public mode, and virtual mode needs a shared IP on each WAN /24 of the network's MX. Swapping changes the roles only, so the sim keeps reporting on the same MX, and removing the primary makes the spare the network's MX with warm spare off. The defaults, the same model rule, the virtual IP checks and the fields shown while warm spare is off are educated guesses. The redundancy endpoints show the same warm spare: designation 1 is the primary and 2 the spare, so naming the spare as 1 swaps the roles, virtual uplink mode lists one virtual IP per WAN, and the mode reads disabled while warm spare is off. active-active and uplink sharing are stored only. The organization view is a list with one entry per MX network, though the spec types it as one object.
• MX Wi-Fi answers 400 unless the network's MX is an MX67W or MX68W. Lab - Ottawa in Acme Test Lab has the seeded MX68W. RF profiles start with 11 Mbps on 2.4 GHz, 12 Mbps on 5 GHz, 802.11ax on and every SSID dual band with band steering, and one assigned to an MX with a radio can't be deleted. Radio settings start on auto (null) with no RF profile, and assigning one (or null for the basic profile) clears the manual values. The four MX SSIDs start disabled and open as Unconfigured SSID 1 to 4 on the first VLAN, and show the RADIUS servers and encryption fields only for the auth modes that use them. A vMX authentication token is only for vMX appliances and expires an hour after it is made. The defaults, the 50 profile limit, the 2 to 30 dBm power range and these rules are educated guesses.
• Hub BGP, third-party VPN peers, IPsec SLA policies, VPN firewall rules and the organization's allowed intrusion rules are configuration only: the VPN status and stats endpoints don't read them. BGP starts off with AS 64512 and an iBGP hold timer of 240, can only be turned on in VPN hub mode and reads as off on a network that leaves it, and the ASN is shared by every hub in the organization. Peers, SLA policies and VPN firewall rules start empty apart from the default allow rule. A peer without IPsec policies or a preset shows the default preset, custom policies fill unset fields from 3DES, SHA1, group 2 and 28800 seconds for phase 1 and AES128, SHA1, no PFS and 28800 seconds for phase 2, and a preset shows only its name. A peer needs a public IP or hostname, and BGP neighbors and ECMP uplinks need a route-based peer. SLA policies keep their ID while one with the same name stays in the list. Allowed intrusion rules show a message for the signatures the sim's security events use. These defaults, the 18 digit ID format and the limits (100 BGP neighbors, 300 peers, 100 SLA policies, 1,000 rules) are educated guesses.
• An appliance port updated through the device writes the same port settings as the network port update, so both read back the same. WAN ports carry the uplinks: they can't be disabled, turned into LAN ports or switched to cellular, and LAN ports stay LAN ports. Wired L3 interfaces sit on a free LAN port of the network's MX (or on none), which then shows at layer 3 with no downlink settings, and their subnets can't overlap the network's VLANs or each other, including VLANs kept while VLANs are off. Static delegated prefixes run from /48 to /64 and show on the device as manual delegated prefixes, one per uplink they name (an independent prefix under independent). A VLAN with IPv6 on and an autonomous prefix assignment takes the next /64 of the first static prefix on its origin, and its MX address is ::1 in it; an assignment with no such prefix reads as Not assigned. The VRF setting is stored only, and uplink selection rules still take only VRF 0, since the API has no way to add VRFs. The limits (100 interfaces and 100 static prefixes per network), the ID formats and these rules are educated guesses.
• MX local and split DNS profiles are configuration only: DNS answers in the simulation don't change. Local DNS records hold one IPv4 address, and a hostname appears once per profile. Split DNS hostnames may start with a *. wildcard and take one IPv4 nameserver. A network with an MX takes one profile of each kind, so assigning a second is refused, and a profile still assigned or still holding records can't be deleted. Assignments drop out with their network, follow it through a split (to its appliance part) and a combine, and are dropped when it moves to another organization. The ID formats (6 digit IDs counting up from a seeded start), these refusals and the limits (1,000 profiles, 10,000 records, 100 hostnames per split profile) are educated guesses.
• Insight tracks a fixed list of eight applications with smart thresholds made up per network, and works on any network with an MX. Application health splits the network's WAN and LAN traffic by the same application mix as traffic analysis, so its bytes match that view; latency and loss come from the active uplink's link samples, LAN latency is a small made-up value with no LAN loss, and response time is a per-application server time plus three WAN round trips. Monitored media servers are stored only.
• Lab - Winnipeg in Acme Test Lab has the only Cisco Secure Router, a C8455-G2-MX, which every appliance view treats as an MX. Ports 1 to 4 are SFP+ (TenGigabitEthernet0/0/n), the rest GigabitEthernet0/0/n. Optics sit in port 1 (wan1, SFP-10G-LR-S) and port 3 (SFP-10G-SR-S, nothing on the far end, so it receives -40 dBm). DOM readings are sampled every five minutes and each interval reports their minimum, maximum and median, newest first, on aligned buckets (so the newest one is partial), leaving out intervals the router was down for; the interval defaults to 1200 s up to 4 days and 14400 s beyond. Packet counters turn each WAN port's bytes from the uplink usage views into packets of 620 to 1120 bytes, mostly unicast with a little multicast and broadcast and no errors; LAN ports have nothing cabled and count nothing. The model, port layout, optics, levels and packet sizes are educated guesses.
• Secure Access starts empty in every organization. One integration per organization, its key and secret kept without being shown; the answer carries an integrationId the spec doesn't list, since the integration paths need one, and deleting the integration detaches every site and tears down every connector. Attaching, detaching and site updates are refused until an integration exists. Eligible networks are the MX networks not bound to a template, and templates with the appliance product, that aren't attached yet; each is offered the nearest of eight fixed regions (templates the first), with default route on. Attaching checks every item first, deploys one connector in each region that has none, and answers a pipeline that is completed under a frozen clock; on a running clock it stays active, the site reads no registry and its connector provisioned for 120 seconds. Connectors stay after their last site is detached and can only be deleted with no sites. A site's status comes from its primary MX and the uplink carrying its tunnels at that moment: offline while the MX or every uplink is down, bad tunnel when the active uplink's loss is 5% or more or its latency 150 ms or more (many bad tunnels when every uplink that is up is), else good; a template's site is dormant, a warm spare reads dormant while the primary is up, and history before the attach is unknown. History takes a timespan like -2hours (default two hours, at most 7 days) with a point every 5 minutes, hourly past one day. The overview counts good as healthy, offline, dormant and no registry as offline, and the rest as degraded. A site follows its network through a split or combine, blocks moving the network to another organization, stays while the network has no MX (reading offline) or is bound to a template, and drops out when its network or template is deleted. The regions, these statuses and thresholds, IDs and timings are educated guesses.
• Cisco Umbrella is configuration only: DNS answers in the simulation don't change. Its API key and secret are kept but never shown, the same key always names the same Umbrella organization, and connecting another account drops the old account's policies. Policies, exclusions and protection need a connected account, except turning protection off. Removing a policy that isn't applied answers 400. Disconnecting turns protection off and drops the policies but keeps the domain exclusions. Umbrella is a template setting, so bound networks refuse its writes.

