Cisco Meraki setup

ConfigView pulls Meraki data through one Dashboard API key. The key belongs to a dashboard administrator and inherits that admin’s access — so the inventory follows the admin’s organization membership, not a per-network install. You will end up with 1 secret in ConfigView (MERAKI_API_KEY) when setup is complete. This integration is built for Wi-Fi troubleshooting. Alongside the SSID and RF configuration, it captures the evidence you actually need when someone says “the wifi is broken”: which step of the connection failed (association, authentication, DHCP, DNS), per-client and per-AP latency and packet loss, channel utilization, rogue APs, mesh health, and the raw wireless event log.

⚠️ Required: a full-organization read-only admin
A Meraki API key inherits the permissions of the admin who generated it. ConfigView requires an admin with organization-wide access — read-only is enough, and is what we recommend. If you use a network-scoped admin instead:

Networks outside that admin’s scope are missing from the inventory entirely

Organizations, Assurance Alerts, and every byDevice / byNetwork org-wide collector return partial data or 403

The gaps are silent — they look like “we have no APs there” rather than an error

Create the key from a full organization admin. Read-only is sufficient for every script in this integration; ConfigView never writes to Meraki.

Step 1: Enable Dashboard API access

API access is off by default on a Meraki organization.

Sign in to the Meraki dashboard as a full organization admin
Go to Organization → Settings
Scroll to Dashboard API access
Tick Enable access to the Cisco Meraki Dashboard API
Click Save changes

Repeat this for every organization you want ConfigView to inventory. If the key can see an org but API access is switched off there, every call against it returns 404 — the health check flags this explicitly.

Step 2: Generate the API key

Still signed in as that admin, click your profile name (top right) → My profile
Scroll to the API access section
Click Generate new API key
Copy the key immediately — it is a 40-character hex string and it is shown only once. Meraki will not display it again; you would have to revoke and regenerate.

Use a dedicated service admin. The key dies with the admin account that owns it. If you generate it from a person’s account and that person leaves, ingestion stops. Create a dedicated read-only org admin (for example configview-api@yourcompany.com), and generate the key from there.

Step 3: Add the secret to ConfigView

Go to your ConfigView dashboard: https://{companyname}.configview.com/admin/secret/
Click Add Secret
Secret name: MERAKI_API_KEY
Secret value: Paste the 40-character key from Step 2
Click Save

Step 4: Enable the Meraki scripts

Go to: https://{companyname}.configview.com/admin/cron/
You should see meraki in the list of available apps
Enable scripts. Parents must be enabled before children — ConfigView wires the dependencies automatically, but load order matters for first-run timing.

Foundation — enable these first

Everything else reads its context from these four tables.

Script	Notes
Organizations	Every org the API key can see. All other scripts depend on this.
Networks	All networks per org. The wireless collectors filter this to networks with a `wireless` product type. Depends on Organizations.
Devices	Full hardware inventory (MR, MS, MX, MV…). The per-AP scripts read the `wireless` rows. Depends on Organizations.
Device Statuses	Online / offline / alerting / dormant, plus public IP, uplink IP, gateway and DNS per device. Depends on Organizations.

Wi-Fi troubleshooting — the ones that answer “why is it broken”

Script	Notes
Failed Connections	The single most useful table here. One row per failed client connection with the exact `failure_step` — `assoc`, `auth`, `dhcp`, or `dns` — plus client MAC, AP serial, SSID and VLAN. Start every Wi-Fi investigation here.
Connection Stats (Network)	Aggregate success vs. failure counts per network over the window.
Connection Stats by Client / by AP	The same breakdown attributed to a specific client MAC or AP serial — tells you whether a problem is one laptop or one access point.
Latency Stats (Network) / by Client / by AP	Average latency split by traffic class (background, best-effort, video, voice). Voice latency is the one users feel.
Packet Loss by AP / by Client	Upstream and downstream loss counts and percentages.
Channel Utilization by AP	How congested each band is per AP, right now.
Channel Utilization History	10-minute utilization buckets over the last day — use this to find when it degraded. Meraki only accepts a 600-second resolution on this endpoint.
Air Marshal (Rogue APs)	Every foreign SSID/BSSID your APs can hear, with channel, encryption, and whether it is contained. The usual culprit behind unexplained interference.
Assurance Alerts	Meraki’s own health alerts, with severity and resolution state.
Wireless Event Log	Raw wireless events — association, deauthentication, DHCP, 802.1X. The most granular record available.
Mesh Statuses	Mesh route and performance per repeater. Only meaningful on networks with mesh APs.
AP CPU Load	Time-series CPU load per AP. A pegged AP drops clients.
AP Ethernet & PoE Status	Uplink negotiation, duplex, speed, and PoE standard per AP port. Catches the “AP keeps rebooting” caused by an underpowered PoE switch port.
Client Counts by AP	Online client count per AP — reveals uneven load.
AP Live Radio Status	Live per-radio BSSID, channel, width, and power.
SSID Statuses by AP (BSSIDs)	Org-wide view of which AP is broadcasting which SSID, on what channel, at what power.

