> ## Documentation Index > Fetch the complete documentation index at: https://docs.hashgrid.net/llms.txt > Use this file to discover all available pages before exploring further. # RADIUS and guest portal tools reference > Configure RADIUS authentication profiles, manage local RADIUS accounts, and set up guest portal settings and hotspot packages for your UniFi sites. RADIUS authentication is the backbone of enterprise Wi-Fi security (802.1X) and can also power guest portal login flows. These tools let you manage RADIUS server profiles, create local user accounts for your built-in RADIUS server, configure the guest portal experience, and define hotspot packages — all from a conversation with your AI assistant. ## RADIUS profiles A RADIUS profile tells UniFi where to send authentication requests. You can point it at an external RADIUS server or at UniFi's built-in RADIUS server. ### `list_radius_profiles` Returns all RADIUS profiles configured for a site. The site identifier. *** ### `get_radius_profile` Returns the details of a single RADIUS profile. The site identifier. The RADIUS profile identifier. *** ### `create_radius_profile` Creates a new RADIUS profile pointing to an authentication server. The site identifier. A display name for this profile (e.g., `"Corporate 802.1X"`). The IP address or hostname of the RADIUS authentication server. The shared secret used to authenticate requests to the RADIUS server. The authentication port. Defaults to `1812`. IP address or hostname of a separate RADIUS accounting server. Optional. The accounting port. Defaults to `1813`. Shared secret for the accounting server if different from the auth secret. When `true`, the `auth_secret` is used for accounting as well. Defaults to `true`. When `true`, allows the RADIUS server to dynamically assign VLANs via tunnel attributes. Defaults to `false`. Must be `true` to create the profile. Preview the profile that would be created without applying it. Shared secrets are automatically redacted in dry-run output and audit logs. They are never written to log files in plain text. ```python Example: 802.1X profile with VLAN assignment theme={null} create_radius_profile( site_id="default", name="Corporate 802.1X", auth_server="192.168.1.50", auth_secret="my-strong-secret", auth_port=1812, acct_server="192.168.1.50", acct_port=1813, use_same_secret=True, vlan_enabled=True, confirm=True ) ``` *** ### `update_radius_profile` Updates an existing RADIUS profile. Only the fields you supply are changed. The site identifier. The RADIUS profile identifier. New profile name. New authentication server IP or hostname. New shared secret for authentication. New authentication port. New accounting server IP or hostname. New accounting port. New accounting server secret. Enable or disable VLAN assignment. Enable or disable the profile. Must be `true` to apply. Preview changes without applying them. *** ### `delete_radius_profile` Permanently deletes a RADIUS profile. Ensure no active SSIDs reference this profile before deleting. The site identifier. The RADIUS profile identifier. Must be `true` to delete. Preview the deletion without applying it. *** ## RADIUS accounts RADIUS accounts are local credentials stored on the UniFi controller. They are used with UniFi's built-in RADIUS server for 802.1X or guest portal authentication without an external server. ### `list_radius_accounts` Returns all local RADIUS accounts for a site. Passwords are always redacted in the response. The site identifier. *** ### `get_radius_account` Returns the details of a single RADIUS account. The password field is always redacted. The site identifier. The account identifier. *** ### `create_radius_account` Creates a new local RADIUS user account. When `vlan_id` is supplied, the appropriate RADIUS tunnel attributes (`tunnel_type=13`, `tunnel_medium_type=6`) are set automatically. The site identifier. The login username for this account. The account password. This is stored securely and never returned in plain text after creation. If provided, the account will be assigned to this VLAN on successful authentication. Automatically sets the RADIUS tunnel type and medium attributes. RADIUS tunnel type override. Defaults to `13` (VLAN) when `vlan_id` is provided. RADIUS tunnel medium type override. Defaults to `6` (802) when `vlan_id` is provided. Whether the account is active. Defaults to `true`. An optional administrative note. Must be `true` to create the account. Preview creation without applying it. The password is redacted in dry-run output. *** ### `update_radius_account` Updates an existing RADIUS account. Only the fields you supply are changed. The site identifier. The account identifier. New username. New password. New VLAN assignment. New tunnel type. New tunnel medium type. Enable or disable the account. Updated admin note. Must be `true` to apply. Preview changes without applying them. *** ### `delete_radius_account` Permanently deletes a RADIUS account. The site identifier. The account identifier. Must be `true` to delete. Preview the deletion without applying it. *** ## Guest portal ### `get_guest_portal_config` Returns the current guest portal configuration for a site. The site identifier. *** ### `configure_guest_portal` Updates the guest portal settings. Only the fields you supply are changed. The site identifier. The title shown on the guest login page. The authentication method. Accepted values: `none`, `password`, `voucher`, `radius`, `external`. A shared password for the portal (used when `auth_method` is `password`). Redacted in logs. How long a guest session lasts before requiring re-authentication, in minutes. When `true`, guests are redirected to a custom URL after login. The URL guests are sent to after successful authentication. Require guests to accept terms of service before connecting. The full text of your terms of service. Must be `true` to apply changes. Preview changes without applying them. *** ## Hotspot packages Hotspot packages define timed access tiers that guests can purchase or be assigned. Each package specifies a duration and optional bandwidth limits. ### `list_hotspot_packages` Returns all hotspot packages for a site. The site identifier. *** ### `get_hotspot_package` Returns the details of a single hotspot package. The site identifier. The package identifier. *** ### `create_hotspot_package` Creates a new hotspot access package. The site identifier. A display name for the package (e.g., `"1-Hour Basic"`). How long the package grants access, in minutes. Download speed cap in kilobits per second. Omit for unlimited. Upload speed cap in kilobits per second. Omit for unlimited. Total download data quota in megabytes. Omit for unlimited. Total upload data quota in megabytes. Omit for unlimited. Package price (for display/record-keeping purposes). Currency code for the price. Defaults to `"USD"`. Must be `true` to create the package. Preview creation without applying it. *** ### `update_hotspot_package` Updates an existing hotspot package. Only the fields you supply are changed. The site identifier. The package identifier. New package name. New duration in minutes. New download speed cap. New upload speed cap. New download data quota. New upload data quota. New price. New currency code. Enable or disable the package. Must be `true` to apply. Preview changes without applying them. *** ### `delete_hotspot_package` Permanently deletes a hotspot package. The site identifier. The package identifier. Must be `true` to delete. Preview the deletion without applying it. *** ## Example: 802.1X with VLAN assignment This walkthrough configures a RADIUS profile pointing at an external FreeRADIUS server and creates a local account for a device that cannot use certificates. ```python theme={null} # Step 1: Create the RADIUS profile create_radius_profile( site_id="default", name="Corporate 802.1X", auth_server="10.0.0.50", auth_secret="supersecret", auth_port=1812, acct_port=1813, use_same_secret=True, vlan_enabled=True, # Allow server to assign VLANs dynamically confirm=True ) # Step 2: Create a local account for a device using PAP (no cert) create_radius_account( site_id="default", username="printer-lobby", password="device-password", vlan_id=20, # Automatically sets tunnel_type=13, tunnel_medium_type=6 note="Lobby printer — no 802.1X cert support", confirm=True ) ``` The RADIUS profile must be linked to an SSID or wired port profile in the UniFi Console UI. The tools above manage only the RADIUS profile configuration itself. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.