Switches (MS)

• Switches start with no layer 3 interfaces, so the MX still routes every VLAN. Only switches that stack route (MS390 and MS250 here, not MS120 or MS130), and a switch in a stack takes its interfaces and static routes from the stack routes. A switch with its own interfaces can't join a stack until they're gone. An interface can't be deleted, or its subnet changed, while a static route's next hop or the default gateway needs it. OSPF starts off with only the backbone area 0, and an interface's OSPF area must be one of the OSPF areas. Multicast starts with IGMP snooping and unknown multicast flooding on and no overrides. A rendezvous point names the IP of a layer 3 interface in the network and drops out when that interface goes. A network bound to a config template reads OSPF and multicast from the template and refuses writes to them. Overrides name switches or stacks; switch profiles only apply to template networks, which the emulator doesn't address, so they are refused. A network copied from another, a template made from a network and a cloned organization's networks keep the source's stack entries in bridge priorities and MTU and multicast overrides, but drop its switches, since the copy has none of them. The multicast routing live tool lists the switch's interfaces with multicast routing enabled (neighbors are other switches' enabled interfaces in the same subnet) and a (*, G) route per rendezvous point, with 239.255.255.250 standing in for Any; both are empty while no interface runs multicast routing. These rules, the defaults and the route flags are educated guesses.
• Switch ACLs start with only the default rule (allow anything), which stays last and is dropped when sent back. An ACL rule's ports are single ports and need tcp or udp. Access policies are numbered 1, 2, 3 in each network, RADIUS servers get IDs from their own counter, and secrets are never returned. The policy list only shows policies with RADIUS servers, so one using Meraki authentication is only reachable by its number. There are no organization-wide RADIUS servers, so an organizationRadiusServerId is refused. A switch port can only name a policy that exists, and a policy a port uses can't be deleted. QoS rules take a port or a port range on each side, only with TCP or UDP, and a new order has to list every rule. DSCP to CoS mappings start with best effort on queue 0 and the AF classes and EF on queues 1 to 5, and an empty list puts those back. A network bound to a config template reads all of these from the template and refuses writes to them. The policy defaults, the RADIUS ports 1812 and 1813, the 24 hour cache limit, the DSCP defaults, these rules and the error wording are educated guesses.
• STP starts with RSTP on and no bridge priorities, MTU at 9578 with no overrides, and storm control at 100 percent (no limit) for every traffic type. Bridge priorities are multiples of 4096 from 0 to 61440 and name switches or stacks, with a stacked switch listed by its stack, and MTU sizes run from 1280 to 9578. Traffic types treated as one threshold must share the same threshold. Switch profiles only apply to template networks, which the emulator doesn't address, so they are refused, and a network bound to a config template reads these three settings from the template and refuses writes to them. The alternate management interface starts off with no VLAN or protocols, and enabling it needs both. Each switch takes an IPv4 address no other switch or device uses, inside the VLAN's subnet when the MX holds that VLAN, and an MS390 also needs a subnet mask and a gateway. A link aggregation takes 2 to 8 ports of one switch or one stack, none of them the uplink to the MX, a port on a profile-bound switch or a port already aggregated, and port statuses don't change. A switch leaving the network takes its ports along, and a group left with one port splits. Warm spare pairs two lone switches of one model that route (MS390 and MS250 here), set on the primary. Enabling it clears the spare's layer 3 interfaces and static routes, and while paired the spare takes no layer 3 settings of its own and neither switch can join a stack. These defaults, ranges and rules, the link aggregation ID format and the error wording are educated guesses.
• The DHCP server policy starts with new servers allowed and no allowed or blocked servers. Its always allowed servers are the MX that DHCP servers seen reports plus the network's switches, and none of them can be blocked; the policy is a setting only, so servers seen keeps reporting the MX as allowed. MS120 and MS125 switches don't support ARP inspection. While inspection is on, its warnings list each switch that doesn't support it or has no port marked daiTrusted (the port to the MX starts trusted). Trusted servers take a MAC, a VLAN and an IPv4 address, once per MAC and VLAN. Port schedules fill any day left out with the whole day active, take times on the half hour with from before to, and keep times as written. A port can only name a schedule of its own network, shows its schedule while it has one, and a schedule a port uses can't be deleted. A network bound to a config template reads these from the template and refuses writes to them. Cloning a switch copies its port settings, its STP priority, MTU and multicast entries (by switch, not stack) and its link aggregations on its own ports onto targets of the same series in networks not bound to a template; in another network a target drops the port schedule and custom access policy. The unsupported models, the limits, the same series rule, what clone carries and the error wording are educated guesses.
• Networks start with no switch stacks. Once a stack exists, the link layer topology shows its members as one stack node, with each link to a member pointing at that node. The spec lists no fields for a stack's members there, so each one carries the same fields as a device node. Stack member roles (first active, second standby), the ID formats, the stack node's derivedId and mac, and the defaults for interface OSPF and stack DHCP are educated guesses.
• DHCP servers seen only lists the network's MX, on each VLAN where it handed out a lease in the window. There are no rogue servers and switch stacks don't serve DHCP there. The appliance port view names interfaces GigabitEthernet0/0/N, which is a guess.
• Switch port usage history picks its span and interval as the spec describes: an interval alone covers 72 intervals (a day at 1200 s), and with time parameters the interval grows until one port has at most 288.

