diff --git a/src/wifi_ubus.c b/src/wifi_ubus.c
index 57a4f64c63e01c38ee99c632cb2b7dcc6499a1ac..2bb3a4c8daebd83f03872ce02150285299b2d963 100644
--- a/src/wifi_ubus.c
+++ b/src/wifi_ubus.c
@@ -915,7 +915,6 @@ int wifi_ubus_request_transition(struct ubus_context *ubus_ctx, const char *ifna
 	struct blob_buf bb = {};
 	char name[256] = {};
 	char macstr[18] = {};
-	uint8_t *bssid;
 	uint32_t id;
 	uint8_t mode = 0;
 	int ret;
@@ -931,12 +930,15 @@ int wifi_ubus_request_transition(struct ubus_context *ubus_ctx, const char *ifna
 		goto out;
 
 	blob_buf_init(&bb, 0);
-	blobmsg_add_string(&bb, "client", macstr);
-	t = blobmsg_open_array(&bb, "bssid");
+	blobmsg_add_string(&bb, "sta", macstr);
+	t = blobmsg_open_array(&bb, "target_ap");
 	for (i = 0; i < bss_num; i++) {
-		bssid = &bss[i * 6];
-		snprintf(macstr, sizeof(macstr), MACFMT, MAC2STR(bssid));
-		blobmsg_add_string(&bb, "", macstr);
+		void *tt;
+
+		tt = blobmsg_open_table(&bb, "");
+		snprintf(macstr, sizeof(macstr), MACFMT, MAC2STR(&bss[i * 6]));
+		blobmsg_add_string(&bb, "bssid", macstr);
+		blobmsg_close_table(&bb, tt);
 	}
 	blobmsg_close_array(&bb, t);