Wireless configuration — the “settings” half

Script	Notes
SSIDs	All 15 SSID slots per network: auth mode, encryption, VLAN tagging, band selection, minimum bitrate, bandwidth limits, RADIUS servers, 802.11w/r. The per-SSID scripts below depend on this and only walk SSIDs where `enabled = 1`.
Wireless Settings	Network-level meshing, IPv6 bridging, LED state, regulatory domain and 6 GHz permission.
RF Profiles	Per-band min/max power, valid auto channels, channel width, RX-SOP, band steering, client balancing.
RF Profile Assignments by AP	Which RF profile each AP actually has applied.
AP Radio Settings	Per-AP manual channel and target power overrides. A manual override left on one AP is a classic root cause — this table is how you find it.
Radio RRM by Network	Auto-RF / RRM state per network.
SSID L3 Firewall Rules / L7 Firewall Rules	Per-SSID rules, in order. Answers “why can’t this SSID reach that subnet”.
SSID Traffic Shaping	Per-client bandwidth limits and DSCP/PCP tagging rules.
SSID Splash Settings	Captive portal configuration per SSID.
Splash Login Attempts	Who authenticated against the captive portal, and whether it succeeded.
SSID Identity PSKs	iPSK entries with their group policy. Passphrases are never stored — see the note below.
SSID EAP Override	EAP/EAPOL timeouts and retry counts. Tune these when 802.1X clients fail intermittently.
SSID Availability Schedules	Time windows when each SSID is broadcast.
SSID Device-Type Policies	Per-device-type group policy assignment.
SSID VPN / Concentrator	Concentrator, failover, and split-tunnel configuration.
SSID Bonjour Forwarding	Bonjour/mDNS forwarding rules — relevant to AirPlay and printer discovery complaints.
SSID Hotspot 2.0	Passpoint configuration.
AP Ethernet Port Profiles	Port profile definitions applied to AP ethernet ports.
Bluetooth Settings	BLE scanning and advertising per network.
Alternate Management Interface	Out-of-band management VLAN and protocols.
Air Marshal Rules / Air Marshal Settings	Org-wide rogue-AP containment rules and the default policy per network.
Clients	Every client seen in the window: MAC, IP, OS, manufacturer, VLAN, SSID, usage, and which AP it last attached to.

Credentials are never stored

Two fields are deliberately dropped before anything is written to the database:

psk on meraki_wireless_ssids — the pre-shared key for PSK SSIDs
passphrase on meraki_wireless_ssid_identity_psks — iPSK passphrases

They are stripped from the flattened columns and from the raw_json snapshot, and replaced with [redacted]. A ConfigView database dump can therefore never become a Wi-Fi passphrase dump. If you need to verify a PSK, use the Meraki dashboard.

Rate limits and scheduling

Meraki allows 10 requests per second per organization (burst +10, max 30 in 2 seconds) and 100 requests/second per source IP. That ceiling is shared with every other application hitting the same org, including Meraki’s own integrations. ConfigView paces evenly rather than bursting, defaulting to 5 requests/second — half the budget, leaving room for whatever else touches the org. 429 responses carry a Retry-After header, which the collectors honour before retrying. Cost scales with the size of the estate:

Org-wide collectors — 1 call each, regardless of size
Per-network collectors — 1 call per wireless network
Per-AP collectors — 1 call per access point (2 scripts)
Per-SSID collectors — 1 call per enabled SSID per network (11 scripts). Disabled SSID slots are skipped, which is usually a 5× saving

For a site with 10 networks, 3 enabled SSIDs each, and 100 APs, a full sweep is roughly 800 calls — under three minutes. Daily is a sensible cadence for the configuration scripts; the health and event scripts are worth running more often, since they look back over a 24-hour window. The time-windowed scripts (failed connections, connection and latency stats, packet loss, Air Marshal, clients, channel utilization history) use a 24-hour lookback. Each run stores a fresh snapshot under its own run_at, so history accumulates in the table even though each call only asks for a day.