Wireless (MR)

• Controller migrations are a record only: an AP starts its move 5 minutes after it's asked to and stays in its network. Only APs can move to a wireless controller.
• Wireless client connectivity events follow the event log: a failed attempt when there is one, then association, authentication and DHCP, and a disassociation when the session ends. Clients don't roam, so there are no roam or sticky events, and no event triggers a packet capture. A client's latency is its AP's, and data rates follow the band, the client's signal and its spatial streams. No AP is a mesh repeater, so mesh statuses are always empty. The event subtypes and severities, the durations, the default page size of connectivity events, the SSID ID format, the order of the per-client lists (by MAC) and the empty values for intervals with no clients are educated guesses.
• Organization wireless views reuse the per-network numbers. Packet loss comes from each client's usage at a fixed packet size with a steady loss share per client, higher on 2.4 GHz and on the flaky AP. An AP gets the lower of the PoE standard its model needs and the one its switch gives (802.3bt on the MS390, 802.3at elsewhere) and runs at low power when that falls short, so the HQ CW9166Is on the MS250 run at low power. It reports its power mode each time it comes back after its own or its switch's outage. CPU load is the 5-minute load average times 1000. The impacted devices view returns one entry per wireless network, though the spec shows a single object, and counts an outage of 15 minutes or less as AP reboot and a longer one as AP offline. Usage defaults to megabytes, tunneledTo is null since there are no campus gateways, and Catalyst APs report null link speed, duplex and aggregation. These choices, the CPU core counts and the PoE needs per model are educated guesses.
• Radio overrides and radio settings share one per-AP state. Overrides show null for a channel, width or power the RF profile picks, and a disabled radio reports -1 power and stops broadcasting. Assigning an RF profile clears the channel, width and power overrides but keeps disabled radios off. AutoRF settings start with channel avoidance on and AI-RRM, FRA and minimize changes off, FRA needs AI-RRM and turns off with it, and recalculating channels changes nothing and reports completion 5 minutes later. Air Marshal hears three to six neighbor SSIDs per wireless network, some every few minutes and some only every few days, plus a rogue on Warehouse - Reno's LAN and a copy of the guest SSID at the sites with six or more APs. Block rules contain the BSSIDs they match unless an allow rule matches too, allow rules also clear the rogue flag, and the default policy starts at block and only changes what it reads back. Rule IDs, override ranges (2 to 30 dBm, channel widths per band), these defaults and the neighbor data are educated guesses.
• There is no Bluetooth sim, so Bluetooth clients is always an empty list and a client ID answers 404. Bluetooth settings start with scanning and advertising off, a UUID per network and Unique major and minor assignment, where the network gets one major and each AP its own minor; major and minor can only be set on the network in Non-unique mode, and an AP's own values win until set back to null. Billing starts in USD with no plans, takes up to 5, numbers new plans from 1 and drops plans left out of the list. Location scanning starts off with a validator per network, the push API needs analytics on, and turning analytics off turns the API off. Scanning API receivers and wireless MQTT settings only store where data would go and never send anything; a receiver's shared secret is never returned. Receivers take version 2 or 3 and drop out with their network. MQTT settings name one of the network's own MQTT brokers, must have one to be enabled (deleting it turns MQTT off), and start with every message field and QoS 0. The alternate management interface starts off with no VLAN or protocols, gives each AP an IPv4 address no other AP or device uses, and stays writable on a network bound to a config template, since it names the network's own APs. The per-AP IPv6 addresses are stored and only echoed back. These defaults, the receiver ID format and the error wording are educated guesses.
• SSID profiles are stored settings: assigning one to an SSID records the pair, and the SSID keeps answering with its own settings. Profiles start from open security, bridge mode and no splash, with RADIUS, EAP timer and splash defaults taken from the spec's examples. A passphrase is required in psk mode and is never returned, ciphers and AKMs only go with WPA3, and there are no organization-wide RADIUS servers, so a profile naming one is refused. An SSID takes one profile, a new assignment replaces the old one, and a profile still assigned can't be deleted. The spec shows the profile list, the overviews and the assignments by network as a single object; here they are lists of those objects, and the overviews answer the same as the profile list. Isolation allowlist entries take a client MAC once per network and SSID, number their IDs from 1 and keep MACs in lower case. Assignments and entries drop out with their network and follow it through a split (to its wireless part) and a combine. These defaults, the limits (100 profiles, 1,000 entries) and the error wording are educated guesses.
• Every wireless network starts with one default AP port profile, 1001, whose two ports are on SSID 1 and whose USB port is off. New profiles are numbered from there, port numbers follow the order of ports, and a port's SSID can be any number from 0 to 14. pskGroupId is stored as given and only shown when set. The default profile can't be deleted, and APs assigned to a deleted profile go back to the default. Profiles name the network's own APs, so they stay writable on a network bound to a config template and go with the wireless part of a split. Nothing reads the assignments yet. The default profile, the defaults for left-out port fields (enabled true, SSID 0) and the limits (64 profiles, 8 ports, 2 USB ports) are educated guesses.
• Zero touch deployments are a record only: nothing is claimed, swapped or unclaimed. The new device must be an AP in the organization's inventory with no deployment still running, and a replace names an AP in the organization, whose network, name, model, MAC, tags and RF profile fill in the old device. A deployment is ready for a minute, in progress for 4 more, then completed; with a frozen --now it completes in the POST. The status sent in the body is checked but not used, errors is always empty, and a deployment whose network is deleted or moved keeps no network. The list wraps its page in a one-item array as the spec shows. These run times, the default afterAction of unclaim and the ID format are educated guesses.
• An organization gets one RadSec certificate authority: the first create starts generating it, later ones answer the same one. It reads generating with no contents for a minute (at once with a frozen --now), then untrusted until a PUT sets it trusted. Its contents, and its CRL and delta CRL, are PEM-shaped text made up from the seed, not real certificates. Nothing is ever revoked. The status names other than trusted, the generation time and the 4 digit ID are educated guesses.
• Zigbee and electronic shelf labels run on CW916x APs only; other APs answer 400. Every wireless network starts with both off, except Lab - Montreal in Acme Test Lab, whose CW9166I is the IoT controller with two door locks and has ESL on. Turning Zigbee on needs an IoT controller in the network. The lock management system is never contacted: it reads online when Zigbee is on with an address and a controller that is up, and its password is kept but never returned. A gateway's {id} is its serial, and a lock's status follows its gateway. An enrollment pairs one new lock after 30 seconds (it fails if the AP is down) and a disenrollment removes the named locks after 10 seconds, both in the POST with a frozen --now; IDs not found report failure. Both settings name the network's own APs, so they stay writable on a network bound to a config template and follow the wireless part of a split. Network copies and clones take the ESL settings and Zigbee's lock management and defaults, with Zigbee off and no IoT controller. An AP swapped for a model without Zigbee drops its locks and ESL settings, and stops being the IoT controller. The ESL provider is imagotag in high frequency mode and sepioo in Bluetooth mode, where sepioo.hostname shows the hostname. Configured devices lists every CW916x in the network. The run times, the ID formats, the channel ranges (11 to 25 for Zigbee, 1 to 11 for ESL), the limit of 32 locks per gateway and the error wording are educated guesses.

