Device Management
Ubiquiti UniFi
Run your Ubiquiti UniFi networks from Dex - console and site health, device and client inventory, ISP metrics, and Network administration through the cloud connector.
Dex connects to Ubiquiti UniFi through the Site Manager API and the cloud connector so admins can see fleet and site health, browse devices and clients, read WAN/ISP metrics, and administer the UniFi Network application on a console - Wi-Fi, networks, firewall, DNS, ACLs, and hotspot vouchers. The Site Manager endpoints are read-only; every write rides through the cloud connector, which is confined to one console at a time. Employees can self-diagnose slow or dropping Wi-Fi against their own site through Dex Go, read-only. Available as an MSP global app: one API key covers the whole UniFi account and each Dex tenant is mapped to a single UniFi console (host) so it sees only its own network.
What Dex does with Ubiquiti UniFi
Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.
A
For admins (Dex Pro)
- Inventory every UniFi console (host) the API key can see, with type, public IP, and last connection state change
- Read per-site health - device and client counts, WAN uptime, detected ISP, and recorded internet issues - in one call
- List adopted devices grouped by console, with status, model, firmware state, and uptime
- Read WAN/ISP metrics at 5m (24h retention) or 1h (7d/30d) granularity, and query named sites over an explicit time range
- List clients, Wi-Fi broadcasts, networks/VLANs, firewall policies and zones, ACL rules, DNS policies, and hotspot vouchers on a network site
- Authorize or unauthorize guest access for a single client, and generate hotspot vouchers
- Restart a device or power-cycle a PoE port, adopt or unadopt a device, and create/edit/delete Wi-Fi, firewall, ACL, and DNS configuration - with approval
- Deploy as an MSP global app - one API key across the account, each customer confined to its own UniFi console by host id
E
For employees (self-service)
- Check whether the internet at your location is up, and how the WAN has behaved recently
- See whether the access point near you is offline and how long it has been down
- Check whether your own device shows up as a connected client and which access point it is on
Just ask Dex
Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.
Admin prompts
- >Which access points across this customer are offline right now?
- >What was the WAN uptime for the London site over the last 24 hours - any recorded internet issues?
- >List the consoles that have devices with a firmware update available
- >Restart the Office AP - confirm the exact device with me first
- >Generate 10 guest vouchers for reception, good for 24 hours
Employee prompts
- >Is the internet at my office down right now?
- >The Wi-Fi keeps dropping - has the WAN been unstable lately?
- >Is my laptop showing up as connected, and which access point is it on?
Policy actions
Every action Dex can take on Ubiquiti UniFi is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.
| Action | What it does |
|---|---|
unifi_list_hosts | List UniFi consoles (hosts) visible to the API key, with type, public IP, and last connection state change |
unifi_view_host | Read one UniFi console by host id, including which applications are installed |
unifi_list_sites | List UniFi sites across all consoles with per-site device/client counts, WAN uptime, and ISP info |
unifi_list_devices | List adopted UniFi devices grouped by console, with status, model, firmware state, and uptime |
unifi_get_isp_metrics | Read WAN/ISP metrics across sites at 5m (24h retention) or 1h (7d/30d) granularity |
unifi_query_isp_metrics | Query WAN/ISP metrics for named sites by hostId + siteId over an explicit time range |
unifi_list_sdwan_configs | List SD-WAN configurations on the UniFi account |
unifi_view_sdwan_config | Read one SD-WAN configuration by id |
unifi_view_sdwan_status | Read the deployment status of one SD-WAN configuration |
unifi_view_app_info | Read the UniFi Network application version and info on a console through the cloud connector |
unifi_list_network_sites | List the network sites on a console through the cloud connector (source of the Network application siteId) |
unifi_list_clients | List clients currently connected to a network site, with access point and session detail |
unifi_list_adopted_devices | List devices adopted by a network site through the cloud connector |
unifi_view_device_stats | Read the latest statistics for one adopted device - uptime, load, and throughput |
unifi_list_wifi | List Wi-Fi broadcasts (SSIDs) configured on a network site |
unifi_list_networks | List networks/VLANs configured on a network site |
unifi_list_firewall | List firewall policies and zones on a network site, including their evaluation order |
unifi_list_acl_rules | List ACL rules on a network site, including their evaluation order |
unifi_list_dns_policies | List DNS policies on a network site |