Watch these three for row growth

Most tables here are small — tens to hundreds of rows per run. Three are not, and they are the ones to re-schedule or disable if the database grows faster than you want:

Table	Rows per run	Why
`meraki_air_marshal`	thousands to tens of thousands	Every foreign BSSID your APs can hear. In a dense office building this is dominated by neighbouring networks, not yours.
`meraki_wireless_ap_cpu_load`	~260 per AP	A 5-minute CPU sample series per access point over the 24-hour window.
`meraki_network_health_channel_utilization`	~144 per AP radio	10-minute buckets over 24 hours, per radio.

They are genuinely useful, so they are enabled by default — but on a daily schedule they are the bulk of your row growth. If Air Marshal is noisy for you, a weekly cadence still catches a persistent rogue.

Table reference

Table	Meraki endpoint	Key columns
`meraki_organizations`	`GET /organizations`	org_id, org_name, url, api_enabled, licensing_model, cloud_region_name, cloud_region_host
`meraki_networks`	`GET /organizations/{org_id}/networks`	network_id, network_name, product_types, time_zone, tags, enrollment_string, url
`meraki_devices`	`GET /organizations/{org_id}/devices`	network_id, serial, name, model, mac, lan_ip, firmware
`meraki_device_statuses`	`GET /organizations/{org_id}/devices/statuses`	network_id, serial, name, mac, model, product_type, status
`meraki_wireless_ssid_statuses`	`GET /organizations/{org_id}/wireless/ssids/statuses/byDevice`	network_id, network_name, serial, device_name, bssid, ssid_name, ssid_number
`meraki_wireless_client_counts`	`GET /organizations/{org_id}/wireless/clients/overview/byDevice`	network_id, serial, clients_online
`meraki_wireless_channel_utilization`	`GET /organizations/{org_id}/wireless/devices/channelUtilization/byDevice`	network_id, serial, mac, band, wifi_percentage, non_wifi_percentage, total_percentage
`meraki_wireless_packet_loss_by_device`	`GET /organizations/{org_id}/wireless/devices/packetLoss/byDevice`	network_id, network_name, serial, device_name, device_mac, downstream_total, downstream_lost
`meraki_wireless_packet_loss_by_client`	`GET /organizations/{org_id}/wireless/devices/packetLoss/byClient`	network_id, network_name, client_id, client_mac, downstream_total, downstream_lost, downstream_loss_pct
`meraki_wireless_ap_ethernet_statuses`	`GET /organizations/{org_id}/wireless/devices/ethernet/statuses`	network_id, serial, device_name, power_mode, ac_connected, poe_connected, aggregation_enabled
`meraki_wireless_rf_profile_assignments`	`GET /organizations/{org_id}/wireless/rfProfiles/assignments/byDevice`	network_id, serial, device_name, model, rf_profile_id, rf_profile_name, is_indoor_default
`meraki_assurance_alerts`	`GET /organizations/{org_id}/assurance/alerts`	alert_id, network_id, network_name, category_type, alert_type, title, description
`meraki_air_marshal_rules`	`GET /organizations/{org_id}/wireless/airMarshal/rules`	network_id, rule_id, rule_type, match_string, match_type, created_at, updated_at
`meraki_air_marshal_settings`	`GET /organizations/{org_id}/wireless/airMarshal/settings/byNetwork`	network_id, default_policy
`meraki_wireless_radio_rrm`	`GET /organizations/{org_id}/wireless/radio/rrm/byNetwork`	network_id, network_name, time_zone, busy_hour_json, channel_json, fra_json, ai_json
`meraki_wireless_ap_cpu_load`	`GET /organizations/{org_id}/wireless/devices/system/cpu/load/history`	network_id, network_name, serial, device_name, model, mac, cpu_count
`meraki_wireless_settings`	`GET /networks/{network_id}/wireless/settings`	meshing_enabled, ipv6_bridge_enabled, location_analytics_enabled, upgrade_strategy, upgrade_predownload_enabled, led_lights_on, multicast_to_unicast_enabled
`meraki_wireless_ssids`	`GET /networks/{network_id}/wireless/ssids`	ssid_number, name, enabled, splash_page, auth_mode, encryption_mode, wpa_encryption_mode
`meraki_wireless_rf_profiles`	`GET /networks/{network_id}/wireless/rfProfiles`	rf_profile_id, name, client_balancing_enabled, min_bitrate_type, band_selection_type, band_operation_mode, band_steering_enabled
`meraki_wireless_failed_connections`	`GET /networks/{network_id}/wireless/failedConnections`	ts, client_mac, serial, ssid_number, vlan, radio, failure_step
`meraki_wireless_connection_stats`	`GET /networks/{network_id}/wireless/connectionStats`	assoc, auth, dhcp, dns, success, timespan_seconds
`meraki_wireless_client_connection_stats`	`GET /networks/{network_id}/wireless/clients/connectionStats`	client_mac, assoc, auth, dhcp, dns, success, timespan_seconds
