> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Cisco Meraki setup ConfigView pulls Meraki data through **one Dashboard API key**. The key belongs to a dashboard administrator and inherits that admin's access — so the inventory follows the admin's organization membership, not a per-network install. You will end up with **1 secret** in ConfigView (`MERAKI_API_KEY`) when setup is complete. This integration is built for **Wi-Fi troubleshooting**. Alongside the SSID and RF configuration, it captures the evidence you actually need when someone says "the wifi is broken": which step of the connection failed (association, authentication, DHCP, DNS), per-client and per-AP latency and packet loss, channel utilization, rogue APs, mesh health, and the raw wireless event log. > ## ⚠️ Required: a full-organization read-only admin > > A Meraki API key inherits the permissions of the admin who generated it. **ConfigView requires an admin with organization-wide access** — read-only is enough, and is what we recommend. > > If you use a network-scoped admin instead: > > * Networks outside that admin's scope are missing from the inventory entirely > * `Organizations`, `Assurance Alerts`, and every `byDevice` / `byNetwork` org-wide collector return partial data or 403 > * The gaps are silent — they look like "we have no APs there" rather than an error > > Create the key from a **full organization** admin. Read-only is sufficient for every script in this integration; ConfigView never writes to Meraki. *** ## Step 1: Enable Dashboard API access API access is off by default on a Meraki organization. 1. Sign in to the Meraki dashboard as a **full organization admin** 2. Go to **Organization → Settings** 3. Scroll to **Dashboard API access** 4. Tick **Enable access to the Cisco Meraki Dashboard API** 5. Click **Save changes** Repeat this for **every organization** you want ConfigView to inventory. If the key can see an org but API access is switched off there, every call against it returns 404 — the health check flags this explicitly. *** ## Step 2: Generate the API key 1. Still signed in as that admin, click your **profile name** (top right) → **My profile** 2. Scroll to the **API access** section 3. Click **Generate new API key** 4. Copy the key immediately — it is a 40-character hex string and **it is shown only once**. Meraki will not display it again; you would have to revoke and regenerate. > **Use a dedicated service admin.** The key dies with the admin account that owns it. If you generate it from a person's account and that person leaves, ingestion stops. Create a dedicated read-only org admin (for example `configview-api@yourcompany.com`), and generate the key from there. *** ## Step 3: Add the secret to ConfigView 1. Go to your ConfigView dashboard: `https://{companyname}.configview.com/admin/secret/` 2. Click **Add Secret** 3. **Secret name:** `MERAKI_API_KEY` 4. **Secret value:** Paste the 40-character key from Step 2 5. Click **Save** *** ## Step 4: Enable the Meraki scripts 1. Go to: `https://{companyname}.configview.com/admin/cron/` 2. You should see **meraki** in the list of available apps 3. Enable scripts. Parents must be enabled before children — ConfigView wires the dependencies automatically, but load order matters for first-run timing. ### Foundation — enable these first Everything else reads its context from these four tables. | Script | Notes | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | **Organizations** | Every org the API key can see. **All other scripts depend on this.** | | **Networks** | All networks per org. The wireless collectors filter this to networks with a `wireless` product type. **Depends on Organizations.** | | **Devices** | Full hardware inventory (MR, MS, MX, MV...). The per-AP scripts read the `wireless` rows. **Depends on Organizations.** | | **Device Statuses** | Online / offline / alerting / dormant, plus public IP, uplink IP, gateway and DNS per device. **Depends on Organizations.