RADIUS profiles
A RADIUS profile tells UniFi where to send authentication requests. You can point it at an external RADIUS server or at UniFi’s built-in RADIUS server.list_radius_profiles
Returns all RADIUS profiles configured for a site.
string
required
The site identifier.
get_radius_profile
Returns the details of a single RADIUS profile.
string
required
The site identifier.
string
required
The RADIUS profile identifier.
create_radius_profile
Creates a new RADIUS profile pointing to an authentication server.
string
required
The site identifier.
string
required
A display name for this profile (e.g.,
"Corporate 802.1X").string
required
The IP address or hostname of the RADIUS authentication server.
string
required
The shared secret used to authenticate requests to the RADIUS server.
integer
The authentication port. Defaults to
1812.string
IP address or hostname of a separate RADIUS accounting server. Optional.
integer
The accounting port. Defaults to
1813.string
Shared secret for the accounting server if different from the auth secret.
boolean
When
true, the auth_secret is used for accounting as well. Defaults to true.boolean
When
true, allows the RADIUS server to dynamically assign VLANs via tunnel attributes. Defaults to false.boolean
required
Must be
true to create the profile.boolean
Preview the profile that would be created without applying it.
Shared secrets are automatically redacted in dry-run output and audit logs. They are never written to log files in plain text.
Example: 802.1X profile with VLAN assignment
update_radius_profile
Updates an existing RADIUS profile. Only the fields you supply are changed.
string
required
The site identifier.
string
required
The RADIUS profile identifier.
string
New profile name.
string
New authentication server IP or hostname.
string
New shared secret for authentication.
integer
New authentication port.
string
New accounting server IP or hostname.
integer
New accounting port.
string
New accounting server secret.
boolean
Enable or disable VLAN assignment.
boolean
Enable or disable the profile.
boolean
required
Must be
true to apply.boolean
Preview changes without applying them.
delete_radius_profile
Permanently deletes a RADIUS profile. Ensure no active SSIDs reference this profile before deleting.
string
required
The site identifier.
string
required
The RADIUS profile identifier.
boolean
required
Must be
true to delete.boolean
Preview the deletion without applying it.
RADIUS accounts
RADIUS accounts are local credentials stored on the UniFi controller. They are used with UniFi’s built-in RADIUS server for 802.1X or guest portal authentication without an external server.list_radius_accounts
Returns all local RADIUS accounts for a site. Passwords are always redacted in the response.
string
required
The site identifier.
get_radius_account
Returns the details of a single RADIUS account. The password field is always redacted.
string
required
The site identifier.
string
required
The account identifier.
create_radius_account
Creates a new local RADIUS user account. When vlan_id is supplied, the appropriate RADIUS tunnel attributes (tunnel_type=13, tunnel_medium_type=6) are set automatically.
string
required
The site identifier.
string
required
The login username for this account.
string
required
The account password. This is stored securely and never returned in plain text after creation.
integer
If provided, the account will be assigned to this VLAN on successful authentication. Automatically sets the RADIUS tunnel type and medium attributes.
integer
RADIUS tunnel type override. Defaults to
13 (VLAN) when vlan_id is provided.integer
RADIUS tunnel medium type override. Defaults to
6 (802) when vlan_id is provided.boolean
Whether the account is active. Defaults to
true.string
An optional administrative note.
boolean
required
Must be
true to create the account.boolean
Preview creation without applying it. The password is redacted in dry-run output.
update_radius_account
Updates an existing RADIUS account. Only the fields you supply are changed.
string
required
The site identifier.
string
required
The account identifier.
string
New username.
string
New password.
integer
New VLAN assignment.
integer
New tunnel type.
integer
New tunnel medium type.
boolean
Enable or disable the account.
string
Updated admin note.
boolean
required
Must be
true to apply.boolean
Preview changes without applying them.
delete_radius_account
Permanently deletes a RADIUS account.
string
required
The site identifier.
string
required
The account identifier.
boolean
required
Must be
true to delete.boolean
Preview the deletion without applying it.
Guest portal
get_guest_portal_config
Returns the current guest portal configuration for a site.
string
required
The site identifier.
configure_guest_portal
Updates the guest portal settings. Only the fields you supply are changed.
string
required
The site identifier.
string
The title shown on the guest login page.
string
The authentication method. Accepted values:
none, password, voucher, radius, external.string
A shared password for the portal (used when
auth_method is password). Redacted in logs.integer
How long a guest session lasts before requiring re-authentication, in minutes.
boolean
When
true, guests are redirected to a custom URL after login.string
The URL guests are sent to after successful authentication.
boolean
Require guests to accept terms of service before connecting.
string
The full text of your terms of service.
boolean
required
Must be
true to apply changes.boolean
Preview changes without applying them.
Hotspot packages
Hotspot packages define timed access tiers that guests can purchase or be assigned. Each package specifies a duration and optional bandwidth limits.list_hotspot_packages
Returns all hotspot packages for a site.
string
required
The site identifier.
get_hotspot_package
Returns the details of a single hotspot package.
string
required
The site identifier.
string
required
The package identifier.
create_hotspot_package
Creates a new hotspot access package.
string
required
The site identifier.
string
required
A display name for the package (e.g.,
"1-Hour Basic").integer
required
How long the package grants access, in minutes.
integer
Download speed cap in kilobits per second. Omit for unlimited.
integer
Upload speed cap in kilobits per second. Omit for unlimited.
integer
Total download data quota in megabytes. Omit for unlimited.
integer
Total upload data quota in megabytes. Omit for unlimited.
number
Package price (for display/record-keeping purposes).
string
Currency code for the price. Defaults to
"USD".boolean
required
Must be
true to create the package.boolean
Preview creation without applying it.
update_hotspot_package
Updates an existing hotspot package. Only the fields you supply are changed.
string
required
The site identifier.
string
required
The package identifier.
string
New package name.
integer
New duration in minutes.
integer
New download speed cap.
integer
New upload speed cap.
integer
New download data quota.
integer
New upload data quota.
number
New price.
string
New currency code.
boolean
Enable or disable the package.
boolean
required
Must be
true to apply.boolean
Preview changes without applying them.
delete_hotspot_package
Permanently deletes a hotspot package.
string
required
The site identifier.
string
required
The package identifier.
boolean
required
Must be
true to delete.boolean
Preview the deletion without applying it.
Example: 802.1X with VLAN assignment
This walkthrough configures a RADIUS profile pointing at an external FreeRADIUS server and creates a local account for a device that cannot use certificates.The RADIUS profile must be linked to an SSID or wired port profile in the UniFi Console UI. The tools above manage only the RADIUS profile configuration itself.