Cisco Meraki (Dashboard)

Cisco Meraki is a cloud-managed enterprise network + IoT platform: MR access points, MS switches, MX security appliances, MV cameras, and MT environmental sensors are all administered from the same Dashboard (dashboard.meraki.com) and exposed to integrators through the REST API at api.meraki.com/api/v1. This driver treats one Meraki organization as one GEM device and lets you:

• Monitor every Meraki device — online/offline, model, firmware, LAN IP, last-reported timestamp.
• Control MS switch ports — enable/disable (on / off) and set PoE (set_port_poe).
• Snapshot MV cameras on demand.
• Blink identify LEDs or reboot a device.
• Ingest MT sensor readings — temperature, humidity, water leak, door open/close, CO2, TVOC, PM2.5, noise, power, current, voltage.

Deep configuration (VLANs, wireless SSIDs, IPS rules, content filtering, RF profiles) stays in Dashboard. This driver is intentionally a monitoring + basic-control surface, not a Dashboard replacement.

Prerequisites

• A Meraki Dashboard account with membership on the target organization. Read-only is enough for monitoring and MT readings; read-write is required for switch-port control, blink_leds, reboot, and MV snapshot generation.
• Dashboard API access must be enabled organization-wide first. Log into Dashboard and go to Organization → Settings → Dashboard API access → Enable access to the Cisco Meraki Dashboard API. Without this, every API call returns 404 even with a valid key.
• A generated API key (see setup below). It's a 40-character opaque string, shown once at generation, and inherits the parent account's role scope across every organization the account belongs to.
• For MT sensor readings: The MT devices (MT10, MT12, MT14, MT20, MT30, MT40) must be claimed into a Sensor-type network. The /sensor/readings/latest endpoint only returns data for MT devices; MR, MS, MX, and MV do not report through that endpoint.
• For MV snapshots: the target MV camera must be online, licensed, and have a valid RTSP feed. The snapshot endpoint returns a signed URL that becomes valid a few seconds after the request.

Setup

1. Enable API access org-wide. Dashboard → Organization → Settings → scroll to Dashboard API access → check the box → Save.
2. Generate an API key. Click your name in the top-right of Dashboard → My Profile → scroll to API access → Generate new API key → give it a descriptive label (e.g. "GEM — HQ Controller") → Copy the shown key immediately. It is not shown again.
3. Add the device in GEM. Go to Admin → System → Devices, click New Device, pick the driver Cisco Meraki (Dashboard), name the device (e.g. "Meraki — HQ"), and Save.
4. Paste the credential. In the device row, set the Meraki Dashboard API Key attribute to the string you copied.
5. Wait for auto-detection. If the API key spans exactly one organization, the driver detects it and writes org_id automatically. You'll see meraki dashboard auto-selected single org in the log.
6. Multi-org accounts: run the get_organizations command, copy the id for the target org, and paste it into the Organization ID attribute.
7. Enumerate the fleet. Run get_devices. The response lists every device with its serial, model, networkId, productType, etc. Copy the serials of devices you want to expose as GEM zones.
8. Create zones. In Admin → System → Zones, add one zone per Meraki device (or per switch port):
   • Address = <serial> for whole-device monitoring, e.g. Q234-ABCD-5678.
   • Address = port:<serial>:<port_id> for a specific MS switch port, e.g. port:Q234-ABCD-5678:1.
   • Set Subsystem to sensor for MT zones, power for a MT PoE-sensor zone, network for MR/MS/MX, or camera for MV.

Attribute Reference

Device attributes

Attribute	Required	Description
api_key	yes	Dashboard API key. Secure — stored encrypted.
org_id	multi-org only	Meraki organization id. Auto-detected for single-org keys.
network_id	no	Restrict roster/sensor polls to a single Meraki network. Useful for multi-tenant orgs.
api_base	no	Override the base URL. Default https://api.meraki.com/api/v1. Meraki-China (api.meraki.cn/api/v1) and Meraki-Gov tenants use different bases.
status_interval	no	Device status sweep cadence (ms). Default 60000. Meraki caches statuses ~2-5 min server-side; going faster gains nothing.
sensor_interval	no	MT reading poll cadence (ms). Default 60000. Set to 0 to skip if you have no MT devices.

Zone attributes (populated by the driver)

Attribute	Source	Description
online	device status	Boolean. Whether the device reports as online.
status	device status	Raw status token: online, offline, alerting, dormant.
last_reported_at	device status	ISO timestamp of the device's last check-in.
device_name	device roster	Friendly name from Dashboard.
model	device roster	e.g. MS250-48LP, MR46, MV12WE, MT20.
lan_ip	device roster	LAN IP if applicable.
temperature_c / temperature_f	MT temperature	Both units surfaced; Meraki reports both.
humidity	MT humidity	% relative humidity.
water_present	MT water	Boolean — leak sensor.
door_open	MT door	Boolean — plus state = open/closed.
battery_level	MT battery	Percentage.
co2 / tvoc / pm25	MT IAQ	ppm / ppb / µg/m³.
noise_db	MT noise	Ambient dB.
power_w / apparent_power_va / current_a / voltage_v	MT power	Real + apparent power, current, voltage.
iaq_score	MT indoor air quality	0-100 score.
last_button_press	MT button	shortPress / longPress.
last_reading_ts	MT	ISO timestamp of the most recent reading.
state	switch port control	on / off after an on/off command. Also open/closed for MT door zones.