** | ### Wi-Fi troubleshooting — the ones that answer "why is it broken" | Script | Notes | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Failed Connections** | The single most useful table here. One row per failed client connection with the exact `failure_step` — `assoc`, `auth`, `dhcp`, or `dns` — plus client MAC, AP serial, SSID and VLAN. Start every Wi-Fi investigation here. | | **Connection Stats (Network)** | Aggregate success vs. failure counts per network over the window. | | **Connection Stats by Client** / **by AP** | The same breakdown attributed to a specific client MAC or AP serial — tells you whether a problem is one laptop or one access point. | | **Latency Stats (Network)** / **by Client** / **by AP** | Average latency split by traffic class (background, best-effort, video, voice). Voice latency is the one users feel. | | **Packet Loss by AP** / **by Client** | Upstream and downstream loss counts and percentages. | | **Channel Utilization by AP** | How congested each band is per AP, right now. | | **Channel Utilization History** | 10-minute utilization buckets over the last day — use this to find *when* it degraded. Meraki only accepts a 600-second resolution on this endpoint. | | **Air Marshal (Rogue APs)** | Every foreign SSID/BSSID your APs can hear, with channel, encryption, and whether it is contained. The usual culprit behind unexplained interference. | | **Assurance Alerts** | Meraki's own health alerts, with severity and resolution state. | | **Wireless Event Log** | Raw wireless events — association, deauthentication, DHCP, 802.1X. The most granular record available. | | **Mesh Statuses** | Mesh route and performance per repeater. Only meaningful on networks with mesh APs. | | **AP CPU Load** | Time-series CPU load per AP. A pegged AP drops clients. | | **AP Ethernet & PoE Status** | Uplink negotiation, duplex, speed, and PoE standard per AP port. Catches the "AP keeps rebooting" caused by an underpowered PoE switch port. | | **Client Counts by AP** | Online client count per AP — reveals uneven load. | | **AP Live Radio Status** | Live per-radio BSSID, channel, width, and power. | | **SSID Statuses by AP (BSSIDs)** | Org-wide view of which AP is broadcasting which SSID, on what channel, at what power. | ### Wireless configuration — the "settings" half | Script | Notes | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SSIDs** | All 15 SSID slots per network: auth mode, encryption, VLAN tagging, band selection, minimum bitrate, bandwidth limits, RADIUS servers, 802.11w/r. **The per-SSID scripts below depend on this** and only walk SSIDs where `enabled = 1`. | | **Wireless Settings** | Network-level meshing, IPv6 bridging, LED state, regulatory domain and 6 GHz permission. | | **RF Profiles** | Per-band min/max power, valid auto channels, channel width, RX-SOP, band steering, client balancing. | | **RF Profile Assignments by AP** | Which RF profile each AP actually has applied. | | **AP Radio Settings** | Per-AP manual channel and target power overrides. **A manual override left on one AP is a classic root cause** — this table is how you find it. | | **Radio RRM by Network** | Auto-RF / RRM state per network. | | **SSID L3 Firewall Rules** / **L7 Firewall Rules** | Per-SSID rules, in order. Answers "why can't this SSID reach that subnet". | | **SSID Traffic Shaping** | Per-client bandwidth limits and DSCP/PCP tagging rules. | | **SSID Splash Settings** | Captive portal configuration per SSID. | | **Splash Login Attempts** | Who authenticated against the captive portal, and whether it succeeded. | | **SSID Identity PSKs** | iPSK entries with their group policy. **Passphrases are never stored** — see the note below. | | **SSID EAP Override** | EAP/EAPOL timeouts and retry counts. Tune these when 802.1X clients fail intermittently. | | **SSID Availability Schedules** | Time windows when each SSID is broadcast. | | **SSID Device-Type Policies** | Per-device-type group policy assignment. | | **SSID VPN / Concentrator** | Concentrator, failover, and split-tunnel configuration. | | **SSID Bonjour Forwarding** | Bonjour/mDNS forwarding rules — relevant to AirPlay and printer discovery complaints. | | **SSID Hotspot 2.0** | Passpoint configuration. | | **AP Ethernet Port Profiles** | Port profile definitions applied to AP ethernet ports. | | **Bluetooth Settings** | BLE scanning and advertising per network. | | **Alternate Management Interface** | Out-of-band management VLAN and protocols. | | **Air Marshal Rules** / **Air Marshal Settings** | Org-wide rogue-AP containment rules and the default policy per network. | | **Clients** | Every client seen in the window: MAC, IP, OS, manufacturer, VLAN, SSID, usage, and which AP it last attached to. | *** ## Credentials are never stored Two fields are deliberately dropped before anything is written to the database: * **`psk`** on `meraki_wireless_ssids` — the pre-shared key for PSK SSIDs * **`passphrase`** on `meraki_wireless_ssid_identity_psks` — iPSK passphrases They are stripped from the flattened columns *and* from the `raw_json` snapshot, and replaced with `[redacted]`. A ConfigView database dump can therefore never become a Wi-Fi passphrase dump. If you need to verify a PSK, use the Meraki dashboard. *** ## Rate limits and scheduling Meraki allows **10 requests per second per organization** (burst +10, max 