`meraki_wireless_device_connection_stats`	`GET /networks/{network_id}/wireless/devices/connectionStats`	serial, assoc, auth, dhcp, dns, success, timespan_seconds
`meraki_wireless_latency_stats`	`GET /networks/{network_id}/wireless/latencyStats`	background_avg_ms, best_effort_avg_ms, video_avg_ms, voice_avg_ms, background_distribution_json, best_effort_distribution_json, video_distribution_json
`meraki_wireless_client_latency_stats`	`GET /networks/{network_id}/wireless/clients/latencyStats`	client_mac, background_avg_ms, best_effort_avg_ms, video_avg_ms, voice_avg_ms, timespan_seconds
`meraki_wireless_device_latency_stats`	`GET /networks/{network_id}/wireless/devices/latencyStats`	serial, background_avg_ms, best_effort_avg_ms, video_avg_ms, voice_avg_ms, timespan_seconds
`meraki_air_marshal`	`GET /networks/{network_id}/wireless/airMarshal`	ssid, bssid, contained, channels, encryption, types, manufacturers
`meraki_wireless_mesh_statuses`	`GET /networks/{network_id}/wireless/meshStatuses`	serial, mesh_route, latest_mbps, latest_metric, latest_usage_percentage
`meraki_network_health_channel_utilization`	`GET /networks/{network_id}/networkHealth/channelUtilization`	serial, model, tags, radio, start_time, end_time, utilization_total
`meraki_clients`	`GET /networks/{network_id}/clients`	client_id, mac, ip, ip6, ip6_local, description, user
`meraki_wireless_events`	`GET /networks/{network_id}/events`	occurred_at, event_type, description, category, client_id, client_description, client_mac
`meraki_splash_login_attempts`	`GET /networks/{network_id}/splashLoginAttempts`	name, login, ssid, login_at, gateway_device_mac, client_mac, client_id
`meraki_wireless_bluetooth_settings`	`GET /networks/{network_id}/wireless/bluetooth/settings`	scanning_enabled, advertising_enabled, uuid, major_minor_assignment_mode, major, minor, esl_enabled
`meraki_wireless_alternate_mgmt_interface`	`GET /networks/{network_id}/wireless/alternateManagementInterface`	enabled, vlan_id, protocols, access_points_json
`meraki_wireless_ethernet_port_profiles`	`GET /networks/{network_id}/wireless/ethernet/ports/profiles`	profile_id, name, is_default, ports_json, usb_ports_json
`meraki_wireless_radio_settings`	`GET /devices/{serial}/wireless/radio/settings`	rf_profile_id, two_four_channel, two_four_target_power, five_channel, five_channel_width, five_target_power
`meraki_wireless_ap_status`	`GET /devices/{serial}/wireless/status`	ssid_name, ssid_number, enabled, band, bssid, channel, channel_width
`meraki_wireless_ssid_l3_firewall_rules`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/firewall/l3FirewallRules`	rule_index, comment, policy, protocol, ip_ver, dest_port, dest_cidr
`meraki_wireless_ssid_l7_firewall_rules`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/firewall/l7FirewallRules`	rule_index, policy, rule_type, value
`meraki_wireless_ssid_traffic_shaping`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/trafficShaping/rules`	traffic_shaping_enabled, default_rules_enabled, rule_index, definitions_json, per_client_limit_up, per_client_limit_down, per_client_settings
`meraki_wireless_ssid_splash_settings`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/splash/settings`	splash_page, use_splash_url, splash_url, splash_timeout, use_redirect_url, redirect_url, welcome_message
`meraki_wireless_ssid_identity_psks`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/identityPsks`	identity_psk_id, name, group_policy_id, email, wifi_personal_network_id, expires_at
`meraki_wireless_ssid_schedules`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/schedules`	enabled, range_index, start_day, start_time, end_day, end_time
`meraki_wireless_ssid_eap_override`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/eapOverride`	timeout, max_retries, identity_retries, identity_timeout, eapol_key_retries, eapol_key_timeout_ms
`meraki_wireless_ssid_device_type_policies`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/deviceTypeGroupPolicies`	enabled, device_type, device_policy, group_policy_id
`meraki_wireless_ssid_hotspot20`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/hotspot20`	enabled, operator_name, venue_name, venue_type, network_access_type, domains, roam_consort_ois
`meraki_wireless_ssid_bonjour_forwarding`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/bonjourForwarding`	enabled, exception_enabled, rule_index, description, vlan_id, services
`meraki_wireless_ssid_vpn`	`GET /networks/{network_id}/wireless/ssids/{ssid_number}/vpn`	concentrator_network_id, concentrator_vlan_id, concentrator_name, failover_request_ip, failover_heartbeat_interval, failover_idle_timeout, split_tunnel_enabled