Zone Address Format

Two shapes, distinguished by prefix:

• Whole-device monitoring: Q234-ABCD-5678 — the Meraki serial, exactly as shown in Dashboard.
• Switch port control: port:<serial>:<port_id> — e.g. port:Q234-ABCD-5678:1. Port ids are strings ("1", "2", …, or "1/1" on stackable models); use the format Dashboard shows in the port table.

The driver infers zone type from address shape. Override via the zone attribute meraki_type (device or port) only if you have an unusual naming scheme.

Commands

Command	Args	Description
on	address (port)	Enable a switch port.
off	address (port)	Disable a switch port.
set_port_poe	address (port), poe bool	Toggle PoE on a switch port.
blink_leds	address (serial)	Blink identify LEDs for 20s.
reboot	address (serial)	Reboot the device. Meraki disallows this on MX by default.
get_camera_snapshot	address (MV serial), optional timestamp	Trigger MV snapshot; returns a signed URL. May 404 for a few seconds while rendering.
get_organizations	none	List orgs visible to the API key.
get_networks	none	List networks in the configured org.
get_devices	optional network_id	List all devices in the org. Honors network_id filter attribute.
get_status	address (serial)	Per-device Dashboard record.
get_switch_ports	address (MS serial)	Live port statuses (up/down, speed, traffic counters).
get_sensor_readings	none	Latest MT readings across the org.
refresh	none	Rebuild the local device and network caches.

Known Limitations

• Server-cached status. Meraki caches device status by ~2-5 minutes. Polling faster than 60s does not make the data fresher; it just burns quota. Live traffic-graph-level polling is a Dashboard UI capability, not an API one.
• Rate limits are per organization, not per key. Two GEM controllers pointing at the same org share the 10 req/sec ceiling. The driver honors Retry-After on 429 up to 3 attempts before surfacing an error.
• Switch port control requires MS. MR access-point Ethernet ports and MX WAN/LAN ports do not expose the /switch/ports/{id} PUT surface. Attempting on/off on a non-MS device returns a Meraki 400.
• MV snapshot is asynchronous. The snapshot URL is returned immediately but the JPEG may not be ready for 2-8 seconds. Callers polling the URL should be prepared for a brief 404 window before the image appears.
• No PTZ, no zoom. MV cameras do not expose PTZ control over the public API. The Vision UI in Dashboard is the only way to move a camera.
• No wireless SSID / policy / firewall CRUD in this driver. Those APIs exist but are out of scope; use raw_command in a future revision or edit in Dashboard.
• MG cellular and MI Insight are enumerated by get_devices but have no first-class GEM commands here.

Troubleshooting

Symptom: 401 unauthorized at connect, even with a fresh key.

• Confirm Organization → Settings → Dashboard API access is enabled. Meraki returns 401 (not 403) on org-wide-disabled APIs, which is misleading. Also verify the key was copied whole — it's a 40-character string.

Symptom: get_organizations returns [].

• The API key's underlying user has no org membership. Add the user in Dashboard → Organization → Administrators with at least "read-only" access.

Symptom: on/off/set_port_poe returns meraki 400: Product type invalid.

• Address serial is not an MS switch. Only MS devices expose per-port control. Confirm the model with get_status.

Symptom: reboot on MX returns 400.

• Meraki blocks API reboot on MX security appliances by default (to prevent accidental site takedowns). Reboot MX from Dashboard UI.

Symptom: MT readings show up in get_sensor_readings but not in zone attributes.

• The MT serial must be the exact zone address (no port: prefix, no capitalization change). Copy from get_devices.

Symptom: Every request returns meraki 429 rate limited (retries exhausted).

• Combined polls exceed the 10 req/sec ceiling on this org. Raise status_interval to 120000, sensor_interval to 120000, or disable one loop.

Symptom: MV get_camera_snapshot returns a URL, but fetching it 404s.

• Wait 3-5 seconds and re-fetch. Meraki's snapshot pipeline is async; the URL is stable but the image takes a moment to land in the CDN.

Also see

• UniFi Access driver — a comparable cloud-managed access-control platform.
• Verkada Command driver — sibling cloud-managed camera/access platform, similar auth model.
• Ubiquiti UniFi switches — LAN-managed switch control if you prefer local API.