Cameras (MV)

• Cameras record nothing, so snapshot and clip links point at camera.example.com and can't be downloaded. Footage is kept 30 days, or a profile's maxRetentionDays; a time outside that, in the future, or on a camera that is down now answers 400. Cameras start at Standard quality and 1280x720 with sense off, and networks start with no profiles or brokers. A profile overrides a camera's own settings, and its video settings when it has some for the model. Deleting a profile or broker takes it off the cameras using it. MV Sense publishes on its topics once it is on with a broker. Broker passwords and CA certificates are kept but never returned. The object detection models, the recording schedule names, the topic list, the default retention, the 30 minute link expiry, the none and tls security modes, the 18 digit ID format and requiring a camera network (or a sensor or wireless one for brokers) are educated guesses.
• Camera wireless profiles need an SSID name, a pre-shared key of 8 to 63 characters in psk mode and an identity in 8021x-radius mode, and the encryption mode follows the auth mode (wpa or wpa-eap). The key is returned in psk mode, and the identity with its password in 8021x-radius mode. A camera takes up to three of its network's profiles as primary, secondary and backup, each in one slot only, and a deleted profile drops out of its slot. Camera permission scopes are a fixed list of five, with guessed IDs, names and levels. Camera roles have unique names, apply scopes to device tags or camera serials, network tags or IDs (legacy numeric IDs too) and the whole organization, and answer an id the spec leaves out. Entries naming a camera or network that left the organization drop out, and entries naming a split network go to its camera part. The 100 profile and role limits and the error wording are educated guesses.
• Each camera has one area and one crossing line boundary, generated from the seed, since the API has no way to draw them. Detection counts are made up per minute, busier in business hours and on weekdays, and zero while the camera is down or dormant; a longer duration counts fewer people in an area. A detections query takes up to 10 ranges of at most 1,440 intervals of 60 seconds or more, starting no more than 31 days ago, and unknown boundary IDs drop out. Custom analytics artifacts have unique names and IDs counting up from 1 per organization. Nothing is uploaded: an artifact reads pending for a minute after its create, then processing for two, then ready (at once with a frozen clock), and its upload URL on custom-analytics-upload.example.com expires after an hour. A camera's custom analytics must name an artifact in its organization to be enabled, parameter values are numbers, an artifact a camera names can't be deleted, and a network whose cameras name one can't move to another organization. Every camera's onboarding status starts complete, a camera swapped in included; reporting credentials sent sets it to complete and not sent to pending onboarding. The boundary names and ID format, the status names and messages, the limits and the error wording are educated guesses.

Sensors (MT)

• Readings are made up per sensor: temperature, humidity, CO2, TVOC, PM2.5, noise, indoor air quality and the MT40's power every 15 minutes, battery, water and the MT40's outlet and lockout switch every hour, and doors and buttons as they happen. Nothing reports rawTemperature, no2, o3, pm10 or an upstream power outage. History is sorted oldest first, then by serial and metric, and goes back a year but no further than the sensor's claim. A sensor that is down reports nothing, and every sensor connects to every AP in its network with a fixed RSSI.
• Alert profiles need a name and at least one condition. A threshold holds one key matching the condition's metric, temperature, humidity and the power metrics need a direction, and the other metrics refuse one. A quality threshold alerts at that level or worse (good, fair, poor, inadequate, with made-up bands per metric), concentrations, noise and power alert above the value, and the air quality score below it. There are no sensor schedules, so a profile naming one is refused and the answer leaves schedule out. Webhook recipients must be HTTP servers of the profile's network, and serials must be sensors in it. The current overview counts sensors whose latest readings have broken a condition for its duration, and the overview over time counts each such run from the readings history, before the profile existed too. Without interval, a t0, t1 or timespan gets the largest interval that fits it; an interval alone covers 7 days, or the interval if longer.
• Commands take 5 seconds (10 for refreshData) after a second in pending, and finish in the POST with a frozen --now. Power commands only run on an MT40, and refreshData on an MT15 or MT40; a command on a sensor that is down fails. Turning the outlet off drops the MT40's power draw to zero from then on, a cycle turns it off for 5 seconds, and a refresh adds a reading of every metric at that moment. Each sensor keeps its newest 500 commands, and the outlet stays as the dropped ones left it. A swapped sensor starts with no commands and its outlet on.
• Livestream roles link a sensor to cameras in its network, and a camera's roles are the sensors naming it. Only one MQTT broker can be enabled for sensor data; enabling a second is refused. The model metrics, quality bands, run times, RSSI values and limits (100 profiles) and the error wording are educated guesses.