30 in 2 seconds) and 100 requests/second per source IP. That ceiling is shared with every other application hitting the same org, including Meraki's own integrations. ConfigView paces evenly rather than bursting, defaulting to **5 requests/second** — half the budget, leaving room for whatever else touches the org. `429` responses carry a `Retry-After` header, which the collectors honour before retrying. Cost scales with the size of the estate: * **Org-wide collectors** — 1 call each, regardless of size * **Per-network collectors** — 1 call per wireless network * **Per-AP collectors** — 1 call per access point (2 scripts) * **Per-SSID collectors** — 1 call per *enabled* SSID per network (11 scripts). Disabled SSID slots are skipped, which is usually a 5× saving For a site with 10 networks, 3 enabled SSIDs each, and 100 APs, a full sweep is roughly 800 calls — under three minutes. Daily is a sensible cadence for the configuration scripts; the health and event scripts are worth running more often, since they look back over a 24-hour window. The time-windowed scripts (failed connections, connection and latency stats, packet loss, Air Marshal, clients, channel utilization history) use a **24-hour** lookback. Each run stores a fresh snapshot under its own `run_at`, so history accumulates in the table even though each call only asks for a day. ### Watch these three for row growth Most tables here are small — tens to hundreds of rows per run. Three are not, and they are the ones to re-schedule or disable if the database grows faster than you want: | Table | Rows per run | Why | | ------------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | | `meraki_air_marshal` | thousands to tens of thousands | Every foreign BSSID your APs can hear. In a dense office building this is dominated by neighbouring networks, not yours. | | `meraki_wireless_ap_cpu_load` | \~260 per AP | A 5-minute CPU sample series per access point over the 24-hour window. | | `meraki_network_health_channel_utilization` | \~144 per AP radio | 10-minute buckets over 24 hours, per radio. | They are genuinely useful, so they are enabled by default — but on a daily schedule they are the bulk of your row growth. If Air Marshal is noisy for you, a weekly cadence still catches a persistent rogue. *** ## Table reference | Table | Meraki endpoint | Key columns | | ------------------------------------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `meraki_organizations` | `GET /organizations` | org\_id, org\_name, url, api\_enabled, licensing\_model, cloud\_region\_name, cloud\_region\_host | | `meraki_networks` | `GET /organizations/{org_id}/networks` | network\_id, network\_name, product\_types, time\_zone, tags, enrollment\_string, url | | `meraki_devices` | `GET /organizations/{org_id}/devices` | network\_id, serial, name, model, mac, lan\_ip, firmware | | `meraki_device_statuses` | `GET /organizations/{org_id}/devices/statuses` | network\_id, serial, name, mac, model, product\_type, status | | `meraki_wireless_ssid_statuses` | `GET /organizations/{org_id}/wireless/ssids/statuses/byDevice` | network\_id, network\_name, serial, device\_name, bssid, ssid\_name, ssid\_number | | `meraki_wireless_client_counts` | `GET /organizations/{org_id}/wireless/clients/overview/byDevice` | network\_id, serial, clients\_online | | `meraki_wireless_channel_utilization` | `GET /organizations/{org_id}/wireless/devices/channelUtilization/byDevice` | network\_id, serial, mac, band, wifi\_percentage, non\_wifi\_percentage, total\_percentage | | `meraki_wireless_packet_loss_by_device` | `GET /organizations/{org_id}/wireless/devices/packetLoss/byDevice` | network\_id, network\_name, serial, device\_name, device\_mac, downstream\_total, downstream\_lost | | `meraki_wireless_packet_loss_by_client` | `GET /organizations/{org_id}/wireless/devices/packetLoss/byClient` | network\_id, network\_name, client\_id, client\_mac, downstream\_total, downstream\_lost, downstream\_loss\_pct | | `meraki_wireless_ap_ethernet_statuses` | `GET /organizations/{org_id}/wireless/devices/ethernet/statuses` | network\_id, serial, device\_name, power\_mode, ac\_connected, poe\_connected, aggregation\_enabled | | `meraki_wireless_rf_profile_assignments` | `GET /organizations/{org_id}/wireless/rfProfiles/assignments/byDevice` | network\_id, serial, device\_name, model, rf\_profile\_id, rf\_profile\_name, is\_indoor\_default | | `meraki_assurance_alerts` | `GET /organizations/{org_id}/assurance/alerts` | alert\_id, network\_id, network\_name, category\_type, alert\_type, title, description | | `meraki_air_marshal_rules` | `GET /organizations/{org_id}/wireless/airMarshal/rules` | network\_id, rule\_id, rule\_type, match\_string, match\_type, created\_at, updated\_at | | `meraki_air_marshal_settings` | `GET /organizations/{org_id}/wireless/airMarshal/settings/byNetwork` | network\_id, default\_policy | | `meraki_wireless_radio_rrm` | `GET /organizations/{org_id}/wireless/radio/rrm/byNetwork` | network\_id, network\_name, time\_zone, busy\_hour\_json, channel\_json, fra\_json, ai\_json | | `meraki_wireless_ap_cpu_load` | `GET /organizations/{org_id}/wireless/devices/system/cpu/load/history` | network\_id, network\_name, serial, device\_name, model, mac, cpu\_count | | `meraki_wireless_settings` | `GET /networks/{network_id}/wireless/settings` | meshing\_enabled, ipv6\_bridge\_enabled, location\_analytics\_enabled, upgrade\_strategy, upgrade\_predownload\_enabled, led\_lights\_on, multicast\_to\_unicast\_enabled | | `meraki_wireless_ssids` | `GET /networks/{network_id}/wireless/ssids` | ssid\_number, name, enabled, splash\_page, auth\_mode, encryption\_mode, wpa\_encryption\_mode | | `meraki_wireless_rf_profiles` | `GET /networks/{network_id}/wireless/rfProfiles` | rf\_profile\_id, name, client\_balancing\_enabled, min\_bitrate\_type, band\_selection\_type, band\_operation\_mode, band\_steering\_enabled | | `meraki_wireless_failed_connections` | `GET /networks/{network_id}/wireless/failedConnections` | ts, client\_mac, serial, ssid\_number, vlan, radio, failure\_step | | `meraki_wireless_connection_stats` | `GET /networks/{network_id}/wireless/connectionStats` | assoc, auth, dhcp, dns, success, timespan\_seconds | | `meraki_wireless_client_connection_stats` | `GET /networks/{network_id}/wireless/clients/connectionStats` | client\_mac, assoc, auth, dhcp, dns, success, timespan\_seconds | | `meraki_wireless_device_connection_stats` | `GET /networks/{network_id}/wireless/devices/connectionStats` | serial, assoc, auth, dhcp, dns, success, timespan\_seconds | | `meraki_wireless_latency_stats` | `GET /networks/{network_id}/wireless/latencyStats` | background\_avg\_ms, best\_effort\_avg\_ms, video\_avg\_ms, voice\_avg\_ms, background\_distribution\_json, best\_effort\_distribution\_json, video\_distribution\_json | | `meraki_wireless_client_latency_stats` | `GET /networks/{network_id}/wireless/clients/latencyStats` | client\_mac, background\_avg\_ms, best\_effort\_avg\_ms, video\_avg\_ms, voice\_avg\_ms, timespan\_seconds | | `meraki_wireless_device_latency_stats` | `GET /networks/{network_id}/wireless/devices/latencyStats` | serial, background\_avg\_ms, best\_effort\_avg\_ms, video\_avg\_ms, voice\_avg\_ms, timespan\_seconds | | `meraki_air_marshal` | `GET /networks/{network_id}/wireless/airMarshal` | ssid, bssid, contained, channels, encryption, types, manufacturers | | `meraki_wireless_mesh_statuses` | `GET /networks/{network_id}/wireless/meshStatuses` | serial, mesh\_route, latest\_mbps, latest\_metric, latest\_usage\_percentage | | `meraki_network_health_channel_utilization` | `GET /networks/{network_id}/networkHealth/channelUtilization` | serial, model, tags, radio, start\_time, end\_time, utilization\_total | | `meraki_clients` | `GET /networks/{network_id}/clients` | client\_id, mac, ip, ip6, ip6\_local, description, user | | `meraki_wireless_events` | `GET /networks/{network_id}/events` | occurred\_at, event\_type, description, category, client\_id, client\_description, client\_mac | | `meraki_splash_login_attempts` | `GET /networks/{network_id}/splashLoginAttempts` | name, login, ssid, login\_at, gateway\_device\_mac, client\_mac, client\_id | | `meraki_wireless_bluetooth_settings` | `GET /networks/{network_id}/wireless/bluetooth/settings` | scanning\_enabled, advertising\_enabled, uuid, major\_minor\_assignment\_mode, major, minor, esl\_enabled | | `meraki_wireless_alternate_mgmt_interface` | `GET /networks/{network_id}/wireless/alternateManagementInterface` | enabled, vlan\_id, protocols, access\_points\_json | | `meraki_wireless_ethernet_port_profiles` | `GET /networks/{network_id}/wireless/ethernet/ports/profiles` | profile\_id, name, is\_default, ports\_json, usb\_ports\_json | | `meraki_wireless_radio_settings` | `GET /devices/{serial}/wireless/radio/settings` | rf\_profile\_id, two\_four\_channel, two\_four\_target\_power, five\_channel, five\_channel\_width, five\_target\_power | | `meraki_wireless_ap_status` | `GET /devices/{serial}/wireless/status` | ssid\_name, ssid\_number, enabled, band, bssid, channel, channel\_width | | `meraki_wireless_ssid_l3_firewall_rules` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/firewall/l3FirewallRules` | rule\_index, comment, policy, protocol, ip\_ver, dest\_port, dest\_cidr | | `meraki_wireless_ssid_l7_firewall_rules` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/firewall/l7FirewallRules` | rule\_index, policy, rule\_type, value | | `meraki_wireless_ssid_traffic_shaping` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/trafficShaping/rules` | traffic\_shaping\_enabled, default\_rules\_enabled, rule\_index, definitions\_json, per\_client\_limit\_up, per\_client\_limit\_down, per\_client\_settings | | `meraki_wireless_ssid_splash_settings` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/splash/settings` | splash\_page, use\_splash\_url, splash\_url, splash\_timeout, use\_redirect\_url, redirect\_url, welcome\_message | | `meraki_wireless_ssid_identity_psks` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/identityPsks` | identity\_psk\_id, name, group\_policy\_id, email, wifi\_personal\_network\_id, expires\_at | | `meraki_wireless_ssid_schedules` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/schedules` | enabled, range\_index, start\_day, start\_time, end\_day, end\_time | | `meraki_wireless_ssid_eap_override` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/eapOverride` | timeout, max\_retries, identity\_retries, identity\_timeout, eapol\_key\_retries, eapol\_key\_timeout\_ms | | `meraki_wireless_ssid_device_type_policies` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/deviceTypeGroupPolicies` | enabled, device\_type, device\_policy, group\_policy\_id | | `meraki_wireless_ssid_hotspot20` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/hotspot20` | enabled, operator\_name, venue\_name, venue\_type, network\_access\_type, domains, roam\_consort\_ois | | `meraki_wireless_ssid_bonjour_forwarding` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/bonjourForwarding` | enabled, exception\_enabled, rule\_index, description, vlan\_id, services | | `meraki_wireless_ssid_vpn` | `GET /networks/{network_id}/wireless/ssids/{ssid_number}/vpn` | concentrator\_network\_id, concentrator\_vlan\_id, concentrator\_name, failover\_request\_ip, failover\_heartbeat\_interval, failover\_idle\_timeout, split\_tunnel\_enabled | Every table also carries `org_id`, `org_name`, a `raw_json` copy of the source object, and a `run_at` batch timestamp. Network-scoped tables add `network_id` and `network_name`; per-AP tables add `serial` and `device_name`; per-SSID tables add `ssid_number` and `ssid_name`. *** ## Troubleshooting **Everything returns 404.** Dashboard API access is not enabled on that organization. See Step 1 — it is a per-org switch, and enabling it in one org does nothing for the others. **401 on every call.** The key was revoked, or the admin account that owns it was deactivated. Generate a new one and update the secret. **Some networks are missing.** The key belongs to a network-scoped admin. Regenerate it from a full organization admin. **Wireless tables are empty but `meraki_devices` has rows.** Check `product_types` on `meraki_networks` — the wireless collectors only walk networks that include `wireless`. A network of MX/MS hardware with no MR access points is correctly skipped. **Per-SSID tables are empty.** They depend on `meraki_wireless_ssids` and only walk SSIDs with `enabled = 1`. Run the **SSIDs** script first; if every SSID slot is disabled, there is genuinely nothing to fetch. **A single script logs `400`/`403`/`404` and continues.** That is deliberate. Hotspot 2.0, Bluetooth, mesh, and the alternate management interface are not supported on every hardware generation or licence tier, so an unavailable endpoint is skipped with a log line rather than failing the whole run. *** ## What you can't ingest with this setup * **Per-client connectivity events** (`GET /networks/{id}/wireless/clients/{clientId}/connectivityEvents`). One call per client — infeasible to sweep for an estate of any size. The network-level **Wireless Event Log** covers the same ground in aggregate. Open a feature request if you need per-client depth for a named investigation. * **Live tools** (ping, cable test, throughput test, packet capture). These are on-demand actions against a device, not inventory — they mutate state and take seconds to minutes to return. Out of scope for a scheduled collector. * **Signal-quality, client-count, data-rate and usage history.** Deliberately left out of this pass to keep row growth predictable. The **Channel Utilization History** script is included as the representative time-series. Request the others if you want them. * **Non-wireless product families.** Switch ports, appliance/MX firewall rules, VPN status, camera and sensor data are all available in the Meraki API but out of scope here — this integration is scoped to Wi-Fi. `meraki_devices` still inventories the full hardware estate.