unifi_list_vouchers | List hotspot guest vouchers on a network site |
unifi_list_wans | List WAN interfaces on a network site |
unifi_client_action | Authorize or unauthorize guest network access for a single client (reversible; there is no block/reconnect action on this API) |
unifi_create_voucher | Generate hotspot guest vouchers with a time, data, or rate limit - voucher codes are sensitive |
unifi_device_action | Restart an adopted UniFi device - disruptive; restarting a gateway takes the whole site offline for minutes |
unifi_port_action | Power-cycle PoE on one switch port - drops everything powered by that port |
unifi_adopt_device | Adopt a pending device into a network site by MAC address |
unifi_remove_device | Unadopt (remove) a device from a network site - destructive; the device must be re-adopted on site |
unifi_create_wifi | Create a Wi-Fi broadcast (SSID) on a network site |
unifi_update_wifi | Replace a Wi-Fi broadcast (SSID) configuration - a partial body drops settings; changing the passphrase disconnects every client |
unifi_delete_wifi | Delete a Wi-Fi broadcast (SSID) - every client on it loses connectivity |
unifi_delete_voucher | Delete hotspot vouchers |
unifi_create_firewall_policy | Create a firewall policy (ALLOW / BLOCK / REJECT) on a network site - position in the evaluation order decides its effect |
unifi_update_firewall_policy | Replace a firewall policy on a network site |
unifi_delete_firewall_policy | Delete a firewall policy from a network site - may open traffic that the policy was blocking |
unifi_reorder_firewall_policies | Rewrite the firewall policy evaluation order wholesale - order IS the policy |
unifi_create_firewall_zone | Create a firewall zone on a network site |
unifi_update_firewall_zone | Replace a firewall zone definition - changing which networks it covers changes every policy that references it |
unifi_delete_firewall_zone | Delete a firewall zone - destructive; any policy referencing the zone breaks |
unifi_create_acl_rule | Create an ACL rule on a network site - its position in the evaluation order decides its effect |
unifi_update_acl_rule | Replace an ACL rule on a network site |
unifi_delete_acl_rule | Delete an ACL rule from a network site - may open traffic the rule was denying |
unifi_reorder_acl_rules | Rewrite the ACL rule evaluation order wholesale - position decides the outcome |
unifi_create_dns_policy | Create a DNS policy on a network site - DNS policies decide what the site can resolve |
unifi_update_dns_policy | Replace a DNS policy on a network site |
unifi_delete_dns_policy | Delete a DNS policy from a network site - removes whatever filtering or redirection it was applying |
How to configure Ubiquiti UniFi
Onboarding takes minutes. Dex validates your credentials before saving them.
Setup steps
- 1Sign in to the UniFi Site Manager at unifi.ui.com, go to Settings > API Keys, and create a new API key. The key is shown only once at creation.
- 2Decide the scope: a personal key reaches only the consoles that account owns, an organization key reaches every console in the organization.
- 3In Dex, enable the Ubiquiti UniFi integration and paste the API key.
- 4For MSPs, deploy as a global app and map each customer tenant to its UniFi Host ID (console id) - the "id" field from GET /v1/hosts on the master connection, not the siteId and not the console name.
- 5Dex validates the key with a live read and resolves the mapped console before saving. Leave host_id blank only on the MSP master connection.
Credentials required
- api_key
- UniFi Site Manager API key from unifi.ui.com > Settings > API Keys > Create New API Key (shown once at creation)
- host_id
- UniFi Host ID (console id) this tenant maps to - the "id" field from GET /v1/hosts. Leave blank on the MSP master connection for account-wide access
Requirements
- •A UniFi account with an API key created in the Site Manager
- •Console firmware 5.0.3 or later and the console online for cloud connector (Network administration) access
- •Site Manager endpoints are read-only - every write goes through the cloud connector, which is confined to one console at a time
- •Write access on the API key is currently UNVERIFIED - a write may return 403 insufficient permissions until Ubiquiti enables write access on the key
- •For MSPs, deploy as a global app with one shared API key and per-tenant scoping by host id
Related integrations
Device ManagementLansweeper
Bring your Lansweeper IT asset inventory into Dex so you can browse discovered assets in plain language.
Learn more →
RMM & EndpointNinjaOne
Monitor and manage your NinjaOne fleet - device inventory, patch and antivirus status, alerts, and on-demand actions.
Learn more →
RMM & EndpointDatto RMM
Manage Datto RMM sites, devices, alerts, and on-demand jobs from plain-language requests.
Learn more →
See Dex run Ubiquiti UniFi
Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.