Cellular gateways (MG)

• Lab - Kingston in Acme Test Lab has the only cellular gateways: an MG52 with a SIM in sim1 and an eSIM in sim2 (esim in the cellular data views) and an MG21 with a SIM in sim1. Every slot starts with a SIM on Rogers, Bell or Telus, with ICCID, IMSI and MSISDN made up from the device. The primary SIM is active and carries the uplink and all data use, the other reads standby, and SIM failover starts on with a 300 second timeout on the MG52. Changing the primary moves the uplink and its address to the new SIM, which carries data use from then on; data already used stays with the SIM that carried it. APNs start empty (the carrier's default APN is used), up to 3 per SIM; pap and chap need a username, and a password left out keeps the one stored for that APN name.
• The MG52 supports LTE, 5G NSA and 5G SA on every slot and the MG21 LTE only, each with a fixed band list. Band masks replace the masked list for one slot and signal type, and all masks every band. Signal, tower and location telemetry refreshes every 90 minutes; geolocation starts on and reads near where the gateway was placed. Data use is made up per 5 minutes, busiest in the afternoon, and zero while the gateway is down. The current term is the calendar month (UTC) unless the gateway's data profile has a rule for the slot, which sets the term and the limit (its cap in MiB). Data profiles hold one or two rules on different SIM slots and priorities. A removed MG drops out of its profile, and a network whose MGs have a profile can't move to another organization.
• Each MG's LAN comes from its network's subnet pool, which starts as 192.168.0.0/24 in /27 subnets. The pool's first subnet is held back and the MGs take the next ones in the order they joined the network, so the first MG's LAN is 192.168.0.32/27 with the gateway on its first address. Fixed IPs, reserved ranges and port forwarding rules keep their place within the MG's subnet, so they move with it when the pool changes or another MG leaves and the subnets shift. A pool that can't hold every MG of the network, or whose subnets are too small for those addresses, is refused; the deployment mode is always routed. DHCP starts with a 1 day lease and the upstream DNS, and custom DNS servers are required in custom mode and refused otherwise. Connectivity monitoring starts with 8.8.8.8 and takes the same list as on an MX, but doesn't change any reading. Fixed IP assignments, reserved ranges and port forwarding rules stay inside it, sent lists replace the stored ones, and a fixed IP can't fall in a reserved range. A rule with any access reads allowedIps as ["any"]. Uplink bandwidth limits start with no limit and take 1 to 10,000,000 Kbps. MGs show their cellular address and the carrier's DNS in device statuses, uplink addresses and the organization uplink statuses (not the appliance one), can't take a static management IP, and stay out of top devices by usage. The carriers, bands, LAN, defaults, limits, telemetry interval and error wording are educated guesses.
• The MG52's eSIM is the organization's eSIM inventory, its ID in the inventory and swap paths being its EID. It ships with one profile from the carrier its slot started with, matching what the SIMs view shows. Its status is activated or deactivated: a deactivated eSIM reads not inserted in the SIMs view and inactive in the cellular data views, can't be made the primary SIM, and the primary SIM can't be deactivated. Service providers are AT&T, Verizon, T-Mobile, Rogers, Bell and Telus plus a bootstrap provider that takes no accounts, each with two communication plans and three rate plans. Accounts keep their API key without showing it, account IDs are unique in the organization (up to 100 accounts), and plans asked for an unknown account are refused. A swap takes 90 seconds on a running clock and finishes at once on a frozen one; it gives the eSIM a new profile for the target account, or new plans on the profile it already has for that account, and the old profile reads disabled. A request with several swaps answers the first one, the swap status path answers the eSIM's latest swap, and deleting an account leaves its profiles in place. A replacement MG52 comes with its own EID and its eSIM back as shipped. The providers, plans, statuses, swap time and these rules are educated guesses.

Campus gateways

• Lab - Calgary in Acme Test Lab has the only campus gateways: two CW9800H1 in one cluster, Calgary Campus, with a static uplink on man1 (VLAN 1, the gateways keeping their management addresses), a tunnel that reuses the uplink, and one port channel. Both of Calgary's SSIDs use the Campus Gateway IP assignment mode with that cluster. A cluster's gateways show its uplink in device statuses, uplink addresses and the management interface (which can't be changed while the gateway is in a cluster), and campus gateways stay out of top devices by usage.
• Clusters need a name unique in the network, one man1 uplink, one tunnel that either reuses an uplink or names tun1 with its own VLAN and address, at most 4 nameservers, 1 to 8 port channels and at most 8 gateways of the network, none of them in another cluster. A static uplink or a tun1 tunnel needs each gateway's address on that interface, inside its subnet. Lists sent in an update replace the stored ones, each item keeping what it leaves out from the stored item of the same interface, port channel name or serial; port channels keep their ID by name and gateways their member number. Provisioning takes the same body for an existing cluster (404 for an unknown one) plus at most one failover target, another cluster of the organization at priority 1. A cluster an SSID tunnels through can't be deleted, and a deleted cluster's gateways go back to their own addresses; a deleted failover target drops out. A network copy or a cloned organization's copy of a campus gateway network takes its clusters under new IDs without gateways, and the copy's SSIDs, tunnel settings and failover targets name the copied clusters; a same-organization copy without campus gateways keeps tunneling through the source's.
• An SSID in Campus Gateway mode needs campusGateway.cluster.id naming a cluster of the organization, and every SSID of a network tunnels through clusters of one campus gateway network, which is also what the tunnelable list and its excludeSsidNumbers work out. Each AP of the network keeps a tunnel to every gateway of the cluster, its primary (priority 0) spread across the members by its place in the network; a tunnel is up while both ends are, and the AP's tunnelStatus is up, down or up/down. Uptime counts from the last outage in the past 31 days. Tunnel encryption is off until the batch update turns it on for a network and cluster, and its status reads up only on a tunnel that is up. Nothing roams or fails over, so every network tunnels as configured, and there are no local uplink overrides. mDNS gateway settings belong to the SSID and the cluster it tunnels through, start off with no rules, and are refused for an SSID that doesn't tunnel. A network whose SSIDs or clusters link it with another network's cluster can't move to another organization. The defaults, limits, the serial prefix and these rules are educated guesses.