Every table also carries org_id, org_name, a raw_json copy of the source object, and a run_at batch timestamp. Network-scoped tables add network_id and network_name; per-AP tables add serial and device_name; per-SSID tables add ssid_number and ssid_name.

Troubleshooting

Everything returns 404. Dashboard API access is not enabled on that organization. See Step 1 — it is a per-org switch, and enabling it in one org does nothing for the others. 401 on every call. The key was revoked, or the admin account that owns it was deactivated. Generate a new one and update the secret. Some networks are missing. The key belongs to a network-scoped admin. Regenerate it from a full organization admin. Wireless tables are empty but meraki_devices has rows. Check product_types on meraki_networks — the wireless collectors only walk networks that include wireless. A network of MX/MS hardware with no MR access points is correctly skipped. Per-SSID tables are empty. They depend on meraki_wireless_ssids and only walk SSIDs with enabled = 1. Run the SSIDs script first; if every SSID slot is disabled, there is genuinely nothing to fetch. A single script logs 400/403/404 and continues. That is deliberate. Hotspot 2.0, Bluetooth, mesh, and the alternate management interface are not supported on every hardware generation or licence tier, so an unavailable endpoint is skipped with a log line rather than failing the whole run.

What you can’t ingest with this setup

Per-client connectivity events (GET /networks/{id}/wireless/clients/{clientId}/connectivityEvents). One call per client — infeasible to sweep for an estate of any size. The network-level Wireless Event Log covers the same ground in aggregate. Open a feature request if you need per-client depth for a named investigation.
Live tools (ping, cable test, throughput test, packet capture). These are on-demand actions against a device, not inventory — they mutate state and take seconds to minutes to return. Out of scope for a scheduled collector.
Signal-quality, client-count, data-rate and usage history. Deliberately left out of this pass to keep row growth predictable. The Channel Utilization History script is included as the representative time-series. Request the others if you want them.
Non-wireless product families. Switch ports, appliance/MX firewall rules, VPN status, camera and sensor data are all available in the Meraki API but out of scope here — this integration is scoped to Wi-Fi. meraki_devices still inventories the full hardware estate.

Platform

Integrations

⚠️ Required: a full-organization read-only admin

Step 1: Enable Dashboard API access

Step 2: Generate the API key

Step 3: Add the secret to ConfigView

Step 4: Enable the Meraki scripts

Foundation — enable these first

Wi-Fi troubleshooting — the ones that answer “why is it broken”

Wireless configuration — the “settings” half

Credentials are never stored

Rate limits and scheduling

Watch these three for row growth

Table reference

Troubleshooting

What you can’t ingest with this setup

​⚠️ Required: a full-organization read-only admin

​Step 1: Enable Dashboard API access

​Step 2: Generate the API key

​Step 3: Add the secret to ConfigView

​Step 4: Enable the Meraki scripts

​Foundation — enable these first

​Wi-Fi troubleshooting — the ones that answer “why is it broken”

​Wireless configuration — the “settings” half

​Credentials are never stored

​Rate limits and scheduling

​Watch these three for row growth

​Table reference

​Troubleshooting

​What you can’t ingest with this setup

⚠️ Required: a full-organization read-only admin

Step 1: Enable Dashboard API access

Step 2: Generate the API key

Step 3: Add the secret to ConfigView

Step 4: Enable the Meraki scripts

Foundation — enable these first

Wi-Fi troubleshooting — the ones that answer “why is it broken”

Wireless configuration — the “settings” half

Credentials are never stored

Rate limits and scheduling

Watch these three for row growth

Table reference

Troubleshooting

What you can’t ingest with this setup