Wireless LAN controllers

• Lab - Halifax in Acme Test Lab has the only controllers: two C9800-40 in an SSO pair with six Catalyst APs joined to it. The APs are records on the pair rather than organization devices, so they only show in the controller views, always joined to the active unit, in local mode with country code CA. Nine days before the emulator starts, chassis 1 failed and reloaded for 7 minutes, so chassis 2 is the active unit and chassis 1 the standby (Standby hot); the reload shows in the device availability views, the interface status changes and every series. Controllers don't go down otherwise. The overview counts clients and joined APs on the active unit only, the standby showing 0, and its management address is the controller's LAN IP. Availability changes list only the active unit of a pair, from its last switchover, with the open interval's endTs null. Redundancy statuses read SSO and are enabled while both units are in the network; a unit removed from the network ends the pair, and the other one takes the APs.
• Interfaces are those of a C9800-40: two 10 Gbps uplinks in Port-channel 1, two disabled ports, the service port (nothing plugged in) and the redundancy port, which is up while both units are. Layer 3 has the management SVI Vlan1 (the LAN IP, VRF Global) and the service port (VRF Mgmt-intf). Clients follow a working day curve at the site, quieter at weekends; a five-minute slot belongs to the unit active when it starts, and a client count over an interval is the most clients in any of its slots. The uplinks carry about 24 kB/s per client each way plus management, Vlan1 carries what the uplinks do, and the redundancy port carries state sync from the active unit to the standby. Layer 2 and layer 3 usage readings are bytes over the window. The usage and CPU histories use 5 minute intervals up to a day, 20 minutes up to a week and hourly beyond, leaving out CPU intervals the controller was down for. Packet counters split the bytes into 900 byte unicast packets plus broadcast and multicast while the link is up. The firmware short name is ios-xe. The serial prefixes, interface names, module, traffic levels, CPU core count (8) and these rules are educated guesses.

Systems Manager (SM)

• Lab - Systems Manager in Acme Test Lab is the only SM network. Its 13 enrolled devices and 7 owners are made up from the seed, with Toronto's SSIDs as their saved and last used Wi-Fi. Enrolled devices aren't Meraki hardware, so they never show in the organization's devices, inventory or licenses; the licenses overview counts them in systemsManager.counts.orgwideEnrolledDevices. Devices list by ID. Without fields a device answers the nine default fields plus serial, ip and notes (as the spec's example does); an unknown field is refused. scope takes its mode first, then the tags.
• Each device installs the profiles whose scope matches its tags and that its platform takes (restrictions and the kiosk profile are iOS only), and an owner's profiles and software are those of their devices. A profile with a certificate payload gives the device an identity certificate from the lab's CA. Command logs start with the enrollment: device information, each profile and managed app installed, and the app and certificate lists, sent by the system (dashboardUser null). One Mac still waits for a managed app, which shows in missingAppsCount.
• Histories cover the last 30 days, oldest first. A device is online in one stretch per day in Toronto time, which is its connectivity row; while online, laptops (Macs and Windows) log a performance sample every hour and their connection every four hours, and check in every 15 minutes, so lastConnected (epoch seconds) is the end of the latest stretch. Cellular use is per UTC day in kilobytes, the current day counting up to now, and cellularDataUsed is their sum. Performance history, desktop logs and cellular use answer an empty list for devices without a desktop agent or a cellular radio, and security centers for anything but Windows. The device kinds, systemType values, apps, profiles, schedules, units and these rules are educated guesses.
• Set actions (check in, lock, reboot, shutdown, tags, move) take devices by ids, serials, wifiMacs or scope, any of which may match; unknown ones are skipped, at least one selector is required, and the answer lists the devices reached. Each sends a command to the device's command log as API Integration, which keeps its newest 1000. Check in and refreshing details set lastConnected to now. Reboot reaches Macs, Windows laptops, Chromebooks and supervised iPhones and iPads; shutdown only Macs and Windows laptops; others are skipped. Locking or wiping a Mac needs pin (0 to 999999). Changing tags installs and removes the profiles whose scope it changes, and only changed devices are answered. Moving needs another SM network in the organization; the device takes its owner along when the new network lacks them and swaps its profiles for that network's. Wiping or unenrolling a device takes it out of the network at once. A network copy or a cloned organization's copy of an SM network takes its profiles (with the same IDs), target groups and trusted access configs, but no devices, owners or user access devices.
• Installing and uninstalling apps take the app IDs of the device's managed apps. Installing one already present is skipped unless force is set; an uninstalled app leaves the software list until it is installed again. An activation lock bypass attempt succeeds for supervised iPhones and iPads and fails for everything else with Activation lock bypass code not known for this device; it is pending with empty data for 20 seconds (at once with a frozen --now) and the network keeps its newest 100. Target groups need a name (unique in the network), default to none, and with withDetails=true add deviceIds and userIds, which the spec doesn't name. These rules, the OS limits, the command names and the ID formats are educated guesses.
• Lab - Systems Manager has two trusted access configs on Toronto's corporate SSID, BYOD Wi-Fi for byod devices and Remote staff for remote ones, and a user access device for each owned device either one covers, made up from the seed. Their connections are fixed after that, but while the device is enrolled in the network the row shows its current name and tags and lastConnectedAt follows its check-ins; once the device is moved, wiped or unenrolled the row stays with the name and tags it had then. Deleting a user access device only removes it from that list.
• An organization with an SM network has an APNS certificate (random bytes in PEM form, not a real certificate) and one VPP account, both worked out from its ID; without one the certificate answers 404 and the account list is empty. The account syncs once a day, every SM network can use it, and its token only shows on the single account. Limited access roles need a unique name, default to all_tags with no tags, list by ID 50 to a page and are copied when the organization is cloned.
• Sentry policies apply a group policy of a network with wireless or an appliance to the devices of an SM network in the same organization whose tags match. The PUT replaces the policies of each network it names, in the order given, and leaves other networks alone; a policy keeps its ID when policyId names it. priority counts up from 1 in that order, so the last one wins, and groupNumber is the group policy's ID. Policies go when their group policy or either network is deleted, follow a split to the wireless (else appliance) part and the SM part, and a network named by one can't move to another organization. A policy whose group policy is gone another way (the network was bound to a template and unbound) stops showing, doesn't stop a move, and doesn't come back when a new group policy takes the same ID.
• PII lookups take exactly one identifier and search the network's clients (by MAC) and its SM devices (MAC, serial, IMEI) and owners (email, username); a device brings in its owner and an owner their devices, and no match answers {}. Bluetooth MACs never match, and there are no organization-wide SM owners, so the 0 key never shows. A PII request is In progress for 60 seconds (done at once with a frozen --now), then Completed with completedAt; the organization keeps the newest 1000, and a network moved to another organization takes its requests along. Delete requests need datasets from the identifier's list (or all), restrict processing requests take only mac, smDeviceId or smUserId, and only restrict processing requests can be deleted. A delete request for an SM device's device or an owner's user dataset removes it from the network when it is made. These rules, the status names, the defaults, the limits and the ID formats are educated guesses.

Devices and live tools

• Device memory sizes, the order of the switch packet counters and what a power supply reports while its switch is down are educated guesses.
• Live tool jobs are new for a second, then running for the tool's time (one second per ping plus one, 3 seconds for ARP and MAC tables, 5 for cable tests and port cycles, 10 for throughput tests, and 1 or 2 for the rest), then complete with what the sim shows at that moment. With a frozen --now a job finishes in the POST. A job on a device that is down fails with The device is unreachable., except ping device, which loses every packet. Each device keeps its newest 100 jobs. Ping reaches the device's LAN, other networks over the VPN and the internet through the MX's active uplink (an MG uses its own cellular uplink, with round trips from about 38 ms), and never answers an unused private address. Ping and ping device run on every device but sensors, which have no IP address, and wireless LAN controllers, which the cloud only monitors. ARP tables run on switches and APs, MAC tables, cable tests, port cycles, port status and power usage on switches, throughput tests on MXs and wake on LAN on MXs and switches, which must carry the VLAN. A cable test finds every pair ok with a length on a cabled port, open on an empty one and not-supported on an uplink port. Port status names interfaces like GigabitEthernet1/0/5, with uplink ports in subslot 1. Power usage adds PoE draw to a per-model base, with a budget of that base plus the PoE budget. Throughput follows the active uplink's type (940, 480 or 85 Mbps for fiber, cable and DSL, up to the model's limit). These run times, the device kinds per tool, the cable, power and throughput numbers, the interface names, the 1 to 3600 second LED duration and the ID format are educated guesses.
• Routing table lookups and summaries run on Secure Routers only (an MX answers 400) and take 3 seconds. The table has the default VRF only: a direct route per VLAN (or the single LAN) and L3 interface, the enabled static routes, a BGP route per subnet an AutoVPN peer exports and a default WAN route through the uplinks' gateways in order. An address lookup returns its longest prefix match, a subnet lookup the routes inside it, and the other filters narrow by type, next hop, VPN peer and VRF. A VRF other than default answers 400. Every route is IPv4. The route types for VPN peers and these rules